gocryptfs was inspired by encfs(1) and strives to fix its security issues while providing good performance.
gocryptfs -reverse -exclude Music -exclude Movies /home/user /mnt/user.encrypted
See also -exclude-wildcard, -exclude-from and the EXCLUDING FILES section.
gocryptfs -reverse -exclude-wildcard '*~' /home/user /mnt/user.encrypted
See also -exclude, -exclude-from and the EXCLUDING FILES section.
gocryptfs -reverse -exclude-from ~/crypt-exclusions /home/user /mnt/user.encrypted
See also -exclude, -exclude-wildcard and the EXCLUDING FILES section.
When -extpass is specified once, the string argument will be split on spaces. For example, -extpass "md5sum my password.txt" will be executed as "md5sum" "my" "password.txt", which is NOT what you want.
Specify -extpass twice or more to use the string arguments as-is. For example, you DO want to call md5sum like this: -extpass "md5sum" -extpass "my password.txt".
If you want to prevent splitting on spaces but don’t want to pass arguments to your program, use "--", which is accepted by most programs: -extpass "my program" -extpass "--"
This is rarely desired behavior: One should usually run gocryptfs as the account which owns the backing-store files, which should usually be one and the same with the account intended to access the decrypted content. An example of a case where this may be useful is a situation where content is stored on a filesystem that doesn’t properly support UNIX ownership and permissions.
For corrupted media, note that you probably want to use dd_rescue(1) instead, which will recover all but the corrupted 4kB block.
This option makes no sense in reverse mode. It requires gocryptfs to be compiled with openssl support and implies -openssl true. Because of this, it is not compatible with -aessiv, that uses built-in Go crypto.
Setting this option forces the filesystem to read-only and noexec.
Note that unlike “-o”, “-ko” is a regular option and must be passed BEFORE the directories. Example:
gocryptfs -ko noexec /tmp/foo /tmp/bar
The masterkey option is meant as a recovery option for emergencies, such as if you have forgotten the password or lost the config file.
Even if a config file exists, it will not be used. All non-standard settings have to be passed on the command line: -aessiv when you mount a filesystem that was created using reverse mode, or -plaintextnames for a filesystem that was created with that option.
The option is ignored by gocryptfs itself and has no effect outside /etc/fstab.
On ext4, preallocation is fast and does not cause a noticeable performance hit. Unfortunately, on Btrfs, preallocation is very slow, especially on rotational HDDs. The “-noprealloc” option gives users the choice to trade robustness against out-of-space errors for a massive speedup.
For benchmarks and more details of the issue see https://github.com/rfjakob/gocryptfs/issues/63 .
Note that you can only use options that are understood by gocryptfs with “-o”. If you want to pass special flags to the kernel, you should use “-ko” (kernel option). This is different in libfuse-based filesystems, that automatically pass any “-o” options they do not understand along to the kernel.
gocryptfs /tmp/foo /tmp/bar -o q,zerokey
Before gocryptfs v1.7, using -passfile was equivant to writing -extpass="/bin/cat -- FILE". gocryptfs v1.7 and later directly read the file without invoking cat.
This can be used together with -masterkey if you forgot the password but know the master key. Note that without the old password, gocryptfs cannot tell if the master key is correct and will overwrite the old one without mercy. It will, however, create a backup copy of the old config file as gocryptfs.conf.bak. Delete it after you have verified that you can access your files with the new password.
Setting this to a lower value speeds up mounting and reduces its memory needs, but makes the password susceptible to brute-force attacks. The default is 16.
The -serialize_reads option does two things: (1) reads will be submitted one-by-one (no concurrency) and (2) gocryptfs tries to order the reads by file offset order.
The ordering requires gocryptfs to wait a certain time before submitting a read. The serialization introduces extra locking. These factors will limit throughput to below 70MB/s.
For more details visit https://github.com/rfjakob/gocryptfs/issues/92 .
At the moment, it does two things:
- Disable stat() caching so changes to the backing storage show up immediately.
- Disable hard link tracking, as the inode numbers on the backing storage are not stable when files are deleted and re-created behind our back. This would otherwise produce strange “file does not exist” and other errors.
When “-sharedstorage” is active, performance is reduced and hard links cannot be created.
Even with this flag set, you may hit occasional problems. Running gocryptfs on shared storage does not receive as much testing as the usual (exclusive) use-case. Please test your workload in advance and report any problems you may hit.
-exclude matches complete paths, so -exclude file.txt only excludes a file named file.txt in the root of the mounted filesystem; files named file.txt in subdirectories are still visible. (This option is kept for compatibility with the behavior up to version 1.6.x)
-exclude-wildcard matches files anywhere, so -exclude-wildcard file.txt excludes files named file.txt in any directory. If you want to match complete paths, you can prefix the filename with a /: -exclude-wildcard /file.txt excludes only file.txt in the root of the mounted filesystem.
If there are many exclusions, you can use -exclude-from to read exclusion patterns from a file. The syntax is that of -exclude-wildcard, so use a leading / to match complete paths.
The rules for exclusion are that of gitignore (https://git-scm.com/docs/gitignore#_pattern_format). In short:
- A blank line matches no files, so it can serve as a separator for readability.
- A line starting with # serves as a comment. Put a backslash (\) in front of the first hash for patterns that begin with a hash.
- Trailing spaces are ignored unless they are quoted with backslash (\).
- An optional prefix ! negates the pattern; any matching file excluded by a previous pattern will become included again. It is not possible to re-include a file if a parent directory of that file is excluded. Put a backslash (\) in front of the first ! for patterns that begin with a literal !, for example, \!important!.txt.
- If the pattern ends with a slash, it is removed for the purpose of the following description, but it would only find a match with a directory. In other words, foo/ will match a directory foo and paths underneath it, but will not match a regular file or a symbolic link foo.
- If the pattern does not contain a slash /, it is treated as a shell glob pattern and checked for a match against the pathname relative to the root of the mounted filesystem.
- Otherwise, the pattern is treated as a shell glob suitable for consumption by fnmatch(3) with the FNM_PATHNAME flag: wildcards in the pattern will not match a / in the pathname. For example, Documentation/*.html matches Documentation/git.html but not Documentation/ppc/ppc.html or tools/perf/Documentation/perf.html.
- A leading slash matches the beginning of the pathname. For example, /*.c matches cat-file.c but not mozilla-sha1/sha1.c.
- Two consecutive asterisks (**) in patterns matched against full pathname may have special meaning:
- A leading ** followed by a slash means match in all directories. For example, **/foo matches file or directory foo anywhere, the same as pattern foo. **/foo/bar matches file or directory bar anywhere that is directly under directory foo.
- A trailing /** matches everything inside. For example, abc/** matches all files inside directory abc, with infinite depth.
- A slash followed by two consecutive asterisks then a slash matches zero or more directories. For example, a/**/b matches a/b, a/x/b, a/x/y/b and so on.
- Other consecutive asterisks are considered invalid.
mkdir mydir.crypt mydir gocryptfs -init mydir.crypt gocryptfs mydir.crypt mydir
Mount an encrypted view of joe’s home directory using reverse mode:
mkdir /home/joe.crypt gocryptfs -init -reverse /home/joe gocryptfs -reverse /home/joe /home/joe.crypt
6: CIPHERDIR is not an empty directory (on “-init”)
10: MOUNTPOINT is not an empty directory
12: password incorrect
22: password is empty (on “-init”)
23: could not read gocryptfs.conf
24: could not write gocryptfs.conf (on “-init” or “-password”)
26: fsck found errors
other: please check the error message