Linux's NTFS Driver Drops "No Access Rules" Option, Adds Small Optimizations

[phoronix]

Phoronix: Linux's NTFS Driver Drops "No Access Rules" Option, Adds Small Optimizations

The NTFS3 driver developed by Paragon Software that provides read/write support and other modern features for the NTFS file-system with the mainline kernel has seen a new round of changes for Linux 6.4...

https://www.phoronix.com/news/Linux-6.4-NTFS

[uid313]

With Microsoft so heavily investing in Linux it would be great to see them improve NTFS support on Linux. Or maybe Active Directory support.

Are NTFS and ext4 kind of equally good?

[avis]

The "noacsrules" mount option is not permanently removed: "Its use leads to unstable results. If we figure out how to implement it without errors, we will add it later;"

With Microsoft so heavily investing in Linux it would be great to see them improve NTFS support on Linux. Or maybe Active Directory support.

Are NTFS and ext4 kind of equally good?

Why would Microsoft invest into supporting NTFS working [better[ under Linux? How would they or their clients benefit from that? They never did that, I doubt they will.

AD support works great via SAMBA. Again, with no direct or indirect benefit for Microsoft.

As for NTFS and ext4 being equally good - I don't quite understand what you mean. No one AFAIK uses NTFS under Linux for /. It's a FS to exchange files with Windows systems - that's it.

BTW, has anyone used NTFS3 for torrenting or databases? I wonder how it works and if it's reliable [enough]. I've had major FS corruptions with NTFS-3G when doing that, that's why I've resorted to only copying large files to it.

[ypnos]

Are NTFS and ext4 kind of equally good?

No, ext4 is far superior in most regards.

NTFS has a few features that ext4 is lacking. Only NTFS supports filesystem-level compression of files, while both support filesystem-level encryption.

[Old Grouch]

With Microsoft so heavily investing in Linux it would be great to see them improve NTFS support on Linux. Or maybe Active Directory support.

Are NTFS and ext4 kind of equally good?

The allowed character set for filenames stored using NTFS is a subset of the character set for ext4. That alone rules it out for me. Mixing both without caution leads to all sorts of interesting problems with obscurely-named files.

[ll1025]

With Microsoft so heavily investing in Linux it would be great to see them improve NTFS support on Linux. Or maybe Active Directory support.

Are NTFS and ext4 kind of equally good?

What AD support are you wanting that doesn't exist? Base SSSD supports AD fully-- dynamic dns registration, kerberos-backed SSH logins, pubkeys pulled from LDAP, and sudoers files based on a computer's netgroup. There's even support for using GPO to enforce HBAC, and if you're nuts enough to use Ubuntu I understand that GPO support gets even deeper.

Plus, Microsoft doesn't want you using on-prem AD. That's why the forest level hasn't been updated in 8 years, and the DC role hasn't been touched in 5. They want you on Azure AD.

As for NTFS vs ext4-- NTFS big benefit is its very granular ACLs. AFAIK its performance is meh, and has some really nasty corner cases that kneecap it (e.g. directories with thousands of small files). One might speculate that its sprawling featureset / metadata could be linked to those performance issues.

There's supposedly some "self-healing" stuff with it but I've never found it to be more reliable than ext4 or xfs.

[ll1025]

No, ext4 is far superior in most regards.

NTFS has a few features that ext4 is lacking. Only NTFS supports filesystem-level compression of files, while both support filesystem-level encryption.

I don't think ext4 supports encryption. LUKS does that, as far as I'm aware.

It's sort of moot since no one uses compression or EFS--they use bitlocker instead.

The big feature I can think of with NTFS is its native, granular permissions. Even with extended ACLs, NTFS is still far more granular. I think timestamps might be finer precision as well.

[ypnos]

I don't think ext4 supports encryption.

Why bother dissenting when you don't know? Never heard of fscrypt? It's quite nice IMHO.

[uid313]

As for NTFS and ext4 being equally good - I don't quite understand what you mean. No one AFAIK uses NTFS under Linux for /. It's a FS to exchange files with Windows systems - that's it.

I didn't mean NTFS on Linux, I meant which is the better file system, ext4 on Linux, NTFS on Windows, or APFS on macOS?

[Old Grouch]

The big feature I can think of with NTFS is its native, granular permissions. Even with extended ACLs, NTFS is still far more granular. I think timestamps might be finer precision as well.

I suspect that Windows/NTFS inherited the extensive ACL capability from VMS, which is both good and bad.

Quoting from a VMS Access Control List Editor manual:

An access control list consists of access control list entries (ACEs) that grant or deny access to a particular system object. You can place ACLs on the following types of objects:
•Devices
•Files (including directory files)
•Group global sections
•System global sections
•Logical name tables
•Queues
Typically,ACLs are used when you want to provide access to a system object for some, but not all users.When the VMS operating system receives a request for access to an object having an ACL,it searches each access control list entry in the ACL,stopping at the first match.If another match occurs in the ACL,it has no effect.Therefore,ACEs granting or denying access to a system object for specific users should appear in the ACL before ACEs identifying broader classes of users.

Access control list entries could grant or deny access to multiple system-manager defined groups of users, and/or write entries to security logs, and/or propagate to files created in subsidiary directories (when applied to files in the filesystem). You ended up with a very flexible and powerful system which was challenging in its complexity to administer. I suspect you'd need to use SE Linux to get the same flexibility and granularity in Linux.

Access Control Lists, like firewall rule sets, were processed sequentially until the first match, and if you were not careful, could drag down performance. I've not used them in anger on Windows or Linux, and I'm happy not to have had to.