E4CRYPT(8)

💖 E4CRYPT(8) 💖

okay bestie, sit down, hydrate, because today we're learning e4crypt — yes that's section 8 of the system manager's manual, we love a system admin era 👑

this is the ext4 file system encryption utility, and honestly? it's giving security, it's giving secrets, it's giving your files are none of anybody's business 🔐✨

---

✨ NAME ✨

e4crypt — ext4 file system encryption utility 🦋

like. that's it. that's the whole vibe. it does encryption management for ext4 file systems and it does it well.

---

🎀 SYNOPSIS 🎀

e4crypt add_key -S [ -k keyring ] [-v] [-q] [ -p pad ] [ path ... ]
e4crypt new_session
e4crypt get_policy path ...
e4crypt set_policy [ -p pad ] policy path ...

four whole commands. four. we're eating today 🍓

---

🌸 DESCRIPTION 🌸

e4crypt performs encryption management for ext4 file systems. periodt. that's the mission statement, that's the whole personality 💅

---

👑 COMMANDS 👑

🔑 e4crypt add_key [-vq] [-S salt ] [-k keyring ] [ -p pad ] [ path ... ]

so this one prompts you for a passphrase and then inserts it into the keyring you told it about. and if you didn't tell it about one? no worries bestie, e4crypt will use the session keyring if it exists, or the user session keyring if it doesn't. it's flexible like that 🫶

now, a salt is what turns your cute little passphrase into an actual encryption key. and the whole point is: if you use the same passphrase in different contexts, different salt values give you different encryption keys. so nobody's out here reusing the same key across everything like a menace. iconic behavior honestly.

by default, e4crypt will examine all mounted ext4 file systems, and insert an encryption key salted with each file system with encryption enabled, using its default salt value. yes, each one. it's thorough. it's a completionist. we stan 🌈

but alternatively — if you specify an explicit salt, that salt value gets used to calculate the encryption key from the passphrase. and here's how it reads your salt argument, depending on the first characters:

• if the first two characters of salt are s: — the rest of the argument is used as a text string, and that's your salt value 💬
• if the first two characters are 0x — the rest of the argument is parsed as a hex string, and that hex value becomes the salt 🔢
• if the first characters are f: — the rest of the argument is interpreted as a filename, and the salt value gets read from that file 📄
• if the string begins with a / character — same deal, it's treated as a filename 📁
• and finally, if the salt argument parses as a valid UUID — then that UUID value is used as the salt value 🆔

the keyring argument specifies the keyring to which the key should be added. simple. clean. no notes.

the pad value specifies the number of bytes of padding that will be added to directory names, for obfuscation purposes (sneaky, we love). valid pad values are 4, 8, 16, and 32 — those four, nothing else, don't try it 🙈

and if you specify one or more directory paths? e4crypt will try to set the policy of those directories to use the key just added by the add_key command. if a salt was explicitly specified, that's what gets used to derive the encryption key of those directories. otherwise, a directory-specific default salt gets used. so many salts. so much flavor 🧂✨

🔍 e4crypt get_policy path ...

prints the policy for the directories you specified on the command line. that's it, that's the whole thing, it's a lil peek at what's going on 👀

🌱 e4crypt new_session

gives the invoking process (typically a shell) a brand new session keyring — and discards its old session keyring. out with the old, in with the new. main character energy, honestly 💅

📌 e4crypt set_policy [ -p pad ] policy path ...

sets the policy for the directories specified on the command line.

⚠️ okay important one: all directories must be empty to set the policy. empty. like, nothing in there. don't test it.

and if the directory already has a policy established, e4crypt will validate that the policy matches what was specified — so it's checking your work, respectfully 📝

a policy is an encryption key identifier consisting of 16 hexadecimal characters. sixteen. hex. that's the whole format, memorize it iykyk 🔥

---

🫶 AUTHOR 🫶

written by Michael Halcrow <mhalcrow@google.com>, Ildar Muslukhov <muslukhovi@gmail.com>, and Theodore Ts'o <tytso@mit.edu> — absolute legends, the founding mothers and fathers of your encrypted filesystem, no cap 👑

---

🌈 SEE ALSO 🌈

• keyctl(1)
• mke2fs(8)
• mount(8)

go read those too, they're all part of the extended cinematic universe 💜

---

and that's the whole page bestie!! this came to you courtesy of E2fsprogs version 1.47.4, dated March 2025 — so you know it's fresh, you know it's current, you know it ate 💅✨ bye ily, go encrypt something 🎀