[bug] Logged users can view each other encrypted files in plaintext about fscrypt HOT 5 CLOSED

As mentioned on other issues, you can use chmod 0700 to forbid other users from accessing directories.

from fscrypt.

Unfortunately this appears to be a side-effect from the current implementation.

@ebiggers said:

This is a known issue with filesystem encryption in the kernel: the caches that allow encrypted files to be accessed are systemwide

So your data is safe from extraction after physical hardware theft. However, parties that manage to get some kind of access to your machine can still spy on your files. As soon as you access them, they can see them too.

from fscrypt.

Just as a reminder for people who come here from google: Make sure to do a umask 077 that sticks.

Otherwise every new dir/file created with your user will default to 755/644.

Be aware of the maze that is .profile, .bash_profile, .bashrc and which one is read when. It might be best to set system-wide defaults in /etc/profile in /etc/login.defs.

from fscrypt.

2b6667a changed fscrypt encrypt to set mode 0700 on new encrypted directories.

So I think this issue should be closed.

from fscrypt.

Closing as resolved by #134

from fscrypt.