Re: Making an interface for alternative data streams

[Steve French <smfrench@gmail.com>]

On Tue, Mar 22, 2016 at 11:13 PM, Steve French <smfrench@gmail.com> wrote:
> On Tue, Mar 22, 2016 at 4:42 PM, Jeremy Allison <jra@samba.org> wrote:
>> On Tue, Mar 22, 2016 at 04:08:01PM -0400, J. Bruce Fields wrote:
>>>
>>> But you do see people using "named attributes"/"alternative data
>>> streams"?
>>>
>>> This comes up at the LSF/MM summit every now and then and Jeremy Allison
>>> inevitably says "hah, only malware writers use those", and that's the
>>> end of the discussion.  Sounds like Richard Yao has heard otherwise, but
>>> it'd be nice to have actual examples of users.
>>
>> The only use I know of other than malware writers is
>> the :Zone.Identifier stream used by Internet Explorer.
>>
>> http://woshub.com/how-windows-determines-that-the-file-has-been-downloaded-from-the-internet/
>>
>> Not sure if the new Microsoft browser still uses them
>> (I haven't used desktop Windows in over 10 years).
>
> Yes, the browser still uses it (at least on the system I tried
> yesterday), and so do a few important subsystems (the file resource
> manager for example).  Presumably streams are used even more on Mac.
>
> I was experimenting with some patches in the last few weeks to list
> streams (either via an xattr as ntfs-3g does, but I am leaning toward
> an ioctl for cifs.ko).  They are needed for backup (at least), and not
> just for accessing Macs (which use resource forks extensively), but
> since Windows stores the zone identifier (where a file came from is
> stored when internet explorer downloads anything) in an alternate data
> stream, and also "FCI" (file classification information) is stored
> there.

I should also note that since SMB3 operations are handle based
(except open/create itself), I prefer using an ioctl rather than xattr
query to list streams.  In addition, by overlapping the alternate
data stream name space, with the EAs name space they are
harder to tell apart (xattrs are used less frequently on Windows
than in the past but they do show up from time to time,
e.g. in their Services for Unix).  Seems wrong to make it easy
to confuse streams and EAs (extended attributes).


-- 
Thanks,

Steve