add a custom path for /etc/fscrypt.conf about fscrypt HOT 6 OPEN

@limbo127 do you not want to have to create /etc/fscrypt.conf at all? Or do you just need a way to override parameters in it for a specific call?

from fscrypt.

from fscrypt.

@josephlr What are we planning to do in this. I think providing a command line flag to specify custom configuration file is a good idea, or else we can also have an environment variable(like FSCRYPT_CONFIG) specifying the config file path.
I can work on this.

from fscrypt.

@fristonio My idea here was to basically allow /etc/fscrypt.conf to exist in multiple places, and then define a sane ordering to look though them, overriding settings as we go. My thoughts on the order (basically from lower to higher priority):

0. Compiled in application defaults
1. /etc/fscrypt.conf
2. User configuration dirs as specified by the XDG Specification. This basically means we search for $XDG_CONFIG_HOME/fscrypt/fscrypt.config aka ~/.config/fscrypt/fscrypt.conf.
3. A flag passed in naming a file to be used. This could also be parameters for each option, but a command line flag seems better.

Thoughts? This change also means that we could remove certain things we write to /etc/fscrypt.conf by default. For example, if the file encryption mode isn't set, the fscrypt binary could chose the "best" algorithm avalible on the system.

from fscrypt.

Yeah, this looks good to me. A few things though.

Compiled in application defaults

I don't understand this. Are you trying to say that /etc/fscrypt.conf shouldn't be the default but the one specified by user during compile time should be used as default?

if the file encryption mode isn't set, the fscrypt binary could chose the "best" algorithm avalible on the system?

We don't do this now?

from fscrypt.

A while ago, 31bc8c8 added a FSCRYPT_CONF environmental variable for testing purposes. I'm not sure whether we should just document that and consider this issue closed, or whether we should still implement the more complex design described in #72 (comment). It might be best to keep things simple for now.

from fscrypt.