요약·해설과 원문, 전문 번역을 서로 분리했습니다. API 이름, symbol, source path는 원문 표기를 사용합니다.
1. 요약·해설
원문의 핵심 논리와 kernel programming 관점의 보충 설명입니다. 아래의 전문 번역과는 별도로 작성했습니다.
2. 영어 원문 전체
번역 기준이 된 Linux v6.18.37 원문입니다. 줄 번호는 이 버전의 파일 좌표입니다.
원문 전체 펼치기
.. SPDX-License-Identifier: GPL-2.0
======================================================
eCryptfs: A stacked cryptographic filesystem for Linux
======================================================
eCryptfs is free software. Please see the file COPYING for details.
For documentation, please see the files in the doc/ subdirectory. For
building and installation instructions please see the INSTALL file.
:Maintainer: Phillip Hellewell
:Lead developer: Michael A. Halcrow <mhalcrow@us.ibm.com>
:Developers: Michael C. Thompson
Kent Yoder
:Web Site: http://ecryptfs.sf.net
This software is currently undergoing development. Make sure to
maintain a backup copy of any data you write into eCryptfs.
eCryptfs requires the userspace tools downloadable from the
SourceForge site:
http://sourceforge.net/projects/ecryptfs/
Userspace requirements include:
- David Howells' userspace keyring headers and libraries (version
1.0 or higher), obtainable from
http://people.redhat.com/~dhowells/keyutils/
- Libgcrypt
.. note::
In the beta/experimental releases of eCryptfs, when you upgrade
eCryptfs, you should copy the files to an unencrypted location and
then copy the files back into the new eCryptfs mount to migrate the
files.
Mount-wide Passphrase
=====================
Create a new directory into which eCryptfs will write its encrypted
files (i.e., /root/crypt). Then, create the mount point directory
(i.e., /mnt/crypt). Now it's time to mount eCryptfs::
mount -t ecryptfs /root/crypt /mnt/crypt
You should be prompted for a passphrase and a salt (the salt may be
blank).
Try writing a new file::
echo "Hello, World" > /mnt/crypt/hello.txt
The operation will complete. Notice that there is a new file in
/root/crypt that is at least 12288 bytes in size (depending on your
host page size). This is the encrypted underlying file for what you
just wrote. To test reading, from start to finish, you need to clear
the user session keyring:
keyctl clear @u
Then umount /mnt/crypt and mount again per the instructions given
above.
::
cat /mnt/crypt/hello.txt
Notes
=====
eCryptfs version 0.1 should only be mounted on (1) empty directories
or (2) directories containing files only created by eCryptfs. If you
mount a directory that has pre-existing files not created by eCryptfs,
then behavior is undefined. Do not run eCryptfs in higher verbosity
levels unless you are doing so for the sole purpose of debugging or
development, since secret values will be written out to the system log
in that case.
Mike Halcrow
mhalcrow@us.ibm.com
3. 한국어 전문 번역
영어 원문의 문단 순서와 의미를 유지한 전체 번역입니다. 코드, 함수명, symbol과 URL은 원문 표기를 유지합니다.
개발 상태와 userspace 의존성
1-39eCryptfs는 Linux용 stacked cryptographic filesystem입니다. 자유 software이며 자세한 license는 `COPYING`, 문서는 `doc/` subdirectory, build와 installation 절차는 `INSTALL`을 참고합니다.
maintainer는 Phillip Hellewell, lead developer는 Michael A. Halcrow이며 Michael C. Thompson과 Kent Yoder도 developer로 기록되어 있습니다. 웹 사이트는 `http://ecryptfs.sf.net`입니다.
이 software는 개발 중이므로 eCryptfs에 기록하는 모든 data의 backup을 유지해야 합니다. userspace tool은 SourceForge의 `http://sourceforge.net/projects/ecryptfs/`에서 받습니다.
userspace에는 David Howells의 userspace keyring header와 library 1.0 이상, 그리고 Libgcrypt가 필요합니다.
beta 또는 experimental release를 upgrade할 때는 file을 암호화되지 않은 위치로 복사한 뒤 새 eCryptfs mount로 다시 복사해 migration해야 합니다.
stacked encryption을 사용하기 전에 필요한 software와 data 보호 조치입니다.
.. SPDX-License-Identifier: GPL-2.0
======================================================
eCryptfs: A stacked cryptographic filesystem for Linux
======================================================
eCryptfs is free software. Please see the file COPYING for details.
For documentation, please see the files in the doc/ subdirectory. For
building and installation instructions please see the INSTALL file.
:Maintainer: Phillip Hellewell
:Lead developer: Michael A. Halcrow <mhalcrow@us.ibm.com>
:Developers: Michael C. Thompson
Kent Yoder
:Web Site: http://ecryptfs.sf.net
This software is currently undergoing development. Make sure to
maintain a backup copy of any data you write into eCryptfs.
eCryptfs requires the userspace tools downloadable from the
SourceForge site:
http://sourceforge.net/projects/ecryptfs/
Userspace requirements include:
- David Howells' userspace keyring headers and libraries (version
1.0 or higher), obtainable from
http://people.redhat.com/~dhowells/keyutils/
- Libgcrypt
.. note::
In the beta/experimental releases of eCryptfs, when you upgrade
eCryptfs, you should copy the files to an unencrypted location and
then copy the files back into the new eCryptfs mount to migrate the
files.
Mount-wide passphrase와 읽기 검증
40-71먼저 암호화된 underlying file을 저장할 새 directory, 예를 들어 `/root/crypt`를 만들고 mount point인 `/mnt/crypt`를 만듭니다. `mount -t ecryptfs /root/crypt /mnt/crypt`로 mount하면 passphrase와 비어 있어도 되는 salt를 묻습니다.
`echo "Hello, World" > /mnt/crypt/hello.txt`로 file을 쓰면 `/root/crypt`에 host page size에 따라 최소 12288 bytes인 encrypted underlying file이 생깁니다.
처음부터 읽기 경로를 다시 검증하려면 `keyctl clear @u`로 user session keyring을 비웁니다. 그런 다음 `/mnt/crypt`를 unmount하고 같은 절차로 다시 mount합니다.
마지막으로 `cat /mnt/crypt/hello.txt`를 실행해 passphrase를 통한 복호화와 읽기가 정상인지 확인합니다.
underlying encrypted directory와 plaintext mount를 분리해 쓰고 다시 읽는 절차입니다.
Mount-wide Passphrase
=====================
Create a new directory into which eCryptfs will write its encrypted
files (i.e., /root/crypt). Then, create the mount point directory
(i.e., /mnt/crypt). Now it's time to mount eCryptfs::
mount -t ecryptfs /root/crypt /mnt/crypt
You should be prompted for a passphrase and a salt (the salt may be
blank).
Try writing a new file::
echo "Hello, World" > /mnt/crypt/hello.txt
The operation will complete. Notice that there is a new file in
/root/crypt that is at least 12288 bytes in size (depending on your
host page size). This is the encrypted underlying file for what you
just wrote. To test reading, from start to finish, you need to clear
the user session keyring:
keyctl clear @u
Then umount /mnt/crypt and mount again per the instructions given
above.
::
cat /mnt/crypt/hello.txt
Version 0.1 제약과 log 비밀 노출
72-86eCryptfs version 0.1은 빈 directory 또는 eCryptfs가 만든 file만 들어 있는 directory에만 mount해야 합니다. eCryptfs가 만들지 않은 기존 file이 있는 directory에 mount하면 동작이 정의되지 않습니다.
debugging 또는 development만을 목적으로 하는 경우가 아니라면 eCryptfs를 높은 verbosity level로 실행하지 않아야 합니다. 높은 verbosity에서는 secret value가 system log에 기록됩니다.
data 손상과 secret log 노출을 피하기 위한 제한입니다.
Notes
=====
eCryptfs version 0.1 should only be mounted on (1) empty directories
or (2) directories containing files only created by eCryptfs. If you
mount a directory that has pre-existing files not created by eCryptfs,
then behavior is undefined. Do not run eCryptfs in higher verbosity
levels unless you are doing so for the sole purpose of debugging or
development, since secret values will be written out to the system log
in that case.
Mike Halcrow
mhalcrow@us.ibm.com
요약·해설
ecryptfs.rst:1-86eCryptfs는 underlying directory에 암호문 file을 저장하고 별도 mount point에 plaintext view를 제공하는 stacked cryptographic filesystem입니다. keyring·Libgcrypt userspace 도구가 필요하고 개발 단계 문서이므로 backup, migration, verbosity의 secret 노출에 주의해야 합니다.
같은 file이 사용자와 underlying storage에서 다르게 보이는 구조입니다.