{
  "slug": "fscrypt",
  "term": "fscrypt",
  "aliases": [
    "Linux filesystem encryption"
  ],
  "definition": "fscrypt is Linux's filesystem-integrated encryption facility for file contents and names under directory-tree policies.",
  "note": "Linux v6.12 leaves sizes, timestamps, permissions, extended attributes and hole locations exposed. It does not guarantee protection against offline tampering. After unlocking, ordinary access controls still apply. [fscrypt-source]\n\nThis is the kernel facility, not the similarly named userspace tool. It differs from block-level dm-crypt and from fs-verity's integrity checks. [fscrypt-source] [fsverity-source]\n\nFor v2 policies, removal first drops the caller's claim. ENOKEY can mean the caller has no claim while another user retains one. With OTHER_USERS set, a clear FILES_BUSY bit does not prove all files are closed. Key-status queries cover the filesystem keyring, not every key copy. [fscrypt-source]",
  "status": "shipping",
  "advantages": [],
  "limitations": [
    {
      "text": "Removing a master key does not necessarily remove in-use per-file keys or erase cached plaintext.",
      "citationIds": [
        "fscrypt-source"
      ]
    }
  ],
  "related": [
    "inline-encryption",
    "dm-crypt",
    "fs-verity",
    "ext4-data-journal",
    "authenticated-encryption",
    "cryptographic-erase",
    "fscrypt-policy",
    "fscrypt-key-identifier"
  ],
  "supersedes": [],
  "supersededBy": [],
  "firstSeen": null,
  "lastSeen": null,
  "citations": [
    {
      "id": "fscrypt-source",
      "title": "Linux v6.12: fscrypt, threat model, removing keys and getting key status",
      "url": "https://docs.kernel.org/6.12/filesystems/fscrypt.html",
      "accessed": "2026-10-22"
    },
    {
      "id": "fsverity-source",
      "title": "Linux v6.12: fs-verity, integrity and authentication policy",
      "url": "https://docs.kernel.org/6.12/filesystems/fsverity.html",
      "accessed": "2026-10-22"
    },
    {
      "id": "hesela-fscrypt",
      "title": "Hesela: filesystem encryption and the execution backend",
      "url": "https://hesela.com/analyses/checksums-identity-and-lost-writes/#filesystem-encryption",
      "accessed": "2026-10-22"
    }
  ],
  "updated": "2026-10-22"
}