Cybersecurity and privacy risk assessment of point-of-care systems in healthcare: A use case approach

"Everything is a file" is an idea that Unix, and its derivatives, handle input/output to and from resources such as documents, hard-drives, modems, keyboards, printers and even some inter-process and network communications as simple streams of bytes exposed through the filesystem name space.^[1] Exceptions include semaphores, processes and threads.

The advantage of this approach is that the same set of tools, utilities and APIs can be used on a wide range of resources and a number of file types. When a file is opened, a file descriptor is created, using the file path as an addressing system. The file descriptor is then a byte stream I/O interface on which file operations are performed. File descriptors are also created for objects such as anonymous pipes and network sockets – and therefore a more accurate description of this feature is Everything is a file descriptor.^[2][3]

Additionally, a range of pseudo and virtual filesystems exists which exposes internal kernel data, such as information about processes, to user space in a hierarchical file-like structure.^[4] These are mounted into the single file hierarchy.

An example of this purely virtual filesystem is under /proc that exposes many system properties as files. All of these files, in the broader sense of the word, have standard Unix file attributes such as an owner and access permissions, and can be queried by the same classic Unix tools and filters. However, this is not universally considered a fast or portable approach. Some operating systems do not mount /proc by default due to security or speed concerns, relying on system calls instead.^[5] It is, though, used heavily by Linux shell utilities,^[6][7] such as the procps ps implementation and BusyBox, which is widely installed on embedded systems.^[8] Android Toolbox program depend on it as well.^[9]

Another example is sysfs, which is usually mounted to /sys, which exposes kernel data structures.^[10] sysfs provides functionality similar to the sysctl mechanism found in BSD operating systems, with the difference that sysfs is implemented as a virtual file system instead of being a purpose-built kernel mechanism.^[11] The philosophy behind sysfs is to represent each value with a dedicated file. In addition each file has a maximum size of PAGE_SIZE bytes.

For a kernel module there are three possibilities to use a file below /sys:

• module parameter
• register new subsystem
• debugfs: debugfs, mounted in /sys/kernel/debug.

The standard sysfs API uses a dedicated terminology: A file is called an attribute, the function executed upon reading an attribute is called show and the one for writing an attribute store.^[12]

Sysfs was derived from procfs between Linux kernel versions 2.5-2.6, initially as a dedicated filesystem to debug a new driver model. Both sysfs and procfs are memory-based. Sysfs contains directories for block devices, physical bus types, device classes (such as those used for graphics, networking, input or printing), firmware-specific objects and attributes, kernel modules and the power subsystem.^[13]

For example, writing mem to /sys/power/state will trigger a suspend-to-RAM procedure.^[14]

Another example of files with specific behaviors are /dev/null and /dev/zero device files. Writes to them will be discarded.^[15] This can, for example, be used to redirect unneeded standard streams.

• 9P – A network protocol developed for the Plan 9 distributed operating system
• Device file
• Synthetic file system
• Unix architecture
• Filesystem Hierarchy Standard
• https://www.kernel.org/doc/gorman/html/understand/understand015.html
• https://tldp.org/LDP/intro-linux/html/sect_03_01.html