@@ -80,6 +80,16 @@ Before using `fscrypt`, you should consider other solutions:
8080 device. dm-crypt/LUKS is usually configured using
8181 [ cryptsetup] ( https://gitlab.com/cryptsetup/cryptsetup/-/wikis/home ) .
8282
83+ * [ ` systemd-homed ` ] ( https://systemd.io/HOME_DIRECTORY/ ) supports encrypting home
84+ directories using the same Linux native filesystem encryption API that
85+ ` fscrypt ` uses. Note that while the ` systemd-homed ` documentation refers to
86+ this as fscrypt support, it does not use the ` fscrypt ` tool; directories set
87+ up using ` systemd-homed ` cannot be managed by ` fscrypt ` and vice versa.
88+ ` systemd-homed ` has better integration with systemd than ` fscrypt ` does;
89+ however, ` systemd-homed ` (as of systemd v255) uses an obsolete version of the
90+ Linux native filesystem encryption API, and users may run into known issues.
91+ Issues with ` systemd-homed ` should be reported to the systemd developers.
92+
8393* [ ** eCryptfs** ] ( https://en.wikipedia.org/wiki/ECryptfs ) is an alternative
8494 filesystem-level encryption solution. It is a stacked filesystem, which means
8595 it sits on top of a real filesystem, rather than being directly integrated
@@ -88,10 +98,12 @@ Before using `fscrypt`, you should consider other solutions:
8898 disadvantages. eCryptfs is usually configured using
8999 [ ecryptfs-utils] ( https://packages.debian.org/stretch/ecryptfs-utils ) .
90100
91- * The [ ** ZFS** ] ( https://en.wikipedia.org/wiki/ZFS ) filesystem supports
92- encryption in its own way (not compatible with ` fscrypt ` ). ZFS encryption has
93- some advantages; however, ZFS isn't part of the upstream Linux kernel and is
94- less common than other filesystems, so this solution usually isn't an option.
101+ * Some Linux filesystems support encryption natively, but not in a way that is
102+ compatible with the common API that ` fscrypt ` uses. Examples of this are
103+ Bcachefs and ZFS. (Note: ZFS is not part of the upstream kernel.) Bcachefs
104+ encryption is similar to dm-crypt in that it encrypts the full filesystem with
105+ one key. ZFS encryption operates on a per-dataset basis. If you are using
106+ one of these filesystems, refer to the documentation for that filesystem.
95107
96108Which solution to use? Here are our recommendations:
97109
@@ -101,9 +113,9 @@ Which solution to use? Here are our recommendations:
101113 filesystem encryption instead. The largest users of eCryptfs (Ubuntu and
102114 Chrome OS) have switched to dm-crypt or Linux native filesystem encryption.
103115
104- * If you need fine-grained control of encryption within a filesystem, then use
105- ` fscrypt ` , or ` fscrypt ` together with dm-crypt/LUKS. If you don't need this,
106- then use dm-crypt/LUKS.
116+ * If you need fine-grained control of encryption within a filesystem and you are
117+ using a filesystem that supports ` fscrypt ` , then use ` fscrypt ` , or ` fscrypt `
118+ together with dm-crypt/LUKS. If you don't need this, then use dm-crypt/LUKS.
107119
108120 To understand this recommendation: consider that the main advantage of
109121 ` fscrypt ` is to allow different files on the same filesystem to be encrypted
0 commit comments