GOCRYPTFS(1) GOCRYPTFS(1) (NAME) gocryptfs - (SYNOPSIS) gocryptfs -init [OPTIONS] CIPHERDIR (Mount) gocryptfs [OPTIONS] CIPHERDIR MOUNTPOINT [-o COMMA-SEPARATED-OPTIONS] (Unmount) fusermount -u MOUNTPOINT gocryptfs -passwd [OPTIONS] CIPHERDIR gocryptfs -fsck [OPTIONS] CIPHERDIR gocryptfs -info [OPTIONS] CIPHERDIR (DESCRIPTION) gocryptfs (overlay) Go . CIPHERDIR MOUNTPOINT (plaintext) . gocryptfs encfs(1) . (ACTION FLAGS) ( ). -fsck CIPHERDIR. . -h, -help . -hh . -info CIPHERDIR . : $ gocryptfs -info my_cipherdir Creator: gocryptfs v2.0-beta2 FeatureFlags: GCMIV128 HKDF DirIV EMENames LongNames Raw64 EncryptedKey: 64B ScryptObject: Salt=32B N=65536 R=8 P=1 KeyLen=32 -init . -passwd . . (master key) -masterkey . gocryptfs . gocryptfs.conf.bak . . -speed . GCM Go OpenSSL ( ). <<-openssl=auto>> ( ) . -version . <<;>> . : <>. gocryptfs go-fuse Go . (INIT OPTIONS) -init . . -aessiv AES-SIV. AES-GCM <<-reverse>> . gocryptfs -speed . -deterministic-names gocryptfs.diriv. ( <> https://nuetzlich.net/gocryptfs/comparison/#file-names ). gocryptfs.conf <> <> . -devrandom gocryptfs 2.2 . https://github.com/rfjakob/gocryptfs/commit/f3c777d5eaa682d878c638192311e52f9c204294 https://github.com/rfjakob/gocryptfs/issues/596 . -hkdf HKDF . true . -longnamemax integer value, allowed range 62...255 ( ) . . / . -longnamemax . .name . . : -longnamemax 100 -plaintextnames . -raw64 base64 . <<==>> . gocryptfs 1.2 . true . -reverse . -aessiv . -masterkey -aessiv . -xchacha XChaCha20-Poly1305. AES AES-GCM . gocryptfs -speed . (MOUNT OPTIONS) . . -acl (ACL). ACL . -allow_other ( root) FUSE . . user_allow_other /etc/fuse.conf . <> <> fuse(8) . -badname string gocryptfs <<>> ( ) . -badname . GOCRYPTFS_BAD_NAME . (Glob). . : Dropbox: -badname '*conflicted copy*' Syncthing: -badname '*.sync-conflict*' : -badname '*' -context string SELinux. mount(8) . xfstests -o context="system_u:object_r:root_t:s0" . root fusermount3 : fusermount3: unknown option 'context="system_u:object_r:root_t:s0"' -ctlsock string . . . /run/user/UID/my.socket . -dev, -nodev (-dev) (-nodev) gocryptfs (: -nodev). -nodev . -dev (root) . -e PATH, -exclude PATH : . . <> <> : gocryptfs -reverse -exclude Music -exclude Movies /home/user /mnt/user.encrypted -exclude-wildcard -exclude-from << >> . -ew GITIGNORE-PATTERN, -exclude-wildcard GITIGNORE-PATTERN : gitignore(5) . . .mp3 : gocryptfs -reverse -exclude-wildcard '*.mp3' /home/user /mnt/user.encrypted `important` : gocryptfs -reverse -exclude-wildcard '*' -exclude-wildcard '!/important' /home/user /mnt/user.encrypted -exclude-from << >> . -exclude-from FILE : gitignore . . : gocryptfs -reverse -exclude-from ~/crypt-exclusions /home/user /mnt/user.encrypted -exclude -exclude-wildcard << >> . -exec, -noexec (-exec) (-noexec) gocryptfs (: -exec). -noexec . -fg, -f (daemonize ). <<-f>> <<-fg>> . -notifypid syslog stdout stderr . -force_owner string <> ( <> <> ) uid gid . <> . : gocryptfs . . -forcedecode gocryptfs 2.2 . : https://github.com/rfjakob/gocryptfs/commit/d023cd6c95fcbc6b5056ba1f425d2ac3df4abc5a -fsname string ( df -T). <<-o fsname=>> libfuse . CIPHERDIR . -fusedebug fuse. -i duration, -idle duration : () . <<500s>> <<2h45m>> . () . . -kernel_cache kernel_cache FUSE fuse(8) . -ko ( ). FUSE <> . gocryptfs root <> suid <> . <> ( <<-ro>>) <> . FILESYSTEM-INDEPENDENT MOUNT OPTIONS mount(8) . (macOS) <> .Trashes ( ). <> osxfuse <<>> <> <> . <<-o>> <<-ko>> . : gocryptfs -ko noexec /tmp/foo /tmp/bar -longnames ( true). gocryptfs ( 0.8 ) <<-masterkey>> . ( ). -nodev -dev, -nodev . -noexec -exec, -noexec . -nofail nofail /etc/fstab systemd ( man systemd.fstab ). gocryptfs /etc/fstab . -nonempty . FUSE . -noprealloc . gocryptfs fallocate(2) FALLOC_FL_KEEP_SIZE . 4kB . ext4 . Btrfs (HDD). <<-noprealloc>> . : https://github.com/rfjakob/gocryptfs/issues/63 -nosuid -suid, -nosuid . -nosyslog gocryptfs (daemonize) syslog . stdout stderr . -notifypid int USR1 . . -one-file-system ( --one-file-system rsync). . . : . -rw, -ro / (-rw ) (-ro). -ro . -reverse -reverse << >> . -reverse -init . -serialize_reads (readahead) . gocryptfs . ( Amazon Cloud Drive) . -serialize_reads : () ( ) () gocryptfs . gocryptfs . . 70MB/s . : https://github.com/rfjakob/gocryptfs/issues/92 -sharedstorage gocryptfs gocryptfs . : 1. stat() . 2. (hard links) inode . <> . <<-sharedstorage>> . . gocryptfs . . : https://github.com/rfjakob/gocryptfs/issues/156 -suid, -nosuid (-suid) (-nosuid) suid sgid gocryptfs (: -nosuid). -nosuid . -suid . -zerokey . . (COMMON OPTIONS) . . . -config string CIPHERDIR/gocryptfs.conf. : : -fsck -passwd -info -init. -cpuprofile string (CPU profile) . : . -d, -debug . : . -extpass CMD [-extpass ARG1 ...] ( ssh-askpass) . gocryptfs . -passfile . -extpass . -extpass "md5sum my password.txt" "md5sum" "my" "password.txt" . -extpass . : -extpass "md5sum" -extpass "my password.txt". "--" : -extpass "my program" -extpass "--" : . : -extpass -X -X --X . -extpass=-X . (BUGS) . -fido2 DEVICE_PATH FIDO2 . fido2-token -L FIDO2 . fido2-tools . : . -fido2-assert-option OPTION fido2-assert -t. -t OPTION fido2-assert . man fido2-assert . : (PIN): gocryptfs -init -fido2 DEVICE_PATH -fido2-assert-option pin=false CIPHERDIR : gocryptfs -init -fido2 DEVICE_PATH -fido2-assert-option uv=true -fido2-assert-option pin=true CIPHERDIR : gocryptfs -init -fido2 DEVICE_PATH -fido2-assert-option up=true -fido2-assert-option uv=true CIPHERDIR -masterkey string <> stdin . <> . <<-masterkey=stdin>> . masterkey . . : -aessiv -plaintextnames . : : gocryptfs -masterkey=6f717d8b-6b5f8e8a-fd0aa206-778ec093-62c5669b-abd229cd-241e00cd-b4d6713d cipher mnt gocryptfs -masterkey=stdin cipher mnt : gocryptfs -reverse ( -aessiv ): gocryptfs -masterkey=stdin -aessiv cipher mnt : . -memprofile string . gocryptfs . : . -o COMMA-SEPARATED-OPTIONS mount(1) <<-o COMMA-SEPARATED-OPTIONS>> . <<-o q,zerokey>> <<-q -zerokey>> . <<-o>> gocryptfs . <<-ko>> ( ) . libfuse <<-o>> . : gocryptfs /tmp/foo /tmp/bar -o q,zerokey : . -openssl bool/"auto" OpenSSL Go ( <>). Go AES Go 1.6 . <> gocryptfs . : . -passfile FILE [-passfile FILE2 ...] . ( !). . . . . : echo hello > hello.txt echo world > world.txt gocryptfs -passfile hello.txt -passfile world.txt <> . : . -q, -quiet - . : . -scryptn int gocryptfs scrypt ( ) (brute-force) . -scryptn <> scrypt scryptn=log2(N) . -scryptn=10 -scryptn=28 N=2^10 N=2^28 . . . scrypt : scryptn Memory Usage ======= ============ 10 1 MiB 11 2 12 4 13 8 14 16 15 32 16 64 17 128 18 256 19 512 20 1 GiB 21 2 22 4 23 8 24 16 25 32 26 64 27 128 28 256 : -init -passwd : gocryptfs internal/configfile. -trace string . <> . : . -wpanic (panic) . . : . -- . CIPHERDIR <<->> . : . (EXCLUDING FILES) -exclude -exclude-wildcard -exclude-from . -exclude -exclude file.txt file.txt file.txt . . 1.6.x . -exclude-wildcard . -exclude-wildcard gitignore -exclude-wildcard file.txt file.txt . / : -exclude-wildcard /file.txt file.txt . -exclude-from gitignore . -exclude-wildcard / . gitignore . : 1. . 2. # . (\) . 3. (\) . 4. ! . . ! (\) : \!important!.txt. 5. . foo/ foo foo . 6. / . 7. fnmatch(3) FNM_PATHNAME : / . Documentation/*.html Documentation/git.html Documentation/ppc/ppc.html tools/perf/Documentation/perf.html . 8. . /*.c cat-file.c mozilla-sha1/sha1.c . 9. (**) : i. ** . **/foo foo foo. **/foo/bar bar foo . ii. /** . abc/** abc . iii. . a/**/b a/b a/x/b a/x/y/b . iv. . (EXAMPLES) <> <>: mkdir mydir.crypt mydir gocryptfs -init mydir.crypt gocryptfs mydir.crypt mydir joe : mkdir /home/joe.crypt gocryptfs -init -reverse /home/joe gocryptfs -reverse /home/joe /home/joe.crypt fstab /etc/fstab /tmp/cipher /tmp/plain /tmp/passfile . sudo mount -av . gocryptfs which gocryptfs . nofail gocryptfs ( -nofail ). /tmp/cipher /tmp/plain fuse./usr/local/bin/gocryptfs nofail,allow_other,passfile=/tmp/password 0 0 (ENVIRONMENT VARIABLES) NO_COLOR NO_COLOR ( ) ( https://no-color.org ). (EXIT CODES) 0: 6: CIPHERDIR ( <<-init>>) 10: MOUNTPOINT 12: 22: ( <<-init>>) 23: gocryptfs.conf 24: gocryptfs.conf ( <<-init>> <<-password>>) 26: fsck : : https://github.com/rfjakob/gocryptfs/blob/master/internal/exitcodes/exitcodes.go (BUGS) (Dash duplication) gocryptfs 2.1 pflag . -extpass . : gocryptfs -extpass myapp -extpass -X gocryptfs -X --X extpass myapp --X . : gocryptfs -extpass myapp -extpass=-X (SEE ALSO) mount(2) fuse(8) fallocate(2) encfs(1) gitignore(5) (AUTHORS) github.com/rfjakob. Aug 2017 GOCRYPTFS(1)