Lines Matching +full:master +full:- +full:kernel
2 Filesystem-level encryption (fscrypt)
11 Note: "fscrypt" in this document refers to the kernel-level portion,
14 covers the kernel-level portion. For command-line examples of how to
20 <https://source.android.com/security/encryption/file-based>`_, over
21 using the kernel's API directly. Using existing tools reduces the
23 completeness this documentation covers the kernel's API anyway.)
25 Unlike dm-crypt, fscrypt operates at the filesystem level rather than
28 filesystem. This is useful for multi-user systems where each user's
29 data-at-rest needs to be cryptographically isolated from the others.
34 directly into supported filesystems --- currently ext4, F2FS, UBIFS,
44 fscrypt does not support encrypting files in-place. Instead, it
54 ---------------
58 event of a single point-in-time permanent offline compromise of the
60 non-filename metadata, e.g. file sizes, file permissions, file
70 --------------
75 Side-channel attacks
78 fscrypt is only resistant to side-channel attacks, such as timing or
81 vulnerable algorithm is used, such as a table-based implementation of
97 encryption but rather only by the correctness of the kernel.
98 Therefore, any encryption-specific access control checks would merely
99 be enforced by kernel *code* and therefore would be largely redundant
102 Read-only kernel memory compromise
105 Unless `hardware-wrapped keys`_ are used, an attacker who gains the
106 ability to read from arbitrary kernel memory, e.g. by mounting a
107 physical attack or by exploiting a kernel security vulnerability, can
108 compromise all fscrypt keys that are currently in-use. This also
112 However, if hardware-wrapped keys are used, then the fscrypt master
115 compromises of arbitrary kernel memory.
118 kernel, which may protect them from later compromise.
121 FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS ioctl) can wipe a master
122 encryption key from kernel memory. If it does so, it will also try to
124 thereby wiping their per-file keys and making them once again appear
129 - Per-file keys for in-use files will *not* be removed or wiped.
131 encrypted files and directories before removing a master key, as
135 - The kernel cannot magically wipe copies of the master key(s) that
137 copies of the master key(s) it makes as well; normally this should
144 - In general, decrypted contents and filenames in the kernel VFS
148 your kernel command line. However, this has a performance cost.
150 - Secret keys might still exist in CPU registers, in crypto
158 arbitrary kernel code can freely exfiltrate data that is protected by
159 any in-use fscrypt keys. Thus, usually fscrypt provides no meaningful
165 However, if `hardware-wrapped keys`_ are used, such attackers will be
166 unable to exfiltrate the master keys or file contents keys in a form
168 useful if the attacker is significantly time-limited and/or
169 bandwidth-limited, so they can only exfiltrate some data and need to
178 - There is no verification that the provided master key is correct.
180 with another user's encrypted files to which they have read-only
184 meaning of "read-only access".
186 - A compromise of a per-file key also compromises the master key from
189 - Non-root users cannot securely remove encryption keys.
199 hardware-wrapped keys. The use of hardware-wrapped keys modifies the
200 key hierarchy slightly. For details, see `Hardware-wrapped keys`_.
202 Master Keys
203 -----------
205 Each encrypted directory tree is protected by a *master key*. Master
208 encryption modes being used. For example, if any AES-256 mode is
209 used, the master key must be at least 256 bits, i.e. 32 bytes. A
211 policy and AES-256-XTS is used; such keys must be 64 bytes.
214 appropriate master key. There can be any number of master keys, each
218 Master keys must be real cryptographic keys, i.e. indistinguishable
220 **must not** directly use a password as a master key, zero-pad a
225 Instead, users should generate master keys either using a
227 (Key Derivation Function). The kernel does not do any key stretching;
228 therefore, if userspace derives the key from a low-entropy secret such
233 -----------------------
235 With one exception, fscrypt never uses the master key(s) for
239 The KDF used for a particular master key differs depending on whether
242 encryption policies. (No real-world attack is currently known on this
246 For v1 encryption policies, the KDF only supports deriving per-file
247 encryption keys. It works by encrypting the master key with
248 AES-128-ECB, using the file's 16-byte nonce as the AES key. The
252 For v2 encryption policies, the KDF is HKDF-SHA512. The master key is
254 "application-specific information string" is used for each distinct
255 key to be derived. For example, when a per-file encryption key is
256 derived, the application-specific information string is the file's
260 HKDF-SHA512 is preferred to the original AES-128-ECB based KDF because
262 entropy from the master key. HKDF is also standardized and widely
263 used by other software, whereas the AES-128-ECB based KDF is ad-hoc.
265 Per-file encryption keys
266 ------------------------
268 Since each master key can protect many files, it is necessary to
271 cases, fscrypt does this by deriving per-file keys. When a new
273 fscrypt randomly generates a 16-byte nonce and stores it in the
275 derivation function`_) to derive the file's key from the master key
279 require larger xattrs which would be less likely to fit in-line in the
283 alternative master keys or to support rotating master keys. Instead,
284 the master keys may be wrapped in userspace, e.g. as is done by the
288 -------------------
292 long IVs --- long enough to hold both an 8-byte data unit index and a
293 16-byte per-file nonce. Also, the overhead of each Adiantum key is
294 greater than that of an AES-256-XTS key.
299 per-file encryption keys are not used. Instead, whenever any data
300 (contents or filenames) is encrypted, the file's 16-byte nonce is
303 - For v1 encryption policies, the encryption is done directly with the
304 master key. Because of this, users **must not** use the same master
307 - For v2 encryption policies, the encryption is done with a per-mode
308 key derived using the KDF. Users may use the same master key for
312 -----------------------
315 the encryption keys are derived from the master key, encryption mode
317 protected by the same master key sharing a single contents encryption
327 -----------------------
330 IV_INO_LBLK_32, the inode number is hashed with SipHash-2-4 (where the
331 SipHash key is derived from the master key) and added to the file data
332 unit index mod 2^32 to produce a 32-bit IV.
341 ---------------
343 For master keys used for v2 encryption policies, a unique 16-byte "key
348 ------------
350 For directories that are indexed using a secret-keyed dirhash over the
351 plaintext filenames, the KDF is also used to derive a 128-bit
352 SipHash-2-4 key per directory in order to hash filenames. This works
353 just like deriving a per-file encryption key, except that a different
354 KDF context is used. Currently, only casefolded ("case-insensitive")
365 ---------------
369 - AES-256-XTS for contents and AES-256-CBC-CTS for filenames
370 - AES-256-XTS for contents and AES-256-HCTR2 for filenames
371 - Adiantum for both contents and filenames
372 - AES-128-CBC-ESSIV for contents and AES-128-CBC-CTS for filenames
373 - SM4-XTS for contents and SM4-CBC-CTS for filenames
375 Note: in the API, "CBC" means CBC-ESSIV, and "CTS" means CBC-CTS.
376 So, for example, FSCRYPT_MODE_AES_256_CTS means AES-256-CBC-CTS.
382 `CBC-ESSIV mode
383 <https://en.wikipedia.org/wiki/Disk_encryption_theory#Encrypted_salt-sector_initialization_vector_(ESSIV)>`_,
384 or a wide-block cipher. Filenames encryption uses a
385 block cipher in `CBC-CTS mode
386 <https://en.wikipedia.org/wiki/Ciphertext_stealing>`_ or a wide-block
389 The (AES-256-XTS, AES-256-CBC-CTS) pair is the recommended default.
391 if the kernel supports fscrypt at all; see `Kernel config options`_.
393 The (AES-256-XTS, AES-256-HCTR2) pair is also a good choice that
394 upgrades the filenames encryption to use a wide-block cipher. (A
395 *wide-block cipher*, also called a tweakable super-pseudorandom
397 entire result.) As described in `Filenames encryption`_, a wide-block
398 cipher is the ideal mode for the problem domain, though CBC-CTS is the
403 of hardware acceleration for AES. Adiantum is a wide-block cipher
404 that uses XChaCha12 and AES-256 as its underlying components. Most of
409 The (AES-128-CBC-ESSIV, AES-128-CBC-CTS) pair exists only to support
410 systems whose only form of AES acceleration is an off-CPU crypto
415 - (SM4-XTS, SM4-CBC-CTS)
422 Kernel config options
423 ---------------------
426 only the basic support from the crypto API needed to use AES-256-XTS
427 and AES-256-CBC-CTS encryption. For optimal performance, it is
428 strongly recommended to also enable any available platform-specific
430 wish to use. Support for any "non-default" encryption modes typically
437 kernel crypto API (see `Inline encryption support`_); in that case,
438 the file contents mode doesn't need to supported in the kernel crypto
441 - AES-256-XTS and AES-256-CBC-CTS
442 - Recommended:
443 - arm64: CONFIG_CRYPTO_AES_ARM64_CE_BLK
444 - x86: CONFIG_CRYPTO_AES_NI_INTEL
446 - AES-256-HCTR2
447 - Mandatory:
448 - CONFIG_CRYPTO_HCTR2
449 - Recommended:
450 - arm64: CONFIG_CRYPTO_AES_ARM64_CE_BLK
451 - arm64: CONFIG_CRYPTO_POLYVAL_ARM64_CE
452 - x86: CONFIG_CRYPTO_AES_NI_INTEL
453 - x86: CONFIG_CRYPTO_POLYVAL_CLMUL_NI
455 - Adiantum
456 - Mandatory:
457 - CONFIG_CRYPTO_ADIANTUM
458 - Recommended:
459 - arm32: CONFIG_CRYPTO_NHPOLY1305_NEON
460 - arm64: CONFIG_CRYPTO_NHPOLY1305_NEON
461 - x86: CONFIG_CRYPTO_NHPOLY1305_SSE2
462 - x86: CONFIG_CRYPTO_NHPOLY1305_AVX2
464 - AES-128-CBC-ESSIV and AES-128-CBC-CTS:
465 - Mandatory:
466 - CONFIG_CRYPTO_ESSIV
467 - CONFIG_CRYPTO_SHA256 or another SHA-256 implementation
468 - Recommended:
469 - AES-CBC acceleration
471 fscrypt also uses HMAC-SHA512 for key derivation, so enabling SHA-512
474 - SHA-512
475 - Recommended:
476 - arm64: CONFIG_CRYPTO_SHA512_ARM64_CE
477 - x86: CONFIG_CRYPTO_SHA512_SSSE3
480 -------------------
484 data unit incorporates the zero-based index of the data unit within
494 * Fixed-size data units. This is how all filesystems other than UBIFS
496 is zero-padded if needed. By default, the data unit size is equal
498 a sub-block data unit size via the ``log2_data_unit_size`` field of
501 * Variable-size data units. This is what UBIFS does. Each "UBIFS
503 length, possibly compressed data, zero-padded to the next 16-byte
504 boundary. Users cannot select a sub-block data unit size on UBIFS.
510 Therefore a f2fs-compressed file still uses fixed-size data units, and
514 per-file keys. In this case, the IV for each data unit is simply the
516 encryption setting that does not use per-file keys. For these, some
519 - With `DIRECT_KEY policies`_, the data unit index is placed in bits
520 0-63 of the IV, and the file's nonce is placed in bits 64-191.
522 - With `IV_INO_LBLK_64 policies`_, the data unit index is placed in
523 bits 0-31 of the IV, and the file's inode number is placed in bits
524 32-63. This setting is only allowed when data unit indices and
527 - With `IV_INO_LBLK_32 policies`_, the file's inode number is hashed
529 to 32 bits and placed in bits 0-31 of the IV. This setting is only
536 passed to AES-128-CBC, it is encrypted with AES-256 where the AES-256
537 key is the SHA-256 hash of the file's contents encryption key.
540 --------------------
552 With CBC-CTS, the IV reuse means that when the plaintext filenames share a
556 wide-block encryption modes.
560 filenames shorter than 16 bytes are NUL-padded to 16 bytes before
562 via their ciphertexts, all filenames are NUL-padded to the next 4, 8,
563 16, or 32-byte boundary (configurable). 32 is recommended since this
577 ----------------------------
613 - ``version`` must be FSCRYPT_POLICY_V1 (0) if
619 - ``contents_encryption_mode`` and ``filenames_encryption_mode`` must
632 - ``flags`` contains optional flags from ``<linux/fscrypt.h>``:
634 - FSCRYPT_POLICY_FLAGS_PAD_*: The amount of NUL padding to use when
637 - FSCRYPT_POLICY_FLAG_DIRECT_KEY: See `DIRECT_KEY policies`_.
638 - FSCRYPT_POLICY_FLAG_IV_INO_LBLK_64: See `IV_INO_LBLK_64
640 - FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32: See `IV_INO_LBLK_32
649 - ``log2_data_unit_size`` is the log2 of the data unit size in bytes,
653 underlying encryption algorithm (such as AES-256-XTS) in 4096-byte
672 - For v2 encryption policies, ``__reserved`` must be zeroed.
674 - For v1 encryption policies, ``master_key_descriptor`` specifies how
675 to find the master key in a keyring; see `Adding keys`_. It is up
677 master key. The e4crypt and fscrypt tools use the first 8 bytes of
678 ``SHA-512(SHA-512(master_key))``, but this particular scheme is not
679 required. Also, the master key need not be in the keyring yet when
687 the kernel returned in the struct fscrypt_add_key_arg must
695 corresponding master key as described in `Adding keys`_, all regular
717 filesystem with one key should consider using dm-crypt instead.
721 - ``EACCES``: the file is not owned by the process's uid, nor does the
724 - ``EEXIST``: the file is already encrypted with an encryption policy
726 - ``EINVAL``: an invalid encryption policy was specified (invalid
730 - ``ENOKEY``: a v2 encryption policy was specified, but the key with
734 - ``ENOTDIR``: the file is unencrypted and is a regular file, not a
736 - ``ENOTEMPTY``: the file is unencrypted and is a nonempty directory
737 - ``ENOTTY``: this type of filesystem does not implement encryption
738 - ``EOPNOTSUPP``: the kernel was not configured with encryption
742 kernel config, and the superblock must have had the "encrypt"
743 feature flag enabled using ``tune2fs -O encrypt`` or ``mkfs.ext4 -O
745 - ``EPERM``: this directory may not be encrypted, e.g. because it is
747 - ``EROFS``: the filesystem is readonly
750 ----------------------------
754 - `FS_IOC_GET_ENCRYPTION_POLICY_EX`_
755 - `FS_IOC_GET_ENCRYPTION_POLICY`_
791 - ``EINVAL``: the file is encrypted, but it uses an unrecognized
793 - ``ENODATA``: the file is not encrypted
794 - ``ENOTTY``: this type of filesystem does not implement encryption,
795 or this kernel is too old to support FS_IOC_GET_ENCRYPTION_POLICY_EX
797 - ``EOPNOTSUPP``: the kernel was not configured with encryption
800 - ``EOVERFLOW``: the file is encrypted and uses a recognized
824 Getting the per-filesystem salt
825 -------------------------------
829 generated 16-byte value stored in the filesystem superblock. This
831 from a passphrase or other low-entropy user credential.
837 ---------------------------------
840 On encrypted files and directories it gets the inode's 16-byte nonce.
848 -----------
853 The FS_IOC_ADD_ENCRYPTION_KEY ioctl adds a master encryption key to
892 - If the key is being added for use by v1 encryption policies, then
903 an *output* field which the kernel fills in with a cryptographic
909 - ``raw_size`` must be the size of the ``raw`` key provided, in bytes.
913 - ``key_id`` is 0 if the key is given directly in the ``raw`` field.
915 "fscrypt-provisioning" whose payload is struct
919 variable-length, the total size of this key's payload must be
925 allow re-adding keys after a filesystem is unmounted and re-mounted,
928 - ``flags`` contains optional flags from ``<linux/fscrypt.h>``:
930 - FSCRYPT_ADD_KEY_FLAG_HW_WRAPPED: This denotes that the key is a
931 hardware-wrapped key. See `Hardware-wrapped keys`_. This flag
934 - ``raw`` is a variable-length field which must contain the actual
940 For v2 policy keys, the kernel keeps track of which user (identified
942 removed by that user --- or by "root", if they use
958 - ``EACCES``: FSCRYPT_KEY_SPEC_TYPE_DESCRIPTOR was specified, but the
962 - ``EBADMSG``: invalid hardware-wrapped key
963 - ``EDQUOT``: the key quota for this user would be exceeded by adding
965 - ``EINVAL``: invalid key size or key specifier type, or reserved bits
967 - ``EKEYREJECTED``: the key was specified by Linux key ID, but the key
969 - ``ENOKEY``: the key was specified by Linux key ID, but no key exists
971 - ``ENOTTY``: this type of filesystem does not implement encryption
972 - ``EOPNOTSUPP``: the kernel was not configured with encryption
976 does not support hardware-wrapped keys
981 For v1 encryption policies, a master encryption key can also be
982 provided by adding it to a process-subscribed keyring, e.g. to a
998 Nevertheless, to add a key to one of the process-subscribed keyrings,
1001 "logon"; keys of this type are kept in kernel memory and cannot be
1003 followed by the 16-character lower case hex representation of the
1017 bytes ``raw[0..size-1]`` (inclusive) are the actual key.
1020 with a filesystem-specific prefix such as "ext4:". However, the
1021 filesystem-specific prefixes are deprecated and should not be used in
1025 -------------
1030 - `FS_IOC_REMOVE_ENCRYPTION_KEY`_
1031 - `FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS`_
1034 or removed by non-root users.
1037 process-subscribed keyrings mechanism.
1045 The FS_IOC_REMOVE_ENCRYPTION_KEY ioctl removes a claim to a master
1062 - The key to remove is specified by ``key_spec``:
1064 - To remove a key used by v1 encryption policies, set
1070 - To remove a key used by v2 encryption policies, set
1074 For v2 policy keys, this ioctl is usable by non-root users. However,
1089 lock files that are still in-use, so this ioctl is expected to be used
1101 - ``FSCRYPT_KEY_REMOVAL_STATUS_FLAG_FILES_BUSY``: set if some file(s)
1102 are still in-use. Not guaranteed to be set in the case where only
1104 - ``FSCRYPT_KEY_REMOVAL_STATUS_FLAG_OTHER_USERS``: set if only the
1109 - ``EACCES``: The FSCRYPT_KEY_SPEC_TYPE_DESCRIPTOR key specifier type
1112 - ``EINVAL``: invalid key specifier type, or reserved bits were set
1113 - ``ENOKEY``: the key object was not found at all, i.e. it was never
1117 - ``ENOTTY``: this type of filesystem does not implement encryption
1118 - ``EOPNOTSUPP``: the kernel was not configured with encryption
1130 only meaningful if non-root users are adding and removing keys.
1137 ------------------
1143 master encryption key. It can be executed on any file or directory on
1166 - To get the status of a key for v1 encryption policies, set
1170 - To get the status of a key for v2 encryption policies, set
1174 On success, 0 is returned and the kernel fills in the output fields:
1176 - ``status`` indicates whether the key is absent, present, or
1182 - ``status_flags`` can contain the following flags:
1184 - ``FSCRYPT_KEY_STATUS_FLAG_ADDED_BY_SELF`` indicates that the key
1188 - ``user_count`` specifies the number of users who have added the key.
1194 - ``EINVAL``: invalid key specifier type, or reserved bits were set
1195 - ``ENOTTY``: this type of filesystem does not implement encryption
1196 - ``EOPNOTSUPP``: the kernel was not configured with encryption
1206 the filesystem-level keyring, i.e. the keyring managed by
1210 process-subscribed keyrings.
1216 ------------
1219 symlinks behave very similarly to their unencrypted counterparts ---
1223 - Unencrypted files, or files encrypted with a different encryption
1238 - Direct I/O is supported on encrypted files only under some
1241 - The fallocate operations FALLOC_FL_COLLAPSE_RANGE and
1245 - Online defragmentation of encrypted files is not supported. The
1249 - The ext4 filesystem does not support data journaling with encrypted
1252 - DAX (Direct Access) is not supported on encrypted files.
1254 - The maximum length of an encrypted symlink is 2 bytes shorter than
1264 ---------------
1270 - File metadata may be read, e.g. using stat().
1272 - Directories may be listed, in which case the filenames will be
1283 - Files may be deleted. That is, nondirectory files may be deleted
1285 rmdir() as usual. Therefore, ``rm`` and ``rm -r`` will work as
1288 - Symlink targets may be read and followed, but they will be presented
1312 (recursively) will inherit that encryption policy. Special files ---
1313 that is, named pipes, device nodes, and UNIX domain sockets --- will
1320 during ->lookup() to provide limited protection against offline
1324 this by validating all top-level encryption policies prior to access.
1329 By default, fscrypt uses the kernel crypto API for all cryptographic
1331 itself). The kernel crypto API supports hardware crypto accelerators,
1341 through a set of extensions to the block layer called *blk-crypto*.
1342 blk-crypto allows filesystems to attach encryption contexts to bios
1344 in-line. For more information about blk-crypto, see
1345 :ref:`Documentation/block/inline-encryption.rst <inline_encryption>`.
1348 blk-crypto instead of the kernel crypto API to encrypt/decrypt file
1350 the kernel configuration, and specify the "inlinecrypt" mount option
1355 still fall back to using the kernel crypto API on files where the
1358 and where blk-crypto-fallback is unusable. (For blk-crypto-fallback
1359 to be usable, it must be enabled in the kernel configuration with
1361 protected by a raw key rather than a hardware-wrapped key.)
1368 the on-disk format, so users may freely switch back and forth between
1370 files that are protected by a hardware-wrapped key can only be
1373 more information about hardware-wrapped keys, see below.
1375 Hardware-wrapped keys
1376 ---------------------
1378 fscrypt supports using *hardware-wrapped keys* when the inline
1379 encryption hardware supports it. Such keys are only present in kernel
1383 kernel memory is leaked. This is done without limiting the number of
1388 Note that hardware-wrapped keys aren't specific to fscrypt; they are a
1389 block layer feature (part of *blk-crypto*). For more details about
1390 hardware-wrapped keys, see the block layer documentation at
1391 :ref:`Documentation/block/inline-encryption.rst
1393 the details of how fscrypt can use hardware-wrapped keys.
1395 fscrypt supports hardware-wrapped keys by allowing the fscrypt master
1396 keys to be hardware-wrapped keys as an alternative to raw keys. To
1397 add a hardware-wrapped key with `FS_IOC_ADD_ENCRYPTION_KEY`_,
1401 applicable. The key must be in ephemerally-wrapped form, not
1402 long-term wrapped form.
1404 Some limitations apply. First, files protected by a hardware-wrapped
1408 currently the hardware-wrapped key support is only compatible with
1411 fscrypt master key rather than one per file. Future work may address
1412 this limitation by passing per-file nonces down the storage stack to
1413 allow the hardware to derive per-file keys.
1415 Implementation-wise, to encrypt/decrypt the contents of files that are
1416 protected by a hardware-wrapped key, fscrypt uses blk-crypto,
1417 attaching the hardware-wrapped key to the bio crypt contexts. As is
1420 hardware-wrapped key, the hardware doesn't program the given key
1427 uses its master keys to derive filenames encryption keys, key
1431 key from a hardware-wrapped key, fscrypt asks the inline encryption
1433 the hardware-wrapped key. fscrypt uses this "software secret" to key
1436 Note that this implies that the hardware-wrapped key feature only
1448 the filesystem must be mounted with ``-o inlinecrypt`` and inline
1465 ------------------
1467 An encryption policy is represented on-disk by
1471 exposed by the xattr-related system calls such as getxattr() and
1504 by the kernel and is used as KDF input or as a tweak to cause
1505 different files to be encrypted differently; see `Per-file encryption
1509 -----------------
1518 For the read path (->read_folio()) of regular files, filesystems can
1519 read the ciphertext into the page cache and decrypt it in-place. The
1523 For the write path (->writepages()) of regular files, filesystems
1524 cannot encrypt data in-place in the page cache, since the cached
1532 -----------------------------
1536 filename hashes. When a ->lookup() is requested, the filesystem
1546 i.e. the bytes actually stored on-disk in the directory entries. When
1547 asked to do a ->lookup() with the key, the filesystem just encrypts
1548 the user-supplied name to get the ciphertext.
1552 filenames. Therefore, readdir() must base64url-encode the ciphertext
1553 for presentation. For most filenames, this works fine; on ->lookup(),
1554 the filesystem just base64url-decodes the user-supplied name to get
1561 filesystem-specific hash(es) needed for directory lookups. This
1563 the filename given in ->lookup() back to a particular directory entry
1570 ``rm -r`` work as expected on encrypted directories.
1580 f2fs encryption using `kvm-xfstests
1581 <https://github.com/tytso/xfstests-bld/blob/master/Documentation/kvm-quickstart.md>`_::
1583 kvm-xfstests -c ext4,f2fs -g encrypt
1584 kvm-xfstests -c ext4,f2fs -g encrypt -m inlinecrypt
1587 a separate command, and it takes some time for kvm-xfstests to set up
1590 kvm-xfstests -c ubifs -g encrypt
1592 No tests should fail. However, tests that use non-default encryption
1594 algorithms were not built into the kernel's crypto API. Also, tests
1603 kvm-xfstests, use the "encrypt" filesystem configuration::
1605 kvm-xfstests -c ext4/encrypt,f2fs/encrypt -g auto
1606 kvm-xfstests -c ext4/encrypt,f2fs/encrypt -g auto -m inlinecrypt
1608 Because this runs many more tests than "-g encrypt" does, it takes
1609 much longer to run; so also consider using `gce-xfstests
1610 <https://github.com/tytso/xfstests-bld/blob/master/Documentation/gce-xfstests.md>`_
1611 instead of kvm-xfstests::
1613 gce-xfstests -c ext4/encrypt,f2fs/encrypt -g auto
1614 gce-xfstests -c ext4/encrypt,f2fs/encrypt -g auto -m inlinecrypt