Project Infinite Moves Dropbox Into the Kernel
Project Infinite, unveiled publicly last month, aims to let users access all of their Dropbox content regardless of local disk capacity. That goal requires a fundamental change in how the Dropbox desktop client operates. Previously, Dropbox ran entirely in user space as an ordinary application that passively watched the local filesystem. With Project Infinite, Dropbox becomes an active participant in the filesystem itself, which means working in the kernel.
Why FUSE Wasn't the Answer
Early prototypes for solving the limited disk-space problem leaned on FUSE (Filesystems in Userspace). FUSE allows non-privileged users to build filesystems without writing a kernel extension, relying instead on a user-space library. It's part of the kernel on some Unix-like systems, and OS X has a port via a dedicated kernel extension and the libfuse library.
FUSE is powerful technology, but it didn't meet two critical requirements for this project: world-class performance and rock-solid security.
Because FUSE filesystems are largely implemented in user space, every file operation typically requires extra user-kernel mode switches. There's one context switch between the application making the system call and the VFS in the kernel, plus another between the FUSE kernel extension and the libfuse library. While individual context switches are cheap, the overhead on every file operation degrades performance in ways Dropbox didn't want users to experience. 
Security was another deciding factor. Dropbox's security posture includes internal Red Teams, a bug-bounty program, and regular external penetration testing. The FUSE libraries available on OS X come as kernel extensions that introduce too much complexity and risk to distribute as part of the desktop client.
A Custom Kernel Extension
Rather than relying on FUSE, Dropbox built its own custom kernel extension. This approach delivers minimal performance overhead while ensuring full understanding of everything shipped and served to users. By controlling the interface boundary, Dropbox can push non-performance-critical machinery up into user space, further strengthening the security posture.
Work on the kernel extension opened up solving other long-standing problems beyond disk capacity. The "untrained intern problem" surfaced frequently among the more than 150,000 businesses using Dropbox Business. In that scenario, someone unfamiliar with Dropbox moves a folder from a shared Team folder to their Desktop, inadvertently removing access for everyone else on the team. The content can be restored, but preventing the mistake entirely is better.
Starting with Dropbox Enterprise customers, this protection now exists. When someone performs such an operation, they get a warning dialog explaining the consequences for other folder members. 
Detecting File Operations on Mac
The mechanism differs by platform. Windows uses Copy Hooks. On Mac, Dropbox's kernel extension taps into the Kernel Authorization subsystem, or Kauth, which manages file authorizations within the BSD portion of the kernel. By listening on the KAUTH_SCOPE_VNODE scope, the extension can detect and deny actions within the Dropbox folder.
Specifically, the relevant actions are KAUTH_VNODE_DELETE and KAUTH_VNODE_ADD_FILE, which cover deleting or moving a file or folder out of a shared folder. The extension then checks with the user whether the operation was intended and informs them of the consequences for other members. This approach is simpler than a FUSE implementation and involves no third-party dependencies. 
Kernel extensions are common in everyday software, from mouse device drivers to sophisticated antivirus programs. They require extreme care since a bug in the kernel can affect the entire machine. Dropbox has run this extension internally for nearly a year, testing its stability and integrity. The kernel extension is deliberately focused on Dropbox file actions, creating the smallest and most secure surface through which to deliver Project Infinite while respecting user privacy and system stability.
