STRUCT ECRYPTFS_GLOBAL_AUTH_TOK(9)

💅 struct ecryptfs_global_auth_tok — Kernel API Manual, bestie edition

okay so bestie, we're diving into struct ecryptfs_global_auth_tok(9) today and honestly? it's giving "the key that encrypts all your new files under the mountpoint." that's literally what NAME says. no cap. 🔑

✨ SYNOPSIS ✨

struct ecryptfs_global_auth_tok {
  #define ECRYPTFS_AUTH_TOK_INVALID 0x00000001;
  #define ECRYPTFS_AUTH_TOK_FNEK    0x00000002;
    u32 flags;
    struct list_head mount_crypt_stat_list;
    struct key *global_auth_tok_key;
    unsigned char sig[ECRYPTFS_SIG_SIZE_HEX + 1];
 };

like, look at her. that's the whole struct. iconic. 🎀

🌸 Members 🌸

• flags — the status flags, aka the vibe check of the token. just flags.
• mount_crypt_stat_list — okay so these auth_toks hang off the mount-wide cryptographic context. every single time a new inode comes into existence, eCryptfs copies the auth_toks on that list over to the set of auth_toks on the inode's crypt_stat. every time. no skipping. 🦋
• global_auth_tok_key — the key from the user's keyring for the sig. look at her go 👑
• sig — the key identifier. that's it, that's the whole thing. 💅

💖 Description 💖

ecryptfs_global_auth_tok structs refer to authentication token keys in the user keyring that apply to newly created files. a list of these objects hangs off of the mount_crypt_stat struct for any given eCryptfs mount.

and here's the part that slays: this struct maintains a reference to both the key contents and the key itself, so that the key can be put on unmount. like, she remembers her own cleanup. main character energy fr fr. 🫶

🔥 SEE ALSO 🔥

• Kernel file ./fs/ecryptfs/ecryptfs_kernel.h
• struct ecryptfs_key_tfm(9)

okay that's the whole page, you ate that ngl 🍓 this was ./fs/ecryptfs, dated October 2026, struct ecry...bal_auth_tok(9) — go forth and mount something encrypted, bestie. periodt. 💜✨