12

I'm looking for information about encryption with btrfs. I have experience with full-disk (LVM actually) encryption, so this time I only need to look at some btrfs specific questions.

I have found this article on archlinux wiki, and find this method is just the same as the previous encryption way I used (some time ago), except for the fact that they are using btrfs subvolumes instead of LVM.

For me, I don't want / need a full-partition encryption as the home subvolume(s) is(are) the only place where I'd like to encrypt. (Actually there are more subvolumes under home, but that's another question.)
However, through my search, I don't find any information about how to encrypt a btrfs subvolume only. The only most relevant thing I find is this mail from the btrfs mailing list, which is an experimental patch which provides transparent(?) encryption of btrfs (subvolume).
I also couldn't think out of my mind what method can be used to encrypt a subvolume only.

So, my main question is:

Is it possible to encrypt a btrfs subvolume only (no need to be "transparent encryption")? If yes, how?

Side note: Creating an encrypted block (file) and mount it on the "subvolume" is not an acceptable method since it is not a "subvolume" at all.

1
  • 1
    AFAIK, btrfs doesn't support subvolume encryption..at least it didn't last time I looked closely at btrfs a few years ago. zfsonlinux added it last year ("datasets" are the ZFS equivalent to "subvolumes").
    – cas
    Feb 9, 2018 at 13:48

1 Answer 1

Reset to default
8

Is it possible to encrypt a btrfs subvolume only (no need to be "transparent encryption")?

No, BTRFS does not currently have built-in support for encryption.  Today, to encrypt a filesystem (not just a sub-volume) you'd need DM-Crypt/LUKS.  See the Btrfs Wiki FAQ.

3
  • Were I correct, BTRFS's (supposed) encryption support is for transparent encryption. Is there no way to perform manual encryption on subvolumes?
    – renyuneyun
    Feb 13, 2018 at 15:14
  • The encryption support you mentioned is experimental and as far as I know is not included in mainline. I don't know how well maintained those patches are. Today, encryption for BTRFS is done at the block device level using DM-Crypt/LUKS, which encompasses the entire filesystem; hence there's no sub-volume encryption.
    – Emmanuel Rosa
    Feb 13, 2018 at 17:07
  • 5
    Having said that, eCryptFS effectively creates an encrypted layer on top of any filesystem. See ecryptfs.org
    – Emmanuel Rosa
    Feb 13, 2018 at 17:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .