summaryrefslogtreecommitdiff
path: root/internal/nametransform/perms.go
diff options
context:
space:
mode:
authorJakob Unterwurzacher2021-01-10 08:06:09 +0100
committerJakob Unterwurzacher2021-01-10 08:07:10 +0100
commitbed60101f4925eb2cce736301f5cc45ad267c187 (patch)
treef843eaf600da809918f581996ed1001201d4cefe /internal/nametransform/perms.go
parent6b492fdcb8f2a95c6a5dd57b445b3551b541f4ae (diff)
nametransform: make `gocryptfs.diriv` and `gocryptfs.xxx.name` files world-readable
Make `gocryptfs.diriv` and `gocryptfs.xxx.name` files world-readable to make encrypted backups easier when mounting via fstab. Having the files follow chmod/chown of their parent does not seem to be worth the hassle. The content of the diriv files is not secret, and both diriv and name files are protected by the perms of the parent dir. Fixes https://github.com/rfjakob/gocryptfs/issues/539
Diffstat (limited to 'internal/nametransform/perms.go')
-rw-r--r--internal/nametransform/perms.go24
1 files changed, 17 insertions, 7 deletions
diff --git a/internal/nametransform/perms.go b/internal/nametransform/perms.go
index 98b51d6..cfcd062 100644
--- a/internal/nametransform/perms.go
+++ b/internal/nametransform/perms.go
@@ -1,16 +1,26 @@
package nametransform
const (
- // Permissions for gocryptfs.diriv files
+ // Permissions for gocryptfs.diriv files.
+ // The gocryptfs.diriv files are created once, never modified,
+ // never chmod'ed or chown'ed.
//
- // It makes sense to have the diriv files group-readable so the FS can
- // be mounted from several users from a network drive (see
- // https://github.com/rfjakob/gocryptfs/issues/387 ).
+ // Group-readable so the FS can be mounted by several users in the same group
+ // (see https://github.com/rfjakob/gocryptfs/issues/387 ).
//
// Note that gocryptfs.conf is still created with 0400 permissions so the
// owner must explicitly chmod it to permit access.
- dirivPerms = 0440
+ //
+ // World-readable so an encrypted directory can be copied by the non-root
+ // owner when gocryptfs is running as root
+ // ( https://github.com/rfjakob/gocryptfs/issues/539 ).
+ dirivPerms = 0444
- // Permissions for gocryptfs.longname.[sha256].name files
- namePerms = 0400
+ // Permissions for gocryptfs.longname.[sha256].name files.
+ // The .name files are created once, never modified,
+ // never chmod'ed or chown'ed.
+ //
+ // Group- and world-readable for the same reasons as the gocryptfs.diriv
+ // files (see above).
+ namePerms = 0444
)