google / fscrypt

Go tool for managing Linux filesystem encryption

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

[Feature] try to find /.fscrypt directories in the case of a broken UUID link

josephlr opened this issue · comments

Currently, users can create "linked" protectors that refer to a protector on a different filesystem. This is most commonly used to encrypt a directory on a non-root filesystem with a user's login protector (which is stored on the root filesystem). This links stored in a protectors/<protector-id>.link and have the format UUID=<filesystem-uuid>.

Right now, if a link is broken we just return an error: cannot follow filesystem link ... no device with UUID. As an enhancement, if we detect a broken link, we could search all the mounted filesystems for a compatible .fscrypt directory. Then we could use such a directory if we find it (for unlocking or for fscrypt status). We could also output a warning advising the user on how to fix the issue. Something like:

broken link detected
To fix run "echo -n UUID=12345678-abab-ffcd-1234-123456789012 > /mnt/.fscrypt/protectors/128347210983421.link"

#337 solves this, but I went with a slightly different solution: I made the link files contain both a UUID and mountpoint path, rather than just a UUID. It seems preferable to avoid system-wide scans. @josephlr, let me know if you are okay with this solution -- thanks!