emptyfs is a trivial VFS plug-in(kernel extension), its volumes are completely empty(except for the root directory).
This simple VFS plug-in is a minimal implementation, you can use it to explore VFS behaviours, or as a template as your own VFS plug-in.
You must install Apple's Command Line Tools as a minimal build environment, or Xcode as a full build environment in App Store.
$ make # Debug build
$ make release # Release buildTheoretically, this kext can be compile and run in macOS 10.4+, yet currently only from 10.10 up to 10.14 are tested.
If you compile in macOS >= 10.13 and wants the kext to stay compatible with macOS <= 10.12, you should specify -DKASAN or -D_FORTIFY_SOURCE=0 to CPPFLAGS, for more info, please refer to issues#1
# Under kext/ directory
$ make load # Load emptyfs kext
$ make stat # Print status of emptyfs kext
$ make unload # Unload emptyfs kext
TODO: add info about kext logging
# Under kext/ directory
$ make install
$ make uninstall # In case you want to uninstallYou can specify PREFIX variable to make for install location, the default is /Library/Extensions
TODO: add docs about HOWTO load at boot-up time
After installation, the kext will be loaded automatically in each boot.
To test the VFS plug-in, you must specify what device node to mounted on. Simplest approach is to create a disk image:
# Create a disk image (name: test.dmg size: 1MB type: EMPTYFS)
$ hdiutil create -size 1m -partitionType EMPTYFS test
created: /Users/lynnl/test.dmg
$ file test.dmg
test.dmg: Apple Driver Map, blocksize 512, blockcount 2048, devtype 0, devid 0, driver count 0, contains[@0x200]: Apple Partition Map, map block count 2, start block 1, block count 63, name Apple, type Apple_partition_map, valid, allocated, contains[@0x400]: Apple Partition Map, map block count 2, start block 64, block count 1984, name disk image, type EMPTYFS, valid, allocated, readable, writable, mount at startupThen attach the disk image with -nomount flag(.: the system won't automatically mount the volumes on the image):
# The first two volumes are image scheme and map partition
# We cares about the last one(i.e. EMPTYFS)
$ hdiutil attach -nomount test.dmg
/dev/disk2 Apple_partition_scheme
/dev/disk2s1 Apple_partition_map
/dev/disk2s2 EMPTYFSAfter you load emptyfs kext, you can create a mount point and mount the file system:
$ sudo kextload emptyfs.kext
$ mkdir emptyfs_mp
$ ./mount_emptyfs /dev/disk2s2 emptyfs_mpUse mount(8) to check mount info and explore the file system:
$ mount | grep emptyfs
/dev/disk2s2 on /Users/lynnl/emptyfs_mp (emptyfs, local, nodev, noexec, nosuid, read-only, noowners, mounted by lynnl)
$ ls -la emptyfs_mp
total 8
dr-xr-xr-x 2 lynnl staff 528 Dec 27 22:00 .
drwxr-xr-x+ 19 lynnl staff 608 Dec 27 21:59 ..
$ stat emptyfs_mp
16777226 2 dr-xr-xr-x 2 lynnl staff 0 528 "Dec 27 22:00:25 2018" "Dec 27 22:00:25 2018" "Dec 27 22:00:25 2018" "Dec 27 22:00:25 2018" 4096 8 0 emptyfs_mpWhen you explore the file system thoroughly, you can first umount(8) the file system and then unload the kext:
$ unmount emptyfs_mp
$ sudo kextunload emptyfs.kextEmptyFS - A very simple VFS plug-in that mounts a volume that is completely empty
antekone's cross-reference search site