hardcoresushi
/
libgocryptfs
1
0
Fork 0
Code Issues Pull Requests Releases Activity

MANPAGE: prettify plain-text formatting

This commit is contained in:
Jakob Unterwurzacher 2016-10-21 00:04:41 +02:00
parent ceec46c1c1
commit 86afaee200
1 changed files with 52 additions and 50 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

102
Documentation/MANPAGE.md
View File

@ -1,6 +1,6 @@
% GOCRYPTFS(1) % GOCRYPTFS(1)
% github.com/rfjakob % github.com/rfjakob
% May 2016 % Oct 2016
NAME NAME
==== ====
@ -32,14 +32,14 @@ Options:
**-aessiv** **-aessiv**
: Use the AES-SIV encryption mode. This is slower than GCM but is : Use the AES-SIV encryption mode. This is slower than GCM but is
secure with deterministic nonces as used in "-reverse" mode. secure with deterministic nonces as used in "-reverse" mode.
**-allow_other** **-allow_other**
: By default, the Linux kernel prevents any other user (even root) to : By default, the Linux kernel prevents any other user (even root) to
access a mounted FUSE filesystem. Settings this option allows access for access a mounted FUSE filesystem. Settings this option allows access for
other users, subject to file permission checking. Only works if other users, subject to file permission checking. Only works if
user_allow_other is set in /etc/fuse.conf. This option is equivalent to user_allow_other is set in /etc/fuse.conf. This option is equivalent to
"allow_other" plus "default_permissions" described in fuse(8). "allow_other" plus "default_permissions" described in fuse(8).
**-config string** **-config string**
: Use specified config file instead of CIPHERDIR/gocryptfs.conf : Use specified config file instead of CIPHERDIR/gocryptfs.conf
@ -52,9 +52,9 @@ user_allow_other is set in /etc/fuse.conf. This option is equivalent to
**-extpass string** **-extpass string**
: Use an external program (like ssh-askpass) for the password prompt. : Use an external program (like ssh-askpass) for the password prompt.
The program should return the password on stdout, a trailing newline is The program should return the password on stdout, a trailing newline is
stripped by gocryptfs. Using something like "cat /mypassword.txt" allows stripped by gocryptfs. Using something like "cat /mypassword.txt" allows
to mount the gocryptfs filesytem without user interaction. to mount the gocryptfs filesytem without user interaction.
**-f** **-f**
: Stay in the foreground instead of forking away. Implies "-nosyslog". : Stay in the foreground instead of forking away. Implies "-nosyslog".
@ -66,67 +66,68 @@ to mount the gocryptfs filesytem without user interaction.
: Initialize encrypted directory : Initialize encrypted directory
**-ko** **-ko**
: Pass additonal mount options to the kernel (comma-separated list). : Pass additonal mount options to the kernel (comma-separated list).
FUSE filesystems are mounted with "nodev,nosuid" by default. If gocryptfs FUSE filesystems are mounted with "nodev,nosuid" by default. If gocryptfs
runs as root, you can enable device files by passing the opposite mount option, runs as root, you can enable device files by passing the opposite mount option,
"dev", and if you want to enable suid-binaries, pass "suid". "dev", and if you want to enable suid-binaries, pass "suid".
"ro" (equivalent to passing the "-ro" option) and "noexec" may also be "ro" (equivalent to passing the "-ro" option) and "noexec" may also be
interesting. For a complete list see the section interesting. For a complete list see the section
`FILESYSTEM-INDEPENDENT MOUNT OPTIONS` in mount(8). `FILESYSTEM-INDEPENDENT MOUNT OPTIONS` in mount(8).
**-longnames** **-longnames**
: Store names longer than 176 bytes in extra files (default true) : Store names longer than 176 bytes in extra files (default true)
This flag is useful when recovering old gocryptfs filesystems using This flag is useful when recovering old gocryptfs filesystems using
"-masterkey". It is ignored (stays at the default) otherwise. "-masterkey". It is ignored (stays at the default) otherwise.
**-masterkey string** **-masterkey string**
: Use a explicit master key specified on the command line. This : Use a explicit master key specified on the command line. This
option can be used to mount a gocryptfs filesystem without a config file. option can be used to mount a gocryptfs filesystem without a config file.
Note that the command line, and with it the master key, is visible to Note that the command line, and with it the master key, is visible to
anybody on the machine who can execute "ps -auxwww". anybody on the machine who can execute "ps -auxwww".
This is meant as a recovery option for emergencies, such as if you have This is meant as a recovery option for emergencies, such as if you have
forgotten your password. forgotten your password.
Example master key: 6f717d8b-6b5f8e8a-fd0aa206-778ec093-62c5669b-abd229cd-241e00cd-b4d6713d Example master key:
6f717d8b-6b5f8e8a-fd0aa206-778ec093-62c5669b-abd229cd-241e00cd-b4d6713d
**-memprofile string** **-memprofile string**
: Write memory profile to specified file. This is useful when debugging : Write memory profile to the specified file. This is useful when debugging
memory usage of gocryptfs. memory usage of gocryptfs.
**-nonempty** **-nonempty**
: Allow mounting over non-empty directories. FUSE by default disallows : Allow mounting over non-empty directories. FUSE by default disallows
this to prevent accidential shadowing of files. this to prevent accidential shadowing of files.
**-nosyslog** **-nosyslog**
: Diagnostic messages are normally redirected to syslog once gocryptfs : Diagnostic messages are normally redirected to syslog once gocryptfs
daemonizes. This option disables the redirection and messages will daemonizes. This option disables the redirection and messages will
continue be printed to stdout and stderr. continue be printed to stdout and stderr.
**-notifypid int** **-notifypid int**
: Send USR1 to the specified process after successful mount. This is : Send USR1 to the specified process after successful mount. This is
used internally for daemonization. used internally for daemonization.
**-openssl bool/"auto"** **-openssl bool/"auto"**
: Use OpenSSL instead of built-in Go crypto (default "auto"). Using : Use OpenSSL instead of built-in Go crypto (default "auto"). Using
built-in crypto is 4x slower unless your CPU has AES instructions and built-in crypto is 4x slower unless your CPU has AES instructions and
you are using Go 1.6+. In mode "auto", gocrypts chooses the faster you are using Go 1.6+. In mode "auto", gocrypts chooses the faster
option. option.
**-passfile string** **-passfile string**
: Read password from the specified file. This is a shortcut for : Read password from the specified file. This is a shortcut for
specifying "-extpass /bin/cat FILE". specifying "-extpass /bin/cat FILE".
**-passwd** **-passwd**
: Change the password. Will ask for the old password, check if it is : Change the password. Will ask for the old password, check if it is
correct, and ask for a new one. correct, and ask for a new one.
This can be used together with `-masterkey` if This can be used together with `-masterkey` if
you forgot the password but know the master key. Note that without the you forgot the password but know the master key. Note that without the
old password, gocryptfs cannot tell if the master key is correct and will old password, gocryptfs cannot tell if the master key is correct and will
overwrite the old one without mercy. It will, however, create a backup copy overwrite the old one without mercy. It will, however, create a backup copy
of the old config file as `gocryptfs.conf.bak`. Delete it after of the old config file as `gocryptfs.conf.bak`. Delete it after
you have verified that you can access your files with the you have verified that you can access your files with the
new password. new password.
**-plaintextnames** **-plaintextnames**
: Do not encrypt file names and symlink targets : Do not encrypt file names and symlink targets
@ -136,33 +137,34 @@ new password.
**-reverse** **-reverse**
: Reverse mode shows a read-only encrypted view of a plaintext : Reverse mode shows a read-only encrypted view of a plaintext
directory. Implies "-aessiv". directory. Implies "-aessiv".
**-ro** **-ro**
: Mount the filesystem read-only : Mount the filesystem read-only
**-scryptn int** **-scryptn int**
: scrypt cost parameter logN. Setting this to a lower value speeds up : scrypt cost parameter logN. Setting this to a lower value speeds up
mounting but makes the password susceptible to brute-force attacks (default 16) mounting but makes the password susceptible to brute-force attacks
(default 16)
**-version** **-version**
: Print version and exit. The output contains three fields seperated by : Print version and exit. The output contains three fields seperated by ";".
";". Example: "gocryptfs v0.12-2; go-fuse a4c968c; go1.6.2". Example: "gocryptfs v0.12-2; go-fuse a4c968c; go1.6.2".
Field 1 is the gocryptfs version, field 2 is the version of the go-fuse Field 1 is the gocryptfs version, field 2 is the version of the go-fuse
library, field 3 is the Go version that was used to compile the binary. library, field 3 is the Go version that was used to compile the binary.
**-wpanic** **-wpanic**
: When encountering a warning, panic and exit immediately. This is : When encountering a warning, panic and exit immediately. This is
useful in regression testing. useful in regression testing.
**-zerokey** **-zerokey**
: Use all-zero dummy master key. This options is only intended for : Use all-zero dummy master key. This options is only intended for
automated testing as it does not provide any security. automated testing as it does not provide any security.
Comma-Separated-Options: Comma-Separated-Options:
For compatability with mount(1), options are also accepted as For compatibility with mount(1), options are also accepted as
"-o COMMA-SEPARATED-OPTIONS" at the end of the command line. "-o COMMA-SEPARATED-OPTIONS" at the end of the command line.
For example, "-o q,zerokey" is equivalent to "-q -zerokey". For example, "-o q,zerokey" is equivalent to "-q -zerokey".