.\" This is a man page. View it using 'man ./gocryptfs.1'
.\"
.\" Automatically generated by Pandoc 1.18
.\"
.TH "GOCRYPTFS" "1" "Oct 2016" "" ""
.hy
.SH NAME
.PP
gocryptfs \- mount an encrypted directory
.SH SYNOPSIS
.SS Initialize encrypted filesystem
.PP
gocryptfs \-init [OPTIONS] CIPHERDIR
.SS Mount
.PP
gocryptfs [OPTIONS] CIPHERDIR MOUNTPOINT [\-o COMMA\-SEPARATED\-OPTIONS]
.SS Change password
.PP
gocryptfs \-passwd [OPTIONS] CIPHERDIR
.SH DESCRIPTION
.PP
Options:
.TP
.B \f[B]\-aessiv\f[]
Use the AES\-SIV encryption mode.
This is slower than GCM but is secure with deterministic nonces as used
in "\-reverse" mode.
.RS
.RE
.TP
.B \f[B]\-allow_other\f[]
By default, the Linux kernel prevents any other user (even root) to
access a mounted FUSE filesystem.
Settings this option allows access for other users, subject to file
permission checking.
Only works if user_allow_other is set in /etc/fuse.conf.
This option is equivalent to "allow_other" plus "default_permissions"
described in fuse(8).
.RS
.RE
.TP
.B \f[B]\-config string\f[]
Use specified config file instead of CIPHERDIR/gocryptfs.conf
.RS
.RE
.TP
.B \f[B]\-cpuprofile string\f[]
Write cpu profile to specified file
.RS
.RE
.TP
.B \f[B]\-ctlsock string\f[]
Create a control socket at the specified location.
The socket can be used to decrypt and encrypt paths inside the
filesystem.
When using this option, make sure that the direcory you place the socket
in is not world\-accessible.
For example, \f[C]/run/user/UID/my.socket\f[] would be suitable.
.RS
.RE
.TP
.B \f[B]\-d, \-debug\f[]
Enable debug output
.RS
.RE
.TP
.B \f[B]\-extpass string\f[]
Use an external program (like ssh\-askpass) for the password prompt.
The program should return the password on stdout, a trailing newline is
stripped by gocryptfs.
Using something like "cat /mypassword.txt" allows to mount the gocryptfs
filesytem without user interaction.
.RS
.RE
.TP
.B \f[B]\-fg, \-f\f[]
Stay in the foreground instead of forking away.
Implies "\-nosyslog".
For compatability, "\-f" is also accepted, but "\-fg" is preferred.
.RS
.RE
.TP
.B \f[B]\-fusedebug\f[]
Enable fuse library debug output
.RS
.RE
.TP
.B \f[B]\-init\f[]
Initialize encrypted directory
.RS
.RE
.TP
.B \f[B]\-ko\f[]
Pass additonal mount options to the kernel (comma\-separated list).
FUSE filesystems are mounted with "nodev,nosuid" by default.
If gocryptfs runs as root, you can enable device files by passing the
opposite mount option, "dev", and if you want to enable suid\-binaries,
pass "suid".
"ro" (equivalent to passing the "\-ro" option) and "noexec" may also be
interesting.
For a complete list see the section
\f[C]FILESYSTEM\-INDEPENDENT\ MOUNT\ OPTIONS\f[] in mount(8).
.RS
.RE
.TP
.B \f[B]\-longnames\f[]
Store names longer than 176 bytes in extra files (default true) This
flag is useful when recovering old gocryptfs filesystems using
"\-masterkey".
It is ignored (stays at the default) otherwise.
.RS
.RE
.TP
.B \f[B]\-masterkey string\f[]
Use a explicit master key specified on the command line.
This option can be used to mount a gocryptfs filesystem without a config
file.
Note that the command line, and with it the master key, is visible to
anybody on the machine who can execute "ps \-auxwww".
This is meant as a recovery option for emergencies, such as if you have
forgotten your password.
.RS
.PP
Example master key:
.PD 0
.P
.PD
6f717d8b\-6b5f8e8a\-fd0aa206\-778ec093\-62c5669b\-abd229cd\-241e00cd\-b4d6713d
.RE
.TP
.B \f[B]\-memprofile string\f[]
Write memory profile to the specified file.
This is useful when debugging memory usage of gocryptfs.
.RS
.RE
.TP
.B \f[B]\-nonempty\f[]
Allow mounting over non\-empty directories.
FUSE by default disallows this to prevent accidential shadowing of
files.
.RS
.RE
.TP
.B \f[B]\-noprealloc\f[]
Disable preallocation before writing.
By default, gocryptfs preallocates the space the next write will take
using fallocate(2) in mode FALLOC_FL_KEEP_SIZE.
The preallocation makes sure it cannot run out of space in the middle of
the write, which would cause the last 4kB block to be corrupt and
unreadable.
.RS
.PP
On ext4, preallocation is fast and does not cause a noticeable
performance hit.
Unfortunately, on Btrfs, preallocation is very slow, especially on
rotational HDDs.
The "\-noprealloc" option gives users the choice to trade robustness
against out\-of\-space errors for a massive speedup.
.PP
For benchmarks and more details of the issue see
https://github.com/rfjakob/gocryptfs/issues/63 .
.RE
.TP
.B \f[B]\-nosyslog\f[]
Diagnostic messages are normally redirected to syslog once gocryptfs
daemonizes.
This option disables the redirection and messages will continue be
printed to stdout and stderr.
.RS
.RE
.TP
.B \f[B]\-notifypid int\f[]
Send USR1 to the specified process after successful mount.
This is used internally for daemonization.
.RS
.RE
.TP
.B \f[B]\-o COMMA\-SEPARATED\-OPTIONS\f[]
For compatibility with mount(1), options are also accepted as "\-o
COMMA\-SEPARATED\-OPTIONS" at the end of the command line.
For example, "\-o q,zerokey" is equivalent to passing "\-q \-zerokey".
.RS
.RE
.TP
.B \f[B]\-openssl bool/"auto"\f[]
Use OpenSSL instead of built\-in Go crypto (default "auto").
Using built\-in crypto is 4x slower unless your CPU has AES instructions
and you are using Go 1.6+.
In mode "auto", gocrypts chooses the faster option.
.RS
.RE
.TP
.B \f[B]\-passfile string\f[]
Read password from the specified file.
This is a shortcut for specifying "\-extpass /bin/cat FILE".
.RS
.RE
.TP
.B \f[B]\-passwd\f[]
Change the password.
Will ask for the old password, check if it is correct, and ask for a new
one.
.RS
.PP
This can be used together with \f[C]\-masterkey\f[] if you forgot the
password but know the master key.
Note that without the old password, gocryptfs cannot tell if the master
key is correct and will overwrite the old one without mercy.
It will, however, create a backup copy of the old config file as
\f[C]gocryptfs.conf.bak\f[].
Delete it after you have verified that you can access your files with
the new password.
.RE
.TP
.B \f[B]\-plaintextnames\f[]
Do not encrypt file names and symlink targets
.RS
.RE
.TP
.B \f[B]\-q, \-quiet\f[]
Quiet \- silence informational messages
.RS
.RE
.TP
.B \f[B]\-raw64\f[]
Use unpadded base64 encoding for file names.
This gets rid of the trailing "\\=\\=".
A filesystem created with this option can only be mounted using
gocryptfs v1.2 and higher.
.RS
.RE
.TP
.B \f[B]\-reverse\f[]
Reverse mode shows a read\-only encrypted view of a plaintext directory.
Implies "\-aessiv".
.RS
.RE
.TP
.B \f[B]\-ro\f[]
Mount the filesystem read\-only
.RS
.RE
.TP
.B \f[B]\-scryptn int\f[]
scrypt cost parameter logN.
Setting this to a lower value speeds up mounting but makes the password
susceptible to brute\-force attacks (default 16)
.RS
.RE
.TP
.B \f[B]\-version\f[]
Print version and exit.
The output contains three fields seperated by ";".
Example: "gocryptfs v1.1.1\-5\-g75b776c; go\-fuse 6b801d3; 2016\-11\-01
go1.7.3".
Field 1 is the gocryptfs version, field 2 is the version of the go\-fuse
library, field 3 is the compile date and the Go version that was used.
.RS
.RE
.TP
.B \f[B]\-wpanic\f[]
When encountering a warning, panic and exit immediately.
This is useful in regression testing.
.RS
.RE
.TP
.B \f[B]\-zerokey\f[]
Use all\-zero dummy master key.
This options is only intended for automated testing as it does not
provide any security.
.RS
.RE
.SH EXAMPLES
.PP
Create an encrypted filesystem in directory "g1" and mount it on "g2":
.IP
.nf
\f[C]
mkdir\ g1\ g2
gocryptfs\ \-init\ g1
gocryptfs\ g1\ g2
\f[]
.fi
.PP
Mount an ecrypted view of joe\[aq]s home directory using reverse mode:
.IP
.nf
\f[C]
mkdir\ /home/joe.crypt
gocryptfs\ \-init\ \-reverse\ /home/joe
gocryptfs\ \-reverse\ /home/joe\ /home/joe.crypt
\f[]
.fi
.SH SEE ALSO
.PP
fuse(8) fallocate(2)
.SH AUTHORS
github.com/rfjakob.