eCryptFS Deprecation

[Cwavs]

Not sure if you're aware, but I couldn't see any other discussion around it here (and I do use this feature myself so I figured it was worth raising). It appears that eCryptFS is going to be deprecated (see https://lore.kernel.org/lkml/ZyKf6ZSZrETI+4%2FS@redbud/T/#u) and eventually removed from the Kernel.

Given this is currently the only way to encrypt an image easily as part of the standard wizard, it's probably worth looking at an alternative method for image encryption. Some alternative options I've thought of:

• Auto-mount a luks/veracrypt/bitlocker partition (could be cumbersome and not nesscarily well supported on all operating systems without additional applications)
• fscrypt, a good alternative, but relies on the host filesystem to natively support (wouldn't work with NTFS/FAT etc)
• Some sort of encrypted container file (something like 7z, this would be the closest to what we currently with have eCryptFS. not sure quite what formats would be viable)

Either way it's probably at least best adding a notice of deprecation explcitly to Clonezilla as well to let users know that it is being deprecated, and migration will likely be needed to transition to whatever alternative is developed, if any.

[stevenshiau]

Thanks for raising this.
One possibility is to switch to gocryptfs in the future:
https://nuetzlich.net/gocryptfs/
This package is included in Debian repository:
https://tracker.debian.org/pkg/gocryptfs
I haven't check that carefully, but it looks like very promising to be used in Clonezilla in the future.
Any suggestion?

[Cwavs]

Ohh yes, I don't know how I didn't turn that up in my search, but that does look to be a good replacement!

[stevenshiau]

Thanks for raising this discussion.
We have implemented the gocryptfs mechanism in Clonezilla live >= 3.3.2-11 or 20260330-*:
https://clonezilla.org/downloads.php
If you are interested, please give it a try.
In the TUI menu, you will see an option "-goc" which can be used to encrypt the image using gocryptfs.
Let us know the results if you try it.
Thanks.

[Cwavs]

Oh that's great! Thanks for the work on that. I'll go ahead and give that a shot. Are there any plans to implement a migration for older images made in ecryptfs (if there isn't one already)?

[stevenshiau]

"Are there any plans to implement a migration for older images made in ecryptfs (if there isn't one already)?" -> Great. Thanks for asking.
For the moment, it can only be done by decrypt the image, then encrypt it via gocryptfs.
We will have a function to convert it soon.

[Cwavs]

Great! Thanks for confirming. I've given a image and restore a test and it seems to work well. Though I recently haven't had much of a reason to use it, so I haven't been able to do too much in depth testing so far! I'll let you know if I spot any problems though.

[stevenshiau]

Thanks for confirming that.
BTW, we have a new testing Clonezilla live release, i.e., 3.3.2-18. There is a new command ocs-cvtimg-enc that can be used to convert the encrypted image. e.g., to convert my-image-ecryptfs (encrypted with ecryptfs) to my-image-gocryptfs (encrypted with gocryptfs), you can run:
ocs-cvtimg-enc -t gocryptfs my-image-ecryptfs my-image-gocryptfs
Please test it if you have time. Thanks.

[Cwavs]

Great! Thanks for the work as usual, I'll give that a shot tomorrow if I have time!

[Cwavs]

Sorry, I forgot to respond! I tried out the command on a few images the other day and it all seemed to work fine. Again nothing rigorous but I've not hit any problems. I've also generally been using the normal backup to gocryptfs a fair bit and it's been working fine.

[stevenshiau]

Cool. Thanks for your feedback.

[Cwavs]

No Problem. Thanks for the great work.