SECURE BLOCK CLONING ON RESILIENT FILE SYSTEMS

1 . A computer-implemented method comprising:

receiving, by a computer security application executing on a computer system deploying a file system configured to implement block cloning on stored files, a block cloning command to clone a source file to a target file;

before the computer system executes the block cloning command:

identifying, by the computer security application, a trust status associated with the source file, the trust status identified by looking up a base inventory that stores trust data associated with a plurality of files stored on the file system, the plurality of files including the source file, and

determining, based on the trust status associated with the source file, that the trust status associated with the source file is trustworthy; and

in response to determining that the source file is trustworthy, applying the trust status associated with the source file to the target file.

2 . The method of claim 1 , wherein the source file and the target file are the first source file and the first target file, respectively, wherein the block cloning command is a first block cloning command, wherein the method further comprises:

receiving a second block cloning command to clone a second source file to a second target file; and

before the computer system executes the second block cloning command:

determining an absence of a trust status associated with the second source file in the base inventory or that the trust status associated with the second source file is untrustworthy, and

in response to determining the absence of the trust status associated with the second source file in the base inventory, analyzing the second target file to determine a trust status for the second target file.

3 . The method of claim 1 , further comprising, before in response to receiving the block cloning command, generating the integrity cache that stores populated with the trust data associated with the plurality of filessource file, a file handle associated with the source file, and a file object associated with the source file stored on the file system by analyzing each file of the plurality of files.

4 . The method of claim 3 , wherein analyzing each file of the plurality of files comprises, for each file:

determining a hash of each file;

extracting certificate data associated with each file;

storing, in a base inventory, the hash of each file and the certificate data associated with each file.

5 . The method of claim 1 , further comprising clearing the integrity cache for the source file in response to determining that the source file has been removed from the file system.

6 . The method of claim 1 , further comprising clearing the integrity cache for the source file in response to determining an expiration of a time to live value associated with the integrity cache for the source file.

7 . The method of claim 1 , wherein the block cloning command includes a source file identifier identifying the source file and a target file identifier identifying the target file, wherein the method further comprises:

extracting the source file identifier and the target file identifier from the block cloning command; and

identifying the source file and the target file using the source file identifier and the target file identifier, respectively.

8 . The method of claim 1 , wherein the block cloning command is transmitted to the file system, wherein receiving the block cloning command comprises intercepting the block cloning command before the block cloning command is executed on the file system.

9 . A non-transitory computer-readable medium storing instructions which, when executed by a hardware-based processor, performs operations comprising:

receiving, by a computer security application executing on a computer system deploying a file system configured to implement block cloning on stored files, a block cloning command to clone a source file to a target file;

before the computer system executes the block cloning command:

identifying, by the computer security application, a trust status associated with the source file, the trust status identified by looking up a base inventory that stores trust data associated with a plurality of files stored on the file system, the plurality of files including the source file, and

determining, based on the trust status associated with the source file, that the trust status associated with the source file is trustworthy; and

in response to determining that the source file is trustworthy, applying the trust status associated with the source file to the target file.

10 . The medium of claim 9 , wherein the source file and the target file are the first source file and the first target file, respectively, wherein the block cloning command is a first block cloning command, wherein the operations further comprise:

receiving a second block cloning command to clone a second source file to a second target file; and

before the computer system executes the second block cloning command:

determining an absence of a trust status associated with the second source file in the integrity cache or that the trust status associated with the second source file is untrustworthy, and

in response to determining the absence of the trust status associated with the second source file in the integrity cache, analyzing the second target file to determine a trust status for the second target file.

11 . The medium of claim 9 , wherein the operations further comprise, in response to receiving the block cloning command, generating the integrity cache that populated with the trust data associated with the source file, a file handle associated with the source file, and a file object associated with the source file.

12 . The medium of claim 11 , wherein analyzing each file of the plurality of files comprises, for each file:

determining a hash of each file;

extracting certificate data associated with each file;

storing, in a base inventory, the hash of each file and the certificate data associated with each file.

13 . The medium of claim 9 , wherein the operations further comprise clearing the integrity cache for the source file in response to determining that the source file has been removed from the file system.

14 . The medium of claim 9 , wherein the operations further comprise clearing the integrity cache for the source file in response to determining an expiration of a time to live value associated with the integrity cache for the source file.

15 . The medium of claim 9 , wherein the block cloning command includes a source file identifier identifying the source file and a target file identifier identifying the target file, wherein the operations further comprise:

extracting the source file identifier and the target file identifier from the block cloning command; and

identifying the source file and the target file using the source file identifier and the target file identifier, respectively.

16 . The medium of claim 9 , wherein the block cloning command is transmitted to the file system, wherein receiving the block cloning command comprises intercepting the block cloning command before the block cloning command is executed on the file system.

17 . A system comprising:

one or more processors including a hardware-based processor; and

a memory storage including a non-transitory computer-readable medium storing instructions which, when executed by the one or more processors including the hardware-based processor, performs operations comprising:

receiving, by a computer security application executing on a computer system deploying a file system configured to implement block cloning on stored files, a block cloning command to clone a source file to a target file;

before the computer system executes the block cloning command:

identifying, by the computer security application, a trust status associated with the source file, the trust status identified by looking up a base inventory that stores trust data associated with a plurality of files stored on the file system, the plurality of files including the source file, and

determining, based on the trust status associated with the source file, that the trust status associated with the source file is trustworthy; and

in response to determining that the source file is trustworthy, applying the trust status associated with the source file to the target file.

18 . The system of claim 17 , wherein the source file and the target file are the first source file and the first target file, respectively, wherein the block cloning command is a first block cloning command, wherein the operations further comprise:

receiving a second block cloning command to clone a second source file to a second target file; and

before the computer system executes the second block cloning command:

determining an absence of a trust status associated with the second source file in the integrity cache or that the trust status associated with the second source file is untrustworthy, and

in response to determining the absence of the trust status associated with the second source file in the integrity cache, analyzing the second target file to determine a trust status for the second target file.

19 . The system of claim 17 , wherein the operations further comprise, before in response to receiving the block cloning command, generating the integrity cache that stores populated with the trust data associated with the plurality of filessource file, a file handle associated with the source file, and a file object associated with the source file stored on the file system by analyzing each file of the plurality of files.

20 . The system of claim 19 , wherein analyzing each file of the plurality of files comprises, for each file:

determining a hash of each file;

extracting certificate data associated with each file;

storing, in the a integrity cachebase inventory, the hash of each file, and the certificate data associated with each file, a file handle associated with each file, and a file object associated with each file.