.\" This man page was generated from MANPAGE.md. View it using 'man ./gocryptfs.1'
.\"
.\" Automatically generated by Pandoc 3.1.8
.\"
.TH "GOCRYPTFS" "1" "Aug 2017" "" ""
.SH NAME
gocryptfs - create or mount an encrypted filesystem
.SH SYNOPSIS
.SS Initialize new encrypted filesystem
\f[CR]gocryptfs -init [OPTIONS] CIPHERDIR\f[R]
.SS Mount
\f[CR]gocryptfs [OPTIONS] CIPHERDIR MOUNTPOINT [-o COMMA-SEPARATED-OPTIONS]\f[R]
.SS Unmount
\f[CR]fusermount -u MOUNTPOINT\f[R]
.SS Change password
\f[CR]gocryptfs -passwd [OPTIONS] CIPHERDIR\f[R]
.SS Check consistency
\f[CR]gocryptfs -fsck [OPTIONS] CIPHERDIR\f[R]
.SS Show filesystem information
\f[CR]gocryptfs -info [OPTIONS] CIPHERDIR\f[R]
.SH DESCRIPTION
gocryptfs is an encrypted overlay filesystem written in Go.
Encrypted files are stored in CIPHERDIR, and a plain-text view can be
presented by mounting the filesystem at MOUNTPOINT.
.PP
gocryptfs was inspired by encfs(1) and strives to fix its security
issues while providing good performance.
.SH ACTION FLAGS
Unless one of the following \f[I]action flags\f[R] is passed, the
default action is to mount a filesystem (see SYNOPSIS).
.SS -fsck
Check CIPHERDIR for consistency.
If corruption is found, the exit code is 26.
.SS -h, -help
Print a short help text that shows the more-often used options.
.SS -hh
Long help text, shows all available options.
.SS -info
Pretty-print the contents of the config file in CIPHERDIR for human
consumption, stripping out sensitive data.
.PP
Example:
.IP
.EX
$ gocryptfs -info my_cipherdir
Creator:      gocryptfs v2.0-beta2
FeatureFlags: GCMIV128 HKDF DirIV EMENames LongNames Raw64
EncryptedKey: 64B
ScryptObject: Salt=32B N=65536 R=8 P=1 KeyLen=32
.EE
.SS -init
Initialize encrypted directory.
.SS -passwd
Change the password.
Will ask for the old password, check if it is correct, and ask for a new
one.
.PP
This can be used together with \f[CR]-masterkey\f[R] if you forgot the
password but know the master key.
Note that without the old password, gocryptfs cannot tell if the master
key is correct and will overwrite the old one without mercy.
It will, however, create a backup copy of the old config file as
\f[CR]gocryptfs.conf.bak\f[R].
Delete it after you have verified that you can access your files with
the new password.
.SS -speed
Run crypto speed test.
Benchmark Go\[cq]s built-in GCM against OpenSSL (if available).
The library that will be selected on \[lq]-openssl=auto\[rq] (the
default) is marked as such.
.SS -version
Print version and exit.
The output contains three fields separated by \[lq];\[rq].
Example: \[lq]gocryptfs v1.1.1-5-g75b776c; go-fuse 6b801d3; 2016-11-01
go1.7.3\[rq].
Field 1 is the gocryptfs version, field 2 is the version of the go-fuse
library, field 3 is the compile date and the Go version that was used.
.SH INIT OPTIONS
Available options for \f[CR]-init\f[R] are listed below.
Usually, you don\[cq]t need any.
Defaults are fine.
.SS -aessiv
Use the AES-SIV encryption mode.
This is slower than AES-GCM but is secure with deterministic nonces as
used in \[lq]-reverse\[rq] mode.
.PP
Run \f[CR]gocryptfs -speed\f[R] to find out if and how much slower.
.SS -deterministic-names
Disable file name randomisation and creation of
\f[CR]gocryptfs.diriv\f[R] files.
This can prevent sync conflicts conflicts when synchronising files, but
leaks information about identical file names across directories
(\[lq]Identical names leak\[rq] in
https://nuetzlich.net/gocryptfs/comparison/#file-names ).
.PP
The resulting \f[CR]gocryptfs.conf\f[R] has \[lq]DirIV\[rq] missing from
\[lq]FeatureFlags\[rq].
.SS -devrandom
Obsolete and ignored on gocryptfs v2.2 and later.
.PP
See
https://github.com/rfjakob/gocryptfs/commit/f3c777d5eaa682d878c638192311e52f9c204294
and https://github.com/rfjakob/gocryptfs/issues/596 for background info.
.SS -hkdf
Use HKDF to derive separate keys for content and name encryption from
the master key.
Default true.
.SS -longnamemax
.IP
.EX
integer value, allowed range 62...255
.EE
.PP
Hash file names that (in encrypted form) exceed this length.
The default is 255, which aligns with the usual name length limit on
Linux and provides best performance.
.PP
However, online storage may impose lower limits on file name and/or path
length.
In this case, setting -longnamemax to a lower value can be helpful.
.PP
The lower the value, the more extra \f[CR].name\f[R] files must be
created, which slows down directory listings.
.PP
Values below 62 are not allowed as then the hashed name would be longer
than the original name.
.PP
Example:
.IP
.EX
-longnamemax 100
.EE
.SS -plaintextnames
Do not encrypt file names and symlink targets.
.SS -raw64
Use unpadded base64 encoding for file names.
This gets rid of the trailing \[lq]\[rs]=\[rs]=\[rq].
A filesystem created with this option can only be mounted using
gocryptfs v1.2 and higher.
Default true.
.SS -reverse
Reverse mode shows a read-only encrypted view of a plaintext directory.
Implies \[lq]-aessiv\[rq].
.SS -xchacha
Use XChaCha20-Poly1305 file content encryption.
This should be much faster than AES-GCM on CPUs that lack AES
acceleration.
.PP
Run \f[CR]gocryptfs -speed\f[R] to find out if and how much faster.
.SH MOUNT OPTIONS
Available options for mounting are listed below.
Usually, you don\[cq]t need any.
Defaults are fine.
.SS -acl
Enable ACL enforcement.
When you want to use ACLs, you must enable this option.
.SS -allow_other
By default, the Linux kernel prevents any other user (even root) to
access a mounted FUSE filesystem.
Settings this option allows access for other users, subject to file
permission checking.
Only works if user_allow_other is set in /etc/fuse.conf.
This option is equivalent to \[lq]allow_other\[rq] plus
\[lq]default_permissions\[rq] described in fuse(8).
.SS -badname string
When gocryptfs encounters a \[lq]bad\[rq] file name (cannot be decrypted
or decrypts to garbage), a warning is logged and the file is hidden from
the plaintext view.
.PP
With the \f[CR]-badname\f[R] option, you can select \[lq]bad\[rq] file
names that should still be shown in the plaintext view instead of hiding
them.
Bad files will get \f[CR]GOCRYPTFS_BAD_NAME\f[R] appended to their name.
.PP
Glob pattern.
Can be passed multiple times for multiple patterns.
.PP
Examples:
.PP
Dropbox sync conflicts:
.IP
.EX
-badname \[aq]*conflicted copy*\[aq]
.EE
.PP
Syncthing sync conflicts:
.IP
.EX
-badname \[aq]*.sync-conflict*\[aq]
.EE
.PP
Show all invalid filenames:
.IP
.EX
-badname \[aq]*\[aq]
.EE
.SS -ctlsock string
Create a control socket at the specified location.
The socket can be used to decrypt and encrypt paths inside the
filesystem.
When using this option, make sure that the directory you place the
socket in is not world-accessible.
For example, \f[CR]/run/user/UID/my.socket\f[R] would be suitable.
.SS -dev, -nodev
Enable (\f[CR]-dev\f[R]) or disable (\f[CR]-nodev\f[R]) device files in
a gocryptfs mount (default: \f[CR]-nodev\f[R]).
If both are specified, \f[CR]-nodev\f[R] takes precedence.
You need root permissions to use \f[CR]-dev\f[R].
.SS -e PATH, -exclude PATH
Only for reverse mode: exclude relative plaintext path from the
encrypted view, matching only from root of mounted filesystem.
Can be passed multiple times.
.PP
Example that excludes the directories \[lq]Music\[rq] and
\[lq]Movies\[rq] from the root directory:
.IP
.EX
gocryptfs -reverse -exclude Music -exclude Movies /home/user /mnt/user.encrypted
.EE
.PP
See also \f[CR]-exclude-wildcard\f[R], \f[CR]-exclude-from\f[R] and the
EXCLUDING FILES section.
.SS -ew GITIGNORE-PATTERN, -exclude-wildcard GITIGNORE-PATTERN
Only for reverse mode: exclude paths from the encrypted view in
gitignore(5) syntax, wildcards supported.
Pass multiple times for multiple patterns.
.PP
Example to exclude all \f[CR].mp3\f[R] files in any directory:
.IP
.EX
gocryptfs -reverse -exclude-wildcard \[aq]*.mp3\[aq] /home/user /mnt/user.encrypted
.EE
.PP
Example to to exclude everything but the directory `important' in the
root dir:
.IP
.EX
gocryptfs -reverse -exclude-wildcard \[aq]*\[aq] -exclude-wildcard \[aq]!/important\[aq] /home/user /mnt/user.encrypted
.EE
.PP
See also \f[CR]-exclude-from\f[R] and the EXCLUDING FILES section.
.SS -exclude-from FILE
Only for reverse mode: reads gitignore patterns from a file.
Can be passed multiple times.
Example:
.IP
.EX
gocryptfs -reverse -exclude-from \[ti]/crypt-exclusions /home/user /mnt/user.encrypted
.EE
.PP
See also \f[CR]-exclude\f[R], \f[CR]-exclude-wildcard\f[R] and the
EXCLUDING FILES section.
.SS -exec, -noexec
Enable (\f[CR]-exec\f[R]) or disable (\f[CR]-noexec\f[R]) executables in
a gocryptfs mount (default: \f[CR]-exec\f[R]).
If both are specified, \f[CR]-noexec\f[R] takes precedence.
.SS -fg, -f
Stay in the foreground instead of forking away.
For compatibility, \[lq]-f\[rq] is also accepted, but \[lq]-fg\[rq] is
preferred.
.PP
Unless \f[CR]-notifypid\f[R] is also passed, the logs go to stdout and
stderr instead of syslog.
.SS -force_owner string
If given a string of the form \[lq]uid:gid\[rq] (where both
\[lq]uid\[rq] and \[lq]gid\[rq] are substituted with positive integers),
presents all files as owned by the given uid and gid, regardless of
their actual ownership.
Implies \[lq]allow_other\[rq].
.PP
This is rarely desired behavior: One should \f[I]usually\f[R] run
gocryptfs as the account which owns the backing-store files, which
should \f[I]usually\f[R] be one and the same with the account intended
to access the decrypted content.
An example of a case where this may be useful is a situation where
content is stored on a filesystem that doesn\[cq]t properly support UNIX
ownership and permissions.
.SS -forcedecode
Obsolete and ignored on gocryptfs v2.2 and later.
.PP
See
https://github.com/rfjakob/gocryptfs/commit/d023cd6c95fcbc6b5056ba1f425d2ac3df4abc5a
for what it was and why it was dropped.
.SS -fsname string
Override the filesystem name (first column in df -T).
Can also be passed as \[lq]-o fsname=\[rq] and is equivalent to
libfuse\[cq]s option of the same name.
By default, CIPHERDIR is used.
.SS -fusedebug
Enable fuse library debug output.
.SS -i duration, -idle duration
Only for forward mode: automatically unmount the filesystem if it has
been idle for the specified duration.
Durations can be specified like \[lq]500s\[rq] or \[lq]2h45m\[rq].
0 (the default) means stay mounted indefinitely.
.PP
When a process has open files or its working directory in the mount,
this will keep it not idle indefinitely.
.SS -kernel_cache
Enable the kernel_cache option of the FUSE filesystem, see fuse(8) for
details.
.SS -ko
Pass additional mount options to the kernel (comma-separated list).
FUSE filesystems are mounted with \[lq]nodev,nosuid\[rq] by default.
If gocryptfs runs as root, you can enable device files by passing the
opposite mount option, \[lq]dev\[rq], and if you want to enable
suid-binaries, pass \[lq]suid\[rq].
\[lq]ro\[rq] (equivalent to passing the \[lq]-ro\[rq] option) and
\[lq]noexec\[rq] may also be interesting.
For a complete list see the section
\f[CR]FILESYSTEM-INDEPENDENT MOUNT OPTIONS\f[R] in mount(8).
On MacOS, \[lq]local\[rq] enables volume-based trash if you have
\f[CR].Trashes\f[R] folder in the root of your volume (might need to be
manually created) note, though, that \[lq]local\[rq] is marked as
\[lq]experimental\[rq] in
osxfuse (https://github.com/osxfuse/osxfuse/wiki/Mount-options#local);
\[lq]noapplexattr\[rq], \[lq]noappledouble\[rq] may also be interesting.
.PP
Note that unlike \[lq]-o\[rq], \[lq]-ko\[rq] is a regular option and
must be passed BEFORE the directories.
Example:
.IP
.EX
gocryptfs -ko noexec /tmp/foo /tmp/bar
.EE
.SS -longnames
Store names that are longer than 175 bytes in extra files (default
true).
.PP
This flag is only useful when recovering very old gocryptfs filesystems
(gocryptfs v0.8 and earlier) using \[lq]-masterkey\[rq].
It is ignored (stays at the default) otherwise.
.SS -nodev
See \f[CR]-dev, -nodev\f[R].
.SS -noexec
See \f[CR]-exec, -noexec\f[R].
.SS -nofail
Having the \f[CR]nofail\f[R] option in \f[CR]/etc/fstab\f[R] instructs
\f[CR]systemd\f[R] to continue booting normally even if the mount fails
(see \f[CR]man systemd.fstab\f[R]).
.PP
The option is ignored by \f[CR]gocryptfs\f[R] itself and has no effect
outside \f[CR]/etc/fstab\f[R].
.SS -nonempty
Allow mounting over non-empty directories.
FUSE by default disallows this to prevent accidental shadowing of files.
.SS -noprealloc
Disable preallocation before writing.
By default, gocryptfs preallocates the space the next write will take
using fallocate(2) in mode FALLOC_FL_KEEP_SIZE.
The preallocation makes sure it cannot run out of space in the middle of
the write, which would cause the last 4kB block to be corrupt and
unreadable.
.PP
On ext4, preallocation is fast and does not cause a noticeable
performance hit.
Unfortunately, on Btrfs, preallocation is very slow, especially on
rotational HDDs.
The \[lq]-noprealloc\[rq] option gives users the choice to trade
robustness against out-of-space errors for a massive speedup.
.PP
For benchmarks and more details of the issue see
https://github.com/rfjakob/gocryptfs/issues/63 .
.SS -nosuid
See \f[CR]-suid, -nosuid\f[R].
.SS -nosyslog
Diagnostic messages are normally redirected to syslog once gocryptfs
daemonizes.
This option disables the redirection and messages will continue be
printed to stdout and stderr.
.SS -notifypid int
Send USR1 to the specified process after successful mount.
This is used internally for daemonization.
.SS -one-file-system
Don\[cq]t cross filesystem boundaries (like rsync\[cq]s
\f[CR]--one-file-system\f[R]).
Mountpoints will appear as empty directories.
.PP
Only applicable to reverse mode.
.PP
Limitation: Mounted single files (yes this is possible) are NOT hidden.
.SS -rw, -ro
Mount the filesystem read-write (\f[CR]-rw\f[R], default) or read-only
(\f[CR]-ro\f[R]).
If both are specified, \f[CR]-ro\f[R] takes precedence.
.SS -reverse
See the \f[CR]-reverse\f[R] section in INIT FLAGS.
You need to specify the \f[CR]-reverse\f[R] option both at
\f[CR]-init\f[R] and at mount.
.SS -serialize_reads
The kernel usually submits multiple concurrent reads to service
userspace requests and kernel readahead.
gocryptfs serves them concurrently and in arbitrary order.
On backing storage that performs poorly for concurrent or out-of-order
reads (like Amazon Cloud Drive), this behavior can cause very slow read
speeds.
.PP
The \f[CR]-serialize_reads\f[R] option does two things: (1) reads will
be submitted one-by-one (no concurrency) and (2) gocryptfs tries to
order the reads by file offset order.
.PP
The ordering requires gocryptfs to wait a certain time before submitting
a read.
The serialization introduces extra locking.
These factors will limit throughput to below 70MB/s.
.PP
For more details visit https://github.com/rfjakob/gocryptfs/issues/92 .
.SS -sharedstorage
Enable work-arounds so gocryptfs works better when the backing storage
directory is concurrently accessed by multiple gocryptfs instances.
.PP
At the moment, it does two things:
.IP "1." 3
Disable stat() caching so changes to the backing storage show up
immediately.
.IP "2." 3
Disable hard link tracking, as the inode numbers on the backing storage
are not stable when files are deleted and re-created behind our back.
This would otherwise produce strange \[lq]file does not exist\[rq] and
other errors.
.PP
When \[lq]-sharedstorage\[rq] is active, performance is reduced and hard
links cannot be created.
.PP
Even with this flag set, you may hit occasional problems.
Running gocryptfs on shared storage does not receive as much testing as
the usual (exclusive) use-case.
Please test your workload in advance and report any problems you may
hit.
.PP
More info: https://github.com/rfjakob/gocryptfs/issues/156
.SS -suid, -nosuid
Enable (\f[CR]-suid\f[R]) or disable (\f[CR]-nosuid\f[R]) suid and sgid
executables in a gocryptfs mount (default: \f[CR]-nosuid\f[R]).
If both are specified, \f[CR]-nosuid\f[R] takes precedence.
You need root permissions to use \f[CR]-suid\f[R].
.SS -zerokey
Use all-zero dummy master key.
This options is only intended for automated testing as it does not
provide any security.
.SH COMMON OPTIONS
Options that apply to more than one action are listed below.
Each options lists where it is applicable.
Again, usually you don\[cq]t need any.
.SS -config string
Use specified config file instead of
\f[CR]CIPHERDIR/gocryptfs.conf\f[R].
.PP
Applies to: all actions that use a config file: mount, \f[CR]-fsck\f[R],
\f[CR]-passwd\f[R], \f[CR]-info\f[R], \f[CR]-init\f[R].
.SS -cpuprofile string
Write cpu profile to specified file.
.PP
Applies to: all actions.
.SS -d, -debug
Enable debug output.
.PP
Applies to: all actions.
.SS -extpass CMD [-extpass ARG1 \&...]
Use an external program (like ssh-askpass) for the password prompt.
The program should return the password on stdout, a trailing newline is
stripped by gocryptfs.
If you just want to read from a password file, see \f[CR]-passfile\f[R].
.PP
When \f[CR]-extpass\f[R] is specified once, the string argument will be
split on spaces.
For example, \f[CR]-extpass \[dq]md5sum my password.txt\[dq]\f[R] will
be executed as
\f[CR]\[dq]md5sum\[dq] \[dq]my\[dq] \[dq]password.txt\[dq]\f[R], which
is NOT what you want.
.PP
Specify \f[CR]-extpass\f[R] twice or more to use the string arguments
as-is.
For example, you DO want to call \f[CR]md5sum\f[R] like this:
\f[CR]-extpass \[dq]md5sum\[dq] -extpass \[dq]my password.txt\[dq]\f[R].
.PP
If you want to prevent splitting on spaces but don\[cq]t want to pass
arguments to your program, use \f[CR]\[dq]--\[dq]\f[R], which is
accepted by most programs:
\f[CR]-extpass \[dq]my program\[dq] -extpass \[dq]--\[dq]\f[R]
.PP
Applies to: all actions that ask for a password.
.PP
BUG: In \f[CR]-extpass -X\f[R], the \f[CR]-X\f[R] will be interpreted as
\f[CR]--X\f[R].
Please use \f[CR]-extpass=-X\f[R] to prevent that.
See \f[B]Dash duplication\f[R] in the \f[B]BUGS\f[R] section for
details.
.SS -fido2 DEVICE_PATH
Use a FIDO2 token to initialize and unlock the filesystem.
Use \[lq]fido2-token -L\[rq] to obtain the FIDO2 token device path.
For linux, \[lq]fido2-tools\[rq] package is needed.
.PP
Applies to: all actions that ask for a password.
.SS -masterkey string
Use an explicit master key specified on the command line or, if the
special value \[lq]stdin\[rq] is used, read the masterkey from stdin,
instead of reading the config file and asking for the decryption
password.
.PP
Note that the command line, and with it the master key, is visible to
anybody on the machine who can execute \[lq]ps -auxwww\[rq].
Use \[lq]-masterkey=stdin\[rq] to avoid that risk.
.PP
The masterkey option is meant as a recovery option for emergencies, such
as if you have forgotten the password or lost the config file.
.PP
Even if a config file exists, it will not be used.
All non-standard settings have to be passed on the command line:
\f[CR]-aessiv\f[R] when you mount a filesystem that was created using
reverse mode, or \f[CR]-plaintextnames\f[R] for a filesystem that was
created with that option.
.PP
Examples:
.IP
.EX
-masterkey=6f717d8b-6b5f8e8a-fd0aa206-778ec093-62c5669b-abd229cd-241e00cd-b4d6713d
-masterkey=stdin
.EE
.PP
Applies to: all actions that ask for a password.
.SS -memprofile string
Write memory profile to the specified file.
This is useful when debugging memory usage of gocryptfs.
.PP
Applies to: all actions.
.SS -o COMMA-SEPARATED-OPTIONS
For compatibility with mount(1), options are also accepted as \[lq]-o
COMMA-SEPARATED-OPTIONS\[rq] at the end of the command line.
For example, \[lq]-o q,zerokey\[rq] is equivalent to passing \[lq]-q
-zerokey\[rq].
.PP
Note that you can only use options that are understood by gocryptfs with
\[lq]-o\[rq].
If you want to pass special flags to the kernel, you should use
\[lq]-ko\[rq] (\f[I]k\f[R]ernel \f[I]o\f[R]ption).
This is different in libfuse-based filesystems, that automatically pass
any \[lq]-o\[rq] options they do not understand along to the kernel.
.PP
Example:
.IP
.EX
gocryptfs /tmp/foo /tmp/bar -o q,zerokey
.EE
.PP
Applies to: all actions.
.SS -openssl bool/\[lq]auto\[rq]
Use OpenSSL instead of built-in Go crypto (default \[lq]auto\[rq]).
Using built-in crypto is 4x slower unless your CPU has AES instructions
and you are using Go 1.6+.
In mode \[lq]auto\[rq], gocrypts chooses the faster option.
.PP
Applies to: all actions.
.SS -passfile FILE [-passfile FILE2 \&...]
Read password from the specified plain text file.
The file should contain exactly one line (do not use binary files!).
A warning will be printed if there is more than one line, and only the
first line will be used.
A single trailing newline is allowed and does not cause a warning.
.PP
Pass this option multiple times to read the first line from multiple
files.
They are concatenated for the effective password.
.PP
Example:
.IP
.EX
echo hello > hello.txt
echo word > world.txt
gocryptfs -passfile hello.txt -passfile world.txt
.EE
.PP
The effective password will be \[lq]helloworld\[rq].
.PP
Applies to: all actions that ask for a password.
.SS -q, -quiet
Quiet - silence informational messages.
.PP
Applies to: all actions.
.SS -scryptn int
gocryptfs uses \f[I]scrypt\f[R] for hashing the password when mounting,
which protects from brute-force attacks.
.PP
\f[CR]-scryptn\f[R] controls the \f[I]scrypt\f[R] cost parameter
\[lq]N\[rq] expressed as scryptn=log2(N).
Possible values are \f[CR]-scryptn=10\f[R] to \f[CR]-scryptn=28\f[R],
representing N=2\[ha]10 to N=2\[ha]28.
.PP
Setting this to a lower value speeds up mounting and reduces its memory
needs, but makes the password susceptible to brute-force attacks.
The default is 16.
.PP
The memory usage for \f[I]scrypt\f[R] during mounting is as follows:
.IP
.EX
scryptn     Memory Usage  
=======     ============
10          1   MiB
11          2 
12          4 
13          8 
14          16  
15          32  
16          64  
17          128 
18          256 
19          512 
20          1   GiB
21          2 
22          4 
23          8 
24          16  
25          32  
26          64  
27          128 
28          256 
.EE
.PP
Applies to: \f[CR]-init\f[R], \f[CR]-passwd\f[R]
.PP
See also: the benchmarks in the gocryptfs source code in
internal/configfile.
.SS -trace string
Write execution trace to file.
View the trace using \[lq]go tool trace FILE\[rq].
.PP
Applies to: all actions.
.SS -wpanic
When encountering a warning, panic and exit immediately.
This is useful in regression testing.
.PP
Applies to: all actions.
.SS --
Stop option parsing.
Helpful when CIPHERDIR may start with a dash \[lq]-\[rq].
.PP
Applies to: all actions.
.SH EXCLUDING FILES
In reverse mode, it is possible to exclude files from the encrypted
view, using the \f[CR]-exclude\f[R], \f[CR]-exclude-wildcard\f[R] and
\f[CR]-exclude-from\f[R] options.
.PP
\f[CR]-exclude\f[R] matches complete paths, so
\f[CR]-exclude file.txt\f[R] only excludes a file named
\f[CR]file.txt\f[R] in the root of the mounted filesystem; files named
\f[CR]file.txt\f[R] in subdirectories are still visible.
Wildcards are NOT supported.
This option is kept for compatibility with the behavior up to version
1.6.x.
New users should use \f[CR]-exclude-wildcard\f[R] instead.
.PP
\f[CR]-exclude-wildcard\f[R] uses gitignore syntax and matches files
anywhere, so \f[CR]-exclude-wildcard file.txt\f[R] excludes files named
\f[CR]file.txt\f[R] in any directory.
If you want to match complete paths, you can prefix the filename with a
\f[CR]/\f[R]: \f[CR]-exclude-wildcard /file.txt\f[R] excludes only
\f[CR]file.txt\f[R] in the root of the mounted filesystem.
.PP
If there are many exclusions, you can use \f[CR]-exclude-from\f[R] to
read gitignore patterns from a file.
As with \f[CR]-exclude-wildcard\f[R], use a leading \f[CR]/\f[R] to
match complete paths.
.PP
The rules for exclusion are that of
gitignore (https://git-scm.com/docs/gitignore#_pattern_format).
In short:
.IP "1." 3
A blank line matches no files, so it can serve as a separator for
readability.
.IP "2." 3
A line starting with \f[CR]#\f[R] serves as a comment.
Put a backslash (\f[CR]\[rs]\f[R]) in front of the first hash for
patterns that begin with a hash.
.IP "3." 3
Trailing spaces are ignored unless they are quoted with backslash
(\f[CR]\[rs]\f[R]).
.IP "4." 3
An optional prefix \f[CR]!\f[R] negates the pattern; any matching file
excluded by a previous pattern will become included again.
It is not possible to re-include a file if a parent directory of that
file is excluded.
Put a backslash (\f[CR]\[rs]\f[R]) in front of the first \f[CR]!\f[R]
for patterns that begin with a literal \f[CR]!\f[R], for example,
\f[CR]\[rs]!important!.txt\f[R].
.IP "5." 3
If the pattern ends with a slash, it is removed for the purpose of the
following description, but it would only find a match with a directory.
In other words, \f[CR]foo/\f[R] will match a directory foo and paths
underneath it, but will not match a regular file or a symbolic link foo.
.IP "6." 3
If the pattern does not contain a slash \f[CR]/\f[R], it is treated as a
shell glob pattern and checked for a match against the pathname relative
to the root of the mounted filesystem.
.IP "7." 3
Otherwise, the pattern is treated as a shell glob suitable for
consumption by fnmatch(3) with the FNM_PATHNAME flag: wildcards in the
pattern will not match a \f[CR]/\f[R] in the pathname.
For example, \f[CR]Documentation/*.html\f[R] matches
\f[CR]Documentation/git.html\f[R] but not
\f[CR]Documentation/ppc/ppc.html\f[R] or
\f[CR]tools/perf/Documentation/perf.html\f[R].
.IP "8." 3
A leading slash matches the beginning of the pathname.
For example, \f[CR]/*.c\f[R] matches \f[CR]cat-file.c\f[R] but not
\f[CR]mozilla-sha1/sha1.c\f[R].
.IP "9." 3
Two consecutive asterisks (\f[CR]**\f[R]) in patterns matched against
full pathname may have special meaning:
.RS 4
.IP "  i." 5
A leading \f[CR]**\f[R] followed by a slash means match in all
directories.
For example, \f[CR]**/foo\f[R] matches file or directory \f[CR]foo\f[R]
anywhere, the same as pattern \f[CR]foo\f[R].
\f[CR]**/foo/bar\f[R] matches file or directory \f[CR]bar\f[R] anywhere
that is directly under directory \f[CR]foo\f[R].
.IP " ii." 5
A trailing \f[CR]/**\f[R] matches everything inside.
For example, \f[CR]abc/**\f[R] matches all files inside directory
\f[CR]abc\f[R], with infinite depth.
.IP "iii." 5
A slash followed by two consecutive asterisks then a slash matches zero
or more directories.
For example, \f[CR]a/**/b\f[R] matches \f[CR]a/b\f[R], \f[CR]a/x/b\f[R],
\f[CR]a/x/y/b\f[R] and so on.
.IP " iv." 5
Other consecutive asterisks are considered invalid.
.RE
.SH EXAMPLES
.SS Init
Create an encrypted filesystem in directory \[lq]mydir.crypt\[rq], mount
it on \[lq]mydir\[rq]:
.IP
.EX
mkdir mydir.crypt mydir
gocryptfs -init mydir.crypt
gocryptfs mydir.crypt mydir
.EE
.SS Mount
Mount an encrypted view of joe\[cq]s home directory using reverse mode:
.IP
.EX
mkdir /home/joe.crypt
gocryptfs -init -reverse /home/joe
gocryptfs -reverse /home/joe /home/joe.crypt
.EE
.SS fstab
Adding this line to \f[CR]/etc/fstab\f[R] will mount
\f[CR]/tmp/cipher\f[R] to \f[CR]/tmp/plain\f[R] on boot, using the
password in \f[CR]/tmp/passfile\f[R].
Use \f[CR]sudo mount -av\f[R] to test the line without having to reboot.
Adjust the gocryptfs path acc.
to the output of the command \f[CR]which gocryptfs\f[R].
Do use the \f[CR]nofail\f[R] option to prevent an unbootable system if
the gocryptfs mount fails (see the \f[CR]-nofail\f[R] option for
details).
.IP
.EX
/tmp/cipher /tmp/plain fuse./usr/local/bin/gocryptfs nofail,allow_other,passfile=/tmp/password 0 0
.EE
.SH ENVIRONMENT VARIABLES
.SS NO_COLOR
If \f[CR]NO_COLOR\f[R] is set (regardless of value), colored output is
disabled (see https://no-color.org/).
.SH EXIT CODES
0: success
.PD 0
.P
.PD
6: CIPHERDIR is not an empty directory (on \[lq]-init\[rq])
.PD 0
.P
.PD
10: MOUNTPOINT is not an empty directory
.PD 0
.P
.PD
12: password incorrect
.PD 0
.P
.PD
22: password is empty (on \[lq]-init\[rq])
.PD 0
.P
.PD
23: could not read gocryptfs.conf
.PD 0
.P
.PD
24: could not write gocryptfs.conf (on \[lq]-init\[rq] or
\[lq]-password\[rq])
.PD 0
.P
.PD
26: fsck found errors
.PD 0
.P
.PD
other: please check the error message
.PP
See also:
https://github.com/rfjakob/gocryptfs/blob/master/internal/exitcodes/exitcodes.go
.SH BUGS
.SS Dash duplication
gocryptfs v2.1 switched to the \f[CR]pflag\f[R] library for command-line
parsing to support flags and positional arguments in any order.
To stay compatible with single-dash long options like
\f[CR]-extpass\f[R], an ugly hack was added: The command line is
preprocessed, and all single-dash options are converted to double-dash.
.PP
Unfortunately, this means that in
.IP
.EX
gocryptfs -extpass myapp -extpass -X
.EE
.PP
gocryptfs transforms the \f[CR]-X\f[R] to \f[CR]--X\f[R], and it will
call \f[CR]myapp --X\f[R] as the extpass program.
.PP
Please use
.IP
.EX
gocryptfs -extpass myapp -extpass=-X
.EE
.PP
to work around this bug.
.SH SEE ALSO
mount(2) fuse(8) fallocate(2) encfs(1) gitignore(5)
.SH AUTHORS
github.com/rfjakob.