Skip to content

Commit c74be8c

Browse files
committed
README.md: update documentation about alternatives
1 parent d00b463 commit c74be8c

1 file changed

Lines changed: 19 additions & 7 deletions

File tree

README.md

Lines changed: 19 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,16 @@ Before using `fscrypt`, you should consider other solutions:
8080
device. dm-crypt/LUKS is usually configured using
8181
[cryptsetup](https://gitlab.com/cryptsetup/cryptsetup/-/wikis/home).
8282

83+
* [`systemd-homed`](https://systemd.io/HOME_DIRECTORY/) supports encrypting home
84+
directories using the same Linux native filesystem encryption API that
85+
`fscrypt` uses. Note that while the `systemd-homed` documentation refers to
86+
this as fscrypt support, it does not use the `fscrypt` tool; directories set
87+
up using `systemd-homed` cannot be managed by `fscrypt` and vice versa.
88+
`systemd-homed` has better integration with systemd than `fscrypt` does;
89+
however, `systemd-homed` (as of systemd v255) uses an obsolete version of the
90+
Linux native filesystem encryption API, and users may run into known issues.
91+
Issues with `systemd-homed` should be reported to the systemd developers.
92+
8393
* [**eCryptfs**](https://en.wikipedia.org/wiki/ECryptfs) is an alternative
8494
filesystem-level encryption solution. It is a stacked filesystem, which means
8595
it sits on top of a real filesystem, rather than being directly integrated
@@ -88,10 +98,12 @@ Before using `fscrypt`, you should consider other solutions:
8898
disadvantages. eCryptfs is usually configured using
8999
[ecryptfs-utils](https://packages.debian.org/stretch/ecryptfs-utils).
90100

91-
* The [**ZFS**](https://en.wikipedia.org/wiki/ZFS) filesystem supports
92-
encryption in its own way (not compatible with `fscrypt`). ZFS encryption has
93-
some advantages; however, ZFS isn't part of the upstream Linux kernel and is
94-
less common than other filesystems, so this solution usually isn't an option.
101+
* Some Linux filesystems support encryption natively, but not in a way that is
102+
compatible with the common API that `fscrypt` uses. Examples of this are
103+
Bcachefs and ZFS. (Note: ZFS is not part of the upstream kernel.) Bcachefs
104+
encryption is similar to dm-crypt in that it encrypts the full filesystem with
105+
one key. ZFS encryption operates on a per-dataset basis. If you are using
106+
one of these filesystems, refer to the documentation for that filesystem.
95107

96108
Which solution to use? Here are our recommendations:
97109

@@ -101,9 +113,9 @@ Which solution to use? Here are our recommendations:
101113
filesystem encryption instead. The largest users of eCryptfs (Ubuntu and
102114
Chrome OS) have switched to dm-crypt or Linux native filesystem encryption.
103115

104-
* If you need fine-grained control of encryption within a filesystem, then use
105-
`fscrypt`, or `fscrypt` together with dm-crypt/LUKS. If you don't need this,
106-
then use dm-crypt/LUKS.
116+
* If you need fine-grained control of encryption within a filesystem and you are
117+
using a filesystem that supports `fscrypt`, then use `fscrypt`, or `fscrypt`
118+
together with dm-crypt/LUKS. If you don't need this, then use dm-crypt/LUKS.
107119

108120
To understand this recommendation: consider that the main advantage of
109121
`fscrypt` is to allow different files on the same filesystem to be encrypted

0 commit comments

Comments
 (0)