kSFS: Secure In-Kernel File Systems

Overview

kSFS asks whether Linux can run file-system code in kernel space without giving that code the full authority of a native filesystem. The series moves from the broad blast radius of trusted in-kernel interfaces to FUSE’s request-and-recovery contract, then examines WebAssembly memory and control-flow isolation, capability-based resource access, fault and liveness recovery, and validated zero-copy I/O. Tests on selected NTFS and exFAT implementations show a workload-dependent middle ground: substantially better than ordinary FUSE in reported cases, but still slower than native Linux in several comparisons. The evidence supports a bounded microkernel-like boundary, not a complete microkernel, universal sandbox, or guarantee of filesystem data integrity.

Learning outcomes

kSFS keeps file-system code behind a FUSE-shaped contract while running it in an in-kernel WebAssembly sandbox.
WebAssembly limits memory and control flow, but capability policy, liveness controls, and trusted runtime support are separate requirements.
Validated zero-copy I/O and selective asynchronous work reduce FUSE overhead without making every filesystem operation concurrent.
The evaluation supports a workload-specific middle ground: better than ordinary FUSE in tested cases, but below native Linux and not a universal kernel sandbox.

Keywords

kSFSLinuxFUSEWebAssemblysandboxingmicrokernelcapabilitieszero-copylivenessWASI

Chapters

kSFS: Can Linux Isolate File Systems?

A bounded alternative to native code and user-space FUSE

12 min · A bounded alternative to native code and user-space FUSE

12 min

kSFS: Why File Systems Need Isolation

Where FUSE, eBPF, and memory-safe code fall short

10 min · Where FUSE, eBPF, and memory-safe code fall short

10 min

kSFS: How FUSE Enforces a Boundary

From kernel request to daemon—and back

8 min · From kernel request to daemon—and back

8 min

kSFS: What a Secure Boundary Must Guarantee

How layered controls turn a sandbox into a boundary

11 min · How layered controls turn a sandbox into a boundary

11 min

kSFS: WebAssembly in Kernel Space

From AOT compilation to fault recovery

12 min · From AOT compilation to fault recovery

12 min

kSFS: Zero-Copy I/O Without Losing Isolation

How metadata ordering enables asynchronous transfers

10 min · How metadata ordering enables asynchronous transfers

10 min

kSFS: Benchmark Results and Security Limits

Measured gains, fault tests, and what remains unproven

13 min · Measured gains, fault tests, and what remains unproven

13 min

kSFS: A File-System Boundary, Not a Microkernel

What the evidence supports—and where it stops

13 min · What the evidence supports—and where it stops

13 min

Preview every chapter · Unlock full text, audio, and video from chapter 4

Plans

Ch.1-3 FreeCh.4-8 Premium

FAQ

What is kSFS?

kSFS is a research framework that runs FUSE-compatible file-system code in an in-kernel WebAssembly sandbox while preserving a constrained interaction with Linux.

How does kSFS contain file-system faults?

kSFS is designed to contain representative memory, control-flow, stack, and liveness faults within an instance and limit resource access to authorized storage. It does not guarantee filesystem correctness or protect that storage from data loss.

Is kSFS faster than FUSE?

In the reported NTFS and exFAT tests, kSFS outperformed ordinary FUSE, but remained below native Linux in several comparisons. Its advantage depends on workload shape, in-kernel execution, validated zero-copy I/O, and selective asynchronous transfers.

Does kSFS turn Linux into a microkernel?

No. kSFS creates a microkernel-like boundary for file systems while Linux remains monolithic and continues to own the surrounding request path, storage stack, and trusted enforcement machinery.