3

I'm looking for information about encryption with btrfs. I have experience with full-disk (LVM actually) encryption, so this time I only need to look at some btrfs specific questions.

I have found this article on archlinux wiki, and find this method is just the same as the previous encryption way I used (some time ago), except for the fact that they are using btrfs subvolumes instead of LVM.

For me, I don't want / need a full-partition encryption as the home subvolume(s) is(are) the only place where I'd like to encrypt. (Actually there are more subvolumes under home, but that's another question.)
However, through my search, I don't find any information about how to encrypt a btrfs subvolume only. The only most relevant thing I find is this mail from the btrfs mailing list, which is an experimental patch which provides transparent(?) encryption of btrfs (subvolume).
I also couldn't think out of my mind what method can be used to encrypt a subvolume only.

So, my main question is:

Is it possible to encrypt a btrfs subvolume only (no need to be "transparent encryption")? If yes, how?

Side note: Creating an encrypted block (file) and mount it on the "subvolume" is not an acceptable method since it is not a "subvolume" at all.

  • 1
    AFAIK, btrfs doesn't support subvolume encryption..at least it didn't last time I looked closely at btrfs a few years ago. zfsonlinux added it last year ("datasets" are the ZFS equivalent to "subvolumes"). – cas Feb 9 '18 at 13:48
3

Is it possible to encrypt a btrfs subvolume only (no need to be "transparent encryption")?

No, BTRFS does not currently have built-in support for encryption. Today, to encrypt a filesystem (not just a sub-volume) you'd need DM-Crypt/LUKS. See https://btrfs.wiki.kernel.org/index.php/FAQ#Does_btrfs_support_encryption.3F

  • Were I correct, BTRFS's (supposed) encryption support is for transparent encryption. Is there no way to perform manual encryption on subvolumes? – renyuneyun Feb 13 '18 at 15:14
  • The encryption support you mentioned is experimental and as far as I know is not included in mainline. I don't know how well maintained those patches are. Today, encryption for BTRFS is done at the block device level using DM-Crypt/LUKS, which encompasses the entire filesystem; hence there's no sub-volume encryption. – Emmanuel Rosa Feb 13 '18 at 17:07
  • 2
    Having said that, eCryptFS effectively creates an encrypted layer on top of any filesystem. See ecryptfs.org – Emmanuel Rosa Feb 13 '18 at 17:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.