xattrs support missing from reverse mode

[crowtrobot]

I just started looking into gocryptfs as a new method to encrypt offsite backups with the reverse option, and so far I am loving it. I have noticed one strange thing, and can't find a report for it here.

If I make a normal gocryptfs filesystem, and put some files in it, I can set extended attributes on those files which get encrypted and stored as extended attributes on the encrypted files. But if I mount with -reverse a directory with files that have extended attributes, they don't show up in the encrypted form.

Tested with the latest release downloaded from github, which is gocryptfs v2.4.0 without_openssl; go-fuse v2.3.0; 2023-06-10 go1.20.3 linux/amd64

Steps to reproduce:

mkdir source_files
echo test > source_files/test
setfattr -n user.test -v "some text" source_files/test
mkdir encrypted
gocryptfs -init -reverse source_files
# put in a password
gocryptfs -reverse source_files encrypted
# type in that same password
mkdir restore
gocryptfs encrypted/ restore/
# type that password in again
getfattr -d restore/test
# expect to see user.test attribute, but see nothing
getfattr -d encrypted/*
# expected to see encrypted xattr, but see nothing

I expected to see here the encrypted xattr, like this:

# file: u2StuT-0BlmWpMSky53Z2A
user.gocryptfs.mp-jfFcJfIe-Mo97njfygw=0sQEtXBWPY7U0KU2NHB0QlbGLbLY8pQX0x2T10cCEaQ2srTo279y64Po+L6fxZ+g==

But instead see nothing.

[rfjakob]

That is, unfortunately, correct. gocryptfs -reverse does not support xattrs, c.f.

gocryptfs/internal/fusefrontend_reverse/node_api_check.go

Line 16 in 0dfa7f8

TODO but low prio. reverse mode in gocryptfs v1 did not have xattr support

[jerry-khan]

I would love to have this feature, which is also important as my primary use of gocryptfs is to create encrypted backups via mounts using the reverse mode.

[rfjakob]

Just to understand the use case better: what xattrs do you have? ACLs or something custom?

…

On Tue, 6 Aug 2024, 16:22 jerry-khan, ***@***.***> wrote: I would love to have this feature, which is also important as my primary use of gocryptfs is to create encrypted backups via mounts using the reverse mode. — Reply to this email directly, view it on GitHub <#827 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AACGA77AOBHLADYMBNXTAN3ZQDLZNAVCNFSM6AAAAABDFYXANGVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDENZRGQZDCNRQGU> . You are receiving this because you commented.Message ID: ***@***.***>

[crowtrobot]

In my case we have a few directories with ACLs, but most of our xattrs come from a set of custom scripts and cron jobs that monitor some shared files.

[jerry-khan]

Just to understand the use case better: what xattrs do you have? ACLs or something custom?
…
On Tue, 6 Aug 2024, 16:22 jerry-khan, @.> wrote: I would love to have this feature, which is also important as my primary use of gocryptfs is to create encrypted backups via mounts using the reverse mode. — Reply to this email directly, view it on GitHub <#827 (comment)>, or unsubscribe https://github.com/notifications/unsubscribe-auth/AACGA77AOBHLADYMBNXTAN3ZQDLZNAVCNFSM6AAAAABDFYXANGVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDENZRGQZDCNRQGU . You are receiving this because you commented.Message ID: @.>

The xattr that I have and use is primarily user.xdg.tags (used by many applications). I use it to tag all files and directories in my system, as an attempt to effectively have a tagging filesystem that is application-independent and future-proof.
Support for XDG's standardized extended attributes ("user.xdg....") would be very nice if possible, but not mandatory.