F2FSCRYPT(8)

💖 F2FSCRYPT(8) 💖

okay bestie, gather round, because f2fscrypt is the manual page we're doing today — it's the f2fs filesystem encryption utility, and it's honestly giving main character energy in the world of disk crypto. 🎀

---

✨ NAME ✨

f2fscrypt — f2fs filesystem encryption utility

No cap, that's the whole name section. Short, sweet, iconic. 💅

---

🦋 SYNOPSIS 🦋

f2fscrypt add_key -S [ -k keyring ] [-v] [-q] [  path ... ]
f2fscrypt new_session
f2fscrypt get_policy path ...
f2fscrypt set_policy policy path ...

---

🌸 DESCRIPTION 🌸

So like, f2fscrypt does encryption management for f2fs file systems. That's the vibe. It's your girl for keys and policies on f2fs, periodt. 🔐✨

---

👑 COMMANDS 👑

💜 f2fscrypt add_key -S [ -k keyring ] [-v] [-q] [ path ... ]

It prompts you for a passphrase and inserts it into the specified keyring. If you don't specify a keyring, f2fscrypt will use the session keyring if it exists, or the user session keyring if it doesn't. 🗝️

And if you hand it one or more directory paths, f2fscrypt will try to set the policy of those directories to use the key you just typed in. Obsessed. 🫶

💜 f2fscrypt get_policy path ...

Prints the policy for the directories you specified on the command line. Literally that simple. 🎀

💜 f2fscrypt new_session

Gives the invoking process (typically a shell) a brand new session keyring, and discards its old session keyring. Out with the old, in with the new. 💅✨

💜 f2fscrypt set_policy policy path ...

Sets the policy for the directories specified on the command line.

Heads up bestie: all directories must be empty to set the policy. And if the directory already has a policy established, f2fscrypt will validate that the policy matches what was specified.

A policy is an encryption key identifier consisting of 16 hexadecimal characters. Count them. Sixteen. 🧚

---

🙈 OPTIONS 🙈

• -S — rides along with add_key in the synopsis; in the example below it's used with a salt (-S 0x1234).
• -k keyring — the keyring you want the key dropped into. Skip it and you get the session keyring (or the user session keyring if there isn't one).
• -v — it's in the synopsis for add_key. The page doesn't spell out more than that, so I'm not gonna make stuff up. 💀
• -q — same deal, it's in the synopsis for add_key, and that's all we're told. No invented lore here. 🌸

---

💀 NOTES 💀

The target directory must be empty.

That's it. That's the note. But it's an important one, so don't skip it. 😭

---

🔥 EXAMPLE 🔥

Formats a f2fs filesystem that supports encrypt.

# mkfs.f2fs -O encrypt /dev/sdxx
# mount /dev/sdxx /encrypted/
# mkdir /encrypted/dir

First create the key in the keyring use an simple salt (or generate a random salt). Then use it to set the policy for the directory to be encrypted.

# f2fscrypt add_key -S 0x1234
  Enter passphrase (echo disabled):
  Added key with descriptor [28e21cc0c4393da1]

# f2fscrypt set_policy 28e21cc0c4393da1 /encrypted/dir
  Key with descriptor [28e21cc0c4393da1] applied to /encrypted/dir.

# touch /encrypted/dir/test.txt
# ls -l /encrypted/dir/
  -rw-r--r--. 1 root root 0 Mar  5 21:41 test.txt

After each reboot, the same command can be used set the key for decryption of the directory and its descendants.

# ls -l /encrypted/dir/
  -rw-r--r--. 1 root root 0 Mar  5 21:41 zbx7tsUEMLzh+AUVMkQcnB

# f2fscrypt get_policy /encrypted/dir/
  /encrypted/dir/: 28e21cc0c4393da1

# f2fscrypt add_key -S 0x1234
  Enter passphrase (echo disabled):
  Added key with descriptor [28e21cc0c4393da1]

# ls -l /encrypted/dir/
  -rw-r--r--. 1 root root 0 Mar  5 21:41 test.txt

Show process keyrings.

# keyctl show
  Session Keyring
    84022412 --alswrv      0     0  keyring: _ses
   204615789 --alswrv      0 65534   \_ keyring: _uid.0
   529474961 --alsw-v      0     0   \_ logon: f2fs:28e21cc0c4393da1

Like… the filename literally changes from test.txt to zbx7tsUEMLzh+AUVMkQcnB when the key isn't loaded, and then snaps right back once you add the key. That's not a glow-up, that's encryption. ✨🔐

---

🎀 AUTHOR 🎀

Written by Kinglong Mee <kinglongmee@gmail.com>, Migrated from e4crypt that Written by Michael Halcrow <mhalcrow@google.com>, Ildar Muslukhov <muslukhovi@gmail.com>, and Theodore Ts'o <tytso@mit.edu>

Shoutout to the whole squad who made this happen. 🫶👑

---

🌈 SEE ALSO 🌈

• keyctl(1)
• mkfs.f2fs(8)
• mount(8)

---

And that's the whole page, bestie — from the System Manager's Manual, F2FSCRYPT(8), section 8 of your local man pages. Go forth and encrypt responsibly. 💖✨🎀🦋