VaultFS: Data Integrity via Write-Once Software Support at the File System Level

High-privilege insiders, such as IT administrators, pose a significant threat to data integrity, whether through accidental errorsor malicious intent. Unauthorized modifications or deletions of critical data—such as system logs and access records—can causesevere operational and security disruptions. Traditionally, these threats are mitigated using hardware-based solutions such as Write-Once Read-Many (WORM) storage. While effective, these approaches have notable drawbacks, including high deployment costsand irreversible consumption of storage blocks, which cannot be reused once written. The goal of this paper is to explore purelysoftware-based solutions to these challenges. To this end, we design VaultFS, a software-only file system for Linux environmentstailored for the protection of cold data—–data that must remain accessible but unmodifiable. VaultFS enables writing througha standard file system interface while ensuring strict immutability and undeletability for a pre-defined time window, potentiallyinfinite. Even threads operating with (effective)root-id permissions cannot alter or remove stored data, preserving integrity againstprivilege escalation threats. Achieving this requires addressing a number of key technical challenges, such as ensuring a trustedtime reference to enforce temporal protection guarantees and mitigating storage-exhaustion Denial-of-Service (DoS) attacks, whereuntrusted applications flood the file system with non-removable content. After discussing real-world deployment strategies, weevaluate the integration of VaultFS with practical applications, demonstrating full compatibility with all seven backup tools assessedand seamless integration with most of the video surveillance applications tested. Furthermore, our experimental evaluation showsthat VaultFS, in its baseline configuration, incurs only a 5-10% performance overhead compared to the common Linux Ext4 filesystem.