Can I create a new ext4 encrypted partition with kernel 4.1 on Ubuntu 15.04?


First off a disclaimer: I've not done this with Ubuntu, but on a machine with Debian "Stretch" installed using a custom Linux 4.2.3 kernel that I enabled EXT4_FS_ENCRYPTION on.

The instructions given by kmeaw don't work for me exactly as posted. A few things were left out (command line parameters and steps).

  • Update e2fsprogs as shown above
  • Generate your random salt. I used the following to store it in a "safe place":

    head -c 16 /dev/urandom | xxd -p >~/tmp-salt.txt
    echo 0x`cat ~/tmp-salt.txt` >~/.cryptoSalt
  • In order to use ext4 encryption on the file system, the "encrypt" flag must be set in the super-block. This is not the default when the ext4 file system is created. Using the "tune2fs" utility from e2fsprogs 1.43 or later, set the "encrypt" option:

    sudo tune2fs -O encrypt /dev/sda4
  • Mount or remount the file system so the kernel knows about the change (maybe it's automatic, but I have only done this on a separate partition, so I'm not sure.)

  • Create a directory on the file system that is mounted with encryption enabled:

    sudo mkdir -p /secret/home/$USER
    sudo chown $USER:$USER /secret/home/$USER
  • Create the key in the keyring and use it to set the policy for the directory to be encrypted (the sudo command is not needed here):

    $ /usr/sbin/e4crypt add_key -S s:`cat ~/.cryptoSalt`
    Enter passphrase (echo disabled):
    Added key with descriptor [0132fed69f946c86]
    $ /usr/bin/e4crypt set_policy 0132fed69f946c86 /secret/home/$USER
    Key with descriptor [0132fed69f946c86] applies to /secret/home/theuser.
  • After each reboot, the add_key command can be used set the key for decryption of the directory and its descendants:

    $ /usr/sbin/e4crypt add_key -S s:`cat ~/.cryptoSalt`
    Enter passphrase (echo disabled):
    Added key with descriptor [0132fed69f946c86]

    Enter the same password used in the previous step, and you don't have to remember the descriptor hex string.

  • You can also use add_key directly. This will use a filesystem specific salt (So all folders under that partition will have the same salt)

    $ /usr/sbin/e4crypt add_key /secret/home/$USER
    Added key with descriptor [0132fed69f946c86]
    Key with descriptor [0132fed69f946c86] applies to /secret/home/theuser.
  • The article in the Arch wiki suggests to read the following blog post, whose author wrote a program to simplify some of the steps: blog.quarkslab.com/… At the time of writing 16.04 is still in development and has the two corresponding kernel configuration options set, e2fsprogs though is still at version 1.42. – LiveWireBT Feb 28 '16 at 13:29

Linux 4.1 comes with a new Ext4 feature to encrypt directories of a filesystem. Encryption keys are stored in the keyring. To get started, make sure you have enabled CONFIG_KEYS and CONFIG_EXT4_FS_ENCRYPTION kernel options and you have kernel 4.1 or higher.

First of all, you need to update e2fsprogs to at least version 1.43, which is still WIP at the time of writing so we need to fetch it from the git repository:

$ git clone git://git.kernel.org/pub/scm/fs/ext2/e2fsprogs.git

e4crypt source has disabled a relevant section in its source code, enable it by editing misc/e4crypt.c and removing these two lines near line 714:

    printf("arg %s\n", argv[optind]);

Now build and install new e2fsprogs:

$ sudo apt-get install devscripts build-essential gettext texinfo pkg-config debhelper m4
$ debuild
$ sudo dpkg -i e2fsprogs_1.43-WIP_amd64.deb

Check your version now, it should be 1.43-WIP:

# e2fsck -V
e2fsck 1.43-WIP (18-May-2015)
        Using EXT2FS Library version 1.43-WIP, 18-May-2015

To work with keys, we need to install the keyutils package:

$ sudo apt-get install keyutils

Let's make a directory that we will encrypt. Encryption policy can be set only on empty directories:

$ sudo mkdir -p /encrypted/dir

First generate a random salt value and store it in a safe place:

$ head -c 16 /dev/random | xxd -p

Now generate and add a new key into your keyring: this step should be repeated every time you flush your keychain (reboot)

$ sudo e4crypt -S 0x877282f53bd0adbbef92142fc4cac459
Enter passphrase (echo disabled): 
Added key with descriptor [f88747555a6115f5]

Now you know a descriptor for your key. Make sure you have added a key into your keychain:

$ keyctl show
Session Keyring
1021618178 --alswrv   1000  1000  keyring: _ses
 176349519 --alsw-v   1000  1000   \_ logon: ext4:f88747555a6115f5

Almost done. Now set an encryption policy for a directory:

$ e4crypt set_policy f88747555a6115f5 /encrypted/dir

That's all. If you try accessing the disk without adding a key into keychain, filenames and their contents will be seen as encrypted gibberish. Be careful running old versions of e2fsck on your filesystem - it will treat encrypted filenames as invalid.

  • This answer had severe formatting issues. I tried to improve as far as I could, but it doesn't make sense to me why one would obviously attempt to use markdown formatting, handle complex commands and also do a similar edit in the Arch wiki at the same time, but then look at the garbage rendered in the preview and decide to leave it as it is. There is no satisfying explanation or further reference why the lines have to be removed. Further it's suggested to use debuild in a way it's not intended (with a non-debianized package, there is an experimental package in Debian) and doesn't work. -1 – LiveWireBT Feb 28 '16 at 13:19

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.