Skip to content

Commit

Permalink
README.md: update documentation about alternatives
Browse files Browse the repository at this point in the history
  • Loading branch information
ebiggers committed Feb 17, 2024
1 parent d00b463 commit 34de863
Showing 1 changed file with 9 additions and 7 deletions.
16 changes: 9 additions & 7 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -88,10 +88,12 @@ Before using `fscrypt`, you should consider other solutions:
disadvantages. eCryptfs is usually configured using
[ecryptfs-utils](https://packages.debian.org/stretch/ecryptfs-utils).

* The [**ZFS**](https://en.wikipedia.org/wiki/ZFS) filesystem supports
encryption in its own way (not compatible with `fscrypt`). ZFS encryption has
some advantages; however, ZFS isn't part of the upstream Linux kernel and is
less common than other filesystems, so this solution usually isn't an option.
* Some Linux filesystems support encryption natively, but not in a way that is
compatible with the common API that `fscrypt` uses. Examples of this are
Bcachefs and ZFS. (Note: ZFS is not part of the upstream kernel.) Bcachefs
encryption is similar to dm-crypt in that it encrypts the full filesystem with
one key. ZFS encryption operates on a per-dataset basis. If you are using
one of these filesystems, refer to the documentation for that filesystem.

Which solution to use? Here are our recommendations:

Expand All @@ -101,9 +103,9 @@ Which solution to use? Here are our recommendations:
filesystem encryption instead. The largest users of eCryptfs (Ubuntu and
Chrome OS) have switched to dm-crypt or Linux native filesystem encryption.

* If you need fine-grained control of encryption within a filesystem, then use
`fscrypt`, or `fscrypt` together with dm-crypt/LUKS. If you don't need this,
then use dm-crypt/LUKS.
* If you need fine-grained control of encryption within a filesystem and you are
using a filesystem that supports `fscrypt`, then use `fscrypt`, or `fscrypt`
together with dm-crypt/LUKS. If you don't need this, then use dm-crypt/LUKS.

To understand this recommendation: consider that the main advantage of
`fscrypt` is to allow different files on the same filesystem to be encrypted
Expand Down

0 comments on commit 34de863

Please sign in to comment.