encryptfs

type EncryptedFileSystem ¶

type EncryptedFileSystem struct {
	DataMount    proxy.FileSystemMount // where to write all data (encrypted)
	KeysMount    proxy.FileSystemMount // where to write secret keys for DataMount files (encrypted)
	DecryptMount proxy.FileSystemMount // where files are temporarily unencrypted for reads and writes
	PrivKey      *rsa.PrivateKey       // required
}

Basic encrypted file system overlay:

• DataMount is where all the encrypted data is stored. File names are NOT encrypted.
• KeysMount is where all the encrypted keys are stored. File names are NOT encrypted. Used to decrypted DataMount.
• DecryptMount is where all the "in-memory" opened files reside. Should be primarily something in memory or a secure location as opened files are decrypted to this location to support read-at locations
• PrivKey is the private key used to decrypt the KeysMount.

PrivKey must be securely stored, but KeysMount and DataMount can be in untrusted locations.

func New(privKey *rsa.PrivateKey, keysMount, dataMount, decryptMount proxy.FileSystemMount) *EncryptedFileSystem

func (f *EncryptedFileSystem) CreateFile(ctx context.Context, path string, flag ninep.OpenMode, mode ninep.Mode) (ninep.FileHandle, error)

func (f *EncryptedFileSystem) Delete(ctx context.Context, path string) error

func (f *EncryptedFileSystem) Init(ctx context.Context) error

func (f *EncryptedFileSystem) ListDir(ctx context.Context, path string) iter.Seq2[fs.FileInfo, error]

func (f *EncryptedFileSystem) MakeDir(ctx context.Context, path string, mode ninep.Mode) error

func (f *EncryptedFileSystem) OpenFile(ctx context.Context, path string, flag ninep.OpenMode) (ninep.FileHandle, error)

func (f *EncryptedFileSystem) Stat(ctx context.Context, path string) (os.FileInfo, error)

func (f *EncryptedFileSystem) WriteStat(ctx context.Context, path string, s ninep.Stat) error