Using dm-crypt for encrypting files

Using dm-crypt for encrypting files

[Ph. Marek]

Hello everybody!

I'm aware of some implementations for file system encryption - dm-crypt,
loopback with encryption, truecrypt, and fuse.

Now I'd like to ask if it's easily possible to write a (preloaded)
user-space library or a kernel module, that
- overlays an existing directory tree,
- decrypts all encrypted files therein,
- encrypts new files depending on their filename, and generally
- allows transparent access, as to normal files.

Why? I'd need to achieve a file-encryption, that works on files whose
filenames match certain criteria.


How to do that? I'm thinking along the lines
- create an anonymous dm-crypt-device,
- attach that (with an offset) to the "base" file,
- on close detach and cleanup the dm-crypt-device.


I don't like the block-device-encryption *in this case*, because
- the amount of encrypted data varies a lot (some use none, others many
  GB), which makes the sizing a bit difficult,
- and I'd like to do incremental backups - which is easier if you just
  look at the files' meta-data.

The advantage I see over fuse is that the context switches are eliminated
- and the infrastructure for encryption is present in the kernel.
(The only difference between a file and a block device is, AFAIK, the
sparseness - which might make a problem for dm-crypt (?).)

(The kernel module would probably be better, because it works on static
binaries too, can hide the keys better [even against the user], and is
easier regarding access to the devices - how many should exist, and who
may use them?)


The main problems I see are:
- In order to know which key to use the full path may have to be created.
  How do we know how long that can be?
- The files should get decrypted *only* for the user-process-hierarchy.
  With other filesystems it's possible to use a clone() with CLONE_NEWNS
  on logon, and no other processes apart from that processtree can access
  clear-text data - not even the administrator (until he *really* wants
  to, then nothing can stop him, of course).
  I don't see how that could be done here, too.


I'm afraid that this is more a brainstorming than a complete wish list or
question table - but I'd like to hear others' opinions before thinking to
much ahead.


Thank you for all ideas, answers, other feedback.



Regards,

Phil



-- 
Versioning your /etc, /home or even your whole installation?
             Try fsvs (fsvs.tigris.org)!

RE: Using dm-crypt for encrypting files

[Paul Rolland]

Hello,

> - encrypts new files depending on their filename, and generally

What about renaming a file ???

Regards,
Paul

RE: Using dm-crypt for encrypting files

[Ph. Marek]

> Hello,
>> - encrypts new files depending on their filename, and generally
>
> What about renaming a file ???
Well, that's a small (but known!) problem with this scheme.
If you say that everything below a directory "_crypt_" should be
encrypted, and just move files in there, you've got no problems - the
encryption settings stay the same.

If you move in/out of encrypted storage, there's two options:
- if it's a separate filesystem, ie. mounted, you cannot move - you
  have to copy & delete, which means the data gets correct settings.
- if its not the same filesystem, you might get a wrongly en/decrypted
  file.

But I just saw ecryptfs (http://ecryptfs.sourceforge.net/) - that seems to
do more or less what I need. I'll take a look.


Regards,

Phil



-- 
Versioning your /etc, /home or even your whole installation?
             Try fsvs (fsvs.tigris.org)!