Bringing fscrypt Encryption to CephFS Userspace
summary
Brings kernel fscrypt support into userspace by adding libcephfs and ceph-fuse implementations, new ioctls (set/get V2) and a crypto keyring so directories can be unlocked and locked per the fscrypt spec. Implements access semantics, a two‑phase fscrypt last block truncate to avoid corruption, and a test suite using fssb, pjd and many CLI utilities. Single‑client data+metadata workloads are stable, concurrent client validation continues and a PR to block unsafe moves is open.
AI-written summary · about
chapters (11)
- 0:00Introduction and overview
- 7:33Historical context and kernel support
- 13:05Motivation for user space implementation
- 13:27Core functional work and challenges
- 16:21Implementing access semantics
- 18:10Testing and debugging utilities
- 21:51Interoperability between clients
- 23:37Fscrypt last block implementation
- 26:05Usage methods and commands
- 27:51Future plans and next steps
- 29:47Q&A session
related talks
33mEncryption for filesystems with advanced features new fscrypt functionality
30mData Security: Theoretical and Real World Approache...
36mCeph Security BoF
35mData Security and Storage Hardening in Rook and Ceph
28mSpeculative Encryption on GPU Applied to Cryptographic File Systems
32mSecurity Features for UBIFS
18mData Security and Storage Hardening in Rook and Ceph
27mCoupling Key-Ring and Linux Crypto-API Framework(LCF) via Crypto-Transformation(tfm)