How to understand the filesystem concepts used by encfs?

Question

I do not hold a deep understanding of computer science concepts but would like to learn more about how the utility encfs works. I have a few question regarding the concept of filesystem in regards to encfs. It is said that encfs is a cryptographic filesystem wiki link.

1)To encrypt the files encfs is moving around blocks of the files to be encrypted, so am I correct to see this 'scrambled' version of the files as a new perspective which justifies the term of a new filesystem?

2)In the man pages of encfs in the section CEVEATS link to man of encfs online, it says that encfs is not a true file system. How should I understand this? Is that because some necessary features common to all file systems is missing in encfs' file system? Or is because of some other more substantial reason?

3)The man pages say that it creates a virtual encrypted file system. There are two questions here; what is it that makes it virtual is it that it is a file system within a file system? and the encrypted is that there is not a straight forward way to map the file blocks into a format to be read by other programs?

4)How does the command fusermount relate to encfs?

Answer 1

I think that behind your description, there is a misconception. The unencrypted data is not stored on the disk at any point. When you write to a file in the encfs filesystem, the write instruction goes to the encfs process; the encfs process encrypts the data (in memory) and writes the ciphertext to a file. The file names, as well as the file contents, are encrypted. Reading a file undergoes the opposite process: encfs reads the encrypted data from the disk file, decrypts it in memory and passes the plaintext to the requesting application.

When you run the encfs command, it does not decrypt any data. It only uses the password that you supply to unlock the filesystem's secret key. (This is actually a decryption operation, cryptographically speaking, but a different type from what happens with the file data. I will not go into more details here.)

1) Encfs is not exactly “moving blocks around”; it is decoding blocks when it reads them. Encfs is a filesystem because it behaves like one: you can store files on it, when it's mounted.

2) Encfs is not a “true” filesystem because it doesn't work independently. Encfs only provides an encryption layer; it uses an underlying filesystem to actually store data and metadata (metadata is auxiliary information about files such as permissions and modification times).

3) Virtual filesystem is another way to say that encfs itself doesn't store any data, it needs an underlying filesystem (see (2) above) for that. Encrypted means just that: encfs stores the data that you put in it in an encrypted form, which cannot be decrypted without the key. Another program could read the data stored by encfs if and only if that other program had access to the key (which requires the password that the key is protected with).

4) The fusermount command sets up a FUSE mount point. You would not normally call it directly, because a FUSE filesystem is implemented by a user-mode process which you have to start anyway, and that process (e.g. encfs) will take care of setting up the mount point. Unmounting a FUSE filesystem, on the other hand, is a generic operation, you can always do it by calling fusermount -u.

Answer 2

1) No. It translates blocks of the file through an encryption algorithm. Moving blocks around would imply that you could see a bits of the file, just out of order. This is not the case. There isnt any bits of the original file that would be viewable looking at the encrypted version.

2) Its not a true filesystem because it doesnt handle actual storage of the data, it just translates it. So it doesnt have to worry about things like filesystem corruption, journaling, access permissions, etc. All that is handled by the underlying filesystem.

3) A) This is just the same as #2. It simply means that its not a real filesystem, it just looks like one. B) No, there is no straight forward way to map the file blocks, see #1. The encrypted data can be read by other programs yes, but the other program would need to know the encryption key. Nothing can be read without that key.

4) FUSE is a method of implementing filesystems in linux. Normally the code for handling the filesystem runs within the linux kernel. In the case of FUSE filesystems, an actual program does the job of running the filesystem. A program you can see with ps, and even kill it. fusermount is just a command used for mounting fuse filesystems. You can mount FUSE filesystems with the normal mount command, but fusermount lets non-root users mount the filesystem.