It seems a directory may contain files encrypted by different protectors. Is it possible to find how to access file content by its path?
$ grep '' not-encrypted/*
grep: not-encrypted/file-a: Required key not available
grep: not-encrypted/file-b: Required key not available
not-encrypted/file-not:Not encrypted
$ fscrypt unlock crypt-a
Enter custom passphrase for protector "a":
"crypt-a" is now unlocked and ready for use.
$ grep '' not-encrypted/*
not-encrypted/file-a:this is a
grep: not-encrypted/file-b: Required key not available
not-encrypted/file-not:Not encrypted
How to determine that namely the crypt-a directory should be unlocked to read not-encrypted/file-a?
Accidentally I moved a file outside of encrypted directory. It resembles a feature requested in #373. Commands to reproduce output given above:
$ mkdir not-encrypted crypt-a crypt-b
$ fscrypt encrypt crypt-a
The following protector sources are available:
1 - Your login passphrase (pam_passphrase)
2 - A custom passphrase (custom_passphrase)
3 - A raw 256-bit key (raw_key)
Enter the source number for the new protector [2 - custom_passphrase]: 2
Enter a name for the new protector: a
Enter custom passphrase for protector "a":
Confirm passphrase:
"crypt-a" is now encrypted, unlocked, and ready for use.
$ echo "this is a" >crypt-a/file-a
$ mv -iv crypt-a/file-a not-encrypted/
renamed 'crypt-a/file-a' -> 'not-encrypted/file-a'
$ fscrypt lock crypt-a
"crypt-a" is now locked.
$ fscrypt encrypt crypt-b
Should we create a new protector? [y/N] y
The following protector sources are available:
1 - Your login passphrase (pam_passphrase)
2 - A custom passphrase (custom_passphrase)
3 - A raw 256-bit key (raw_key)
Enter the source number for the new protector [2 - custom_passphrase]: 2
Enter a name for the new protector: b
Enter custom passphrase for protector "b":
Confirm passphrase:
"crypt-b" is now encrypted, unlocked, and ready for use.
$ echo "this is b" >crypt-b/file-b
$ mv -iv crypt-b/file-b not-encrypted/
renamed 'crypt-b/file-b' -> 'not-encrypted/file-b'
$ fscrypt lock crypt-b
"crypt-b" is now locked.
$ echo "Not encrypted" >not-encrypted/file-not
I expected that it is possible to obtain some info from extended attributes of the files, but the following command results in empty output
$ attr -l not-encrypted/file-a
https://www.kernel.org/doc/html/latest/filesystems/fscrypt.html#encryption-context confirms that attributes are hidden.
README.md describes that moving file into an encrypted directory works more like a copy. Moving file outside of an encrypted directory looks like an unexpected feature.
Debian 12 bookworm, Linux kernel 6.1.55-1, fscrypt 0.3.3-1+b6.
It seems a directory may contain files encrypted by different protectors. Is it possible to find how to access file content by its path?
How to determine that namely the
crypt-adirectory should be unlocked to readnot-encrypted/file-a?Accidentally I moved a file outside of encrypted directory. It resembles a feature requested in #373. Commands to reproduce output given above:
I expected that it is possible to obtain some info from extended attributes of the files, but the following command results in empty output
https://www.kernel.org/doc/html/latest/filesystems/fscrypt.html#encryption-context confirms that attributes are hidden.
README.md describes that moving file into an encrypted directory works more like a copy. Moving file outside of an encrypted directory looks like an unexpected feature.
Debian 12 bookworm, Linux kernel 6.1.55-1, fscrypt 0.3.3-1+b6.