From 3ac282047ff36affb86f260b54ff50653007fdee Mon Sep 17 00:00:00 2001
From: maximilize
Date: Fri, 26 Jun 2026 00:23:30 +0200
Subject: reverse: hide custom -config file located inside CIPHERDIR

In reverse mode, a custom config file passed via -config that lives inside
CIPHERDIR was presented as an ordinary encrypted file in the encrypted view,
which is useless and confusing. By default the config is mapped to a virtual
gocryptfs.conf, but ConfigCustom skips that mapping, so an in-CIPHERDIR custom
config was neither mapped nor hidden.

Plumb the config path into the reverse RootNode and treat a custom config file
located inside CIPHERDIR as excluded in isExcludedPlain, hiding it from both
readdir and lookup. Also document the -config reverse-mode behaviour in
MANPAGE.md and add a regression test.

Fixes #1009
---
 internal/fusefrontend/args.go | 4 ++++
 1 file changed, 4 insertions(+)

(limited to 'internal/fusefrontend/args.go')

diff --git a/internal/fusefrontend/args.go b/internal/fusefrontend/args.go
index ec3d1c2..84e34af 100644
--- a/internal/fusefrontend/args.go
+++ b/internal/fusefrontend/args.go
@@ -24,6 +24,10 @@ type Args struct {
 	// location. If it is false, reverse mode maps ".gocryptfs.reverse.conf"
 	// to "gocryptfs.conf" in the plaintext dir.
 	ConfigCustom bool
+	// Config is the path to the config file. In reverse mode, a custom config
+	// file (-config) located inside Cipherdir is hidden from the encrypted view
+	// (https://github.com/rfjakob/gocryptfs/issues/1009).
+	Config string
 	// NoPrealloc disables automatic preallocation before writing
 	NoPrealloc bool
 	// Exclude is a list of paths to make inaccessible, starting match at
-- 
cgit v1.2.3