google / google/fscrypt

Can't lock folders encrypted with fscrypt

Open
#402 15 comments 5 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
1k
Forks
111
Avg merge
2d 19h
Merged PRs (30d)
3

Description

I have multiple folders encrypted with fscrypt in various directories. They have various files in them (images, videos, text). I open a file and close it with Ctrl+Q. Then I want to lock the folder with `fscrypt lock test/`, however it always fails. Doesn't matter which folder or which file.

```
[ERROR] fscrypt lock: Directory was incompletely locked because some files are still open. These files remain
accessible.

Try killing any processes using files in the directory, for example using:

find "test/" -print0 | xargs -0 fuser -k

Then re-run:

fscrypt lock "test/"

```

Running `find "test/" -print0 | xargs -0 fuser -k` as user I get:
```
Cannot stat file /proc/1025/fd/0: Permission denied
Cannot stat file /proc/1025/fd/1: Permission denied
Cannot stat file /proc/1025/fd/2: Permission denied
Cannot stat file /proc/1025/fd/3: Permission denied
Cannot stat file /proc/1025/fd/4: Permission denied
Cannot stat file /proc/1025/fd/5: Permission denied
Cannot stat file /proc/1025/fd/6: Permission denied
Cannot stat file /proc/1025/fd/7: Permission denied
Cannot stat file /proc/1025/fd/8: Permission denied
Cannot stat file /proc/1025/fd/9: Permission denied
...
Cannot stat file /proc/1025/fd/126: Permission denied
```
Running it as root I don't get the permission denied error. However, re-running `fscrypt lock test/` still doesn't work. I make sure I close all files I open with Ctrl+Q. The thumbnails for the files are already generated. When it is "locked" in this state, I can see all the folder names and files, even the thumbnails, but I can't actually open or view any of them.
```
Error opening file. Required key not available.
```
This is what `fscrypt status test/` says:

```
"test/" is encrypted with fscrypt.

Policy: f307c445aef870630f1d56a6e272320c
Options: padding:32 contents:AES_256_XTS filenames:AES_256_CTS policy_version:2
Unlocked: Partially (incompletely locked)

Protected with 1 protector:
PROTECTOR LINKED DESCRIPTION
c140495356242008 No custom protector "Test"
```

Arch Linux
linux 6.7.4.arch1-1
fscrypt version v0.3.4

When I reboot, the folders are properly locked and nothing inside is visible. But unlocking results in the same issue. Have to keep rebooting.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.