----- Message from Tyler Hicks <tyhicks@xxxxxxxxxxxxx> ---------
Date: Mon, 22 Sep 2014 10:58:25 -0500
From: Tyler Hicks <tyhicks@xxxxxxxxxxxxx>
Subject: Re: Practical questions about locking and re-encrypting
To: Kenneth Waegeman <Kenneth.Waegeman@xxxxxxxx>
Cc: ecryptfs@xxxxxxxxxxxxxxx
On 2014-09-22 17:32:57, Kenneth Waegeman wrote:
Hi all,
Hi Kenneth
We want to use ecryptfs on GPFS. How does ecryptfs handles locking if an
encrypted directory is mounted on different boxes ? Is data corruption
possible while writing?
eCryptfs is not well suited for being stacked on top of a distributed
file system such as GPFS.
That would result in each node having its own eCryptfs mount. Each
eCryptfs mount has its own page cache. eCryptfs doesn't do any sort of
coordination between remote mounts and there's no way for the lower
filesystem to make eCryptfs aware that file contents, which may be in
the eCryptfs page cache, have been modified by a remote node.
That means that if a file is read into the eCryptfs page cache on node A
and then that file is updated on node B, node A will never know an
update has been made and will never invalidate the old, cached file
contents from its page cache.
When is the pagecache flushed? is sync honoured? or does that happen
only on unmount?
Does this also apply for directories? What happens if 2 hosts
modifying different files in same directory?
Thank you for the explanation!
Kenneth
Another question: Is there an easy way to re-encrypt a directory with
another key? (when having compromised key or so).
Unfortunately, no. You'd need to set up a new eCryptfs mount, with a new
key, and copy the files between the two eCryptfs mounts.
Tyler
Thank you!!
Kenneth
--
To unsubscribe from this list: send the line "unsubscribe ecryptfs" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
----- End message from Tyler Hicks <tyhicks@xxxxxxxxxxxxx> -----
--
Met vriendelijke groeten,
Kenneth Waegeman
--
To unsubscribe from this list: send the line "unsubscribe ecryptfs" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
