Re: snapshots of encrypted directories?

["Austin S. Hemmelgarn" <ahferroin7@gmail.com>]

On 2017-09-15 12:28, Ulli Horlacher wrote:
> On Fri 2017-09-15 (12:15), Peter Becker wrote:
>> 2017-09-15 12:01 GMT+02:00 Ulli Horlacher <framstag@rus.uni-stuttgart.de>:
>>
>>> On Fri 2017-09-15 (06:45), Andrei Borzenkov wrote:
>>>
>>>> The actual question is - do you need to mount each individual btrfs
>>>> subvolume when using encfs?
>>>
>>> And even worse it goes with ecryptfs: I do not know at all how to mount a
>>> snapshot, so that the user has access to it.
>>
>> A snapshot is simply a subvolume.
>>
>> Get the ID of the snapshot and mount it:
>>
>> btrfs subvolume list /btrfs
>> mount -o subvolid=<ID> /dev/<DISK> /<MOUNTPOINT_ENCRYPTED>
>>
>> Or mount the snapshot directly by path:
>>
>> mount -o subvol=/snapshots/home/2015-12-01 /<MOUNTPOINT_ENCRYPTED>
>>
>> And then mount enryptfs:
>>
>> mount.ecryptfs /<MOUNTPOINT_ENCRYPTED> /<MOUNTPOINT_DECRYPTED>
> 
> This only possible by root.
> For a user it is not possible to have access for his own snapshots.
> Bad.
> 
Which is why you use EncFS (which is a FUSE module that runs in 
userspace and requires no root privileges) instead of eCryptFS (which is 
a kernel assisted filesystem that doesn't use FUSE, has more complicated 
setup constraints, and requires CAP_SYS_ADMIN or root access).