linux/fs/ecryptfs
Michael Halcrow 87c94c4df0 eCryptfs: Filename Encryption: mount option
Enable mount-wide filename encryption by providing the Filename Encryption
Key (FNEK) signature as a mount option.  Note that the ecryptfs-utils
userspace package versions 61 or later support this option.

When mounting with ecryptfs-utils version 61 or later, the mount helper
will detect the availability of the passphrase-based filename encryption
in the kernel (via the eCryptfs sysfs handle) and query the user
interactively as to whether or not he wants to enable the feature for the
mount.  If the user enables filename encryption, the mount helper will
then prompt for the FNEK signature that the user wishes to use, suggesting
by default the signature for the mount passphrase that the user has
already entered for encrypting the file contents.

When not using the mount helper, the user can specify the signature for
the passphrase key with the ecryptfs_fnek_sig= mount option.  This key
must be available in the user's keyring.  The mount helper usually takes
care of this step.  If, however, the user is not mounting with the mount
helper, then he will need to enter the passphrase key into his keyring
with some other utility prior to mounting, such as ecryptfs-manager.

Signed-off-by: Michael Halcrow <mhalcrow@us.ibm.com>
Cc: Dustin Kirkland <dustin.kirkland@gmail.com>
Cc: Eric Sandeen <sandeen@redhat.com>
Cc: Tyler Hicks <tchicks@us.ibm.com>
Cc: David Kleikamp <shaggy@us.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2009-01-06 15:59:22 -08:00
..
crypto.c eCryptfs: Filename Encryption: filldir, lookup, and readlink 2009-01-06 15:59:22 -08:00
debug.c eCryptfs: update comment and debug statement 2007-10-16 09:43:11 -07:00
dentry.c eCryptfs: Swap dput() and mntput() 2008-03-19 18:53:36 -07:00
ecryptfs_kernel.h eCryptfs: Filename Encryption: filldir, lookup, and readlink 2009-01-06 15:59:22 -08:00
file.c eCryptfs: Filename Encryption: filldir, lookup, and readlink 2009-01-06 15:59:22 -08:00
inode.c eCryptfs: Filename Encryption: filldir, lookup, and readlink 2009-01-06 15:59:22 -08:00
keystore.c eCryptfs: Filename Encryption: Tag 70 packets 2009-01-06 15:59:21 -08:00
kthread.c CRED: Pass credentials through dentry_open() 2008-11-14 10:39:22 +11:00
main.c eCryptfs: Filename Encryption: mount option 2009-01-06 15:59:22 -08:00
Makefile eCryptfs: remove netlink transport 2008-10-16 11:21:39 -07:00
messaging.c User namespaces: set of cleanups (v2) 2008-11-24 18:57:41 -05:00
miscdev.c User namespaces: set of cleanups (v2) 2008-11-24 18:57:41 -05:00
mmap.c fs: symlink write_begin allocation context fix 2009-01-04 13:33:20 -08:00
read_write.c eCryptfs: remove unnecessary page decrypt call 2008-06-06 11:29:09 -07:00
super.c ecryptfs: remove debug as mount option, and warn if set via modprobe 2008-02-06 10:41:12 -08:00