felis/community-plugins
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update davemhammer/gocryptfs to 1.3.1 (#326)

Browse Source 
Secure short-lived password files under a private 0700 directory
(under /dev/shm when available) before write, closing a umask/chmod race.
This commit is contained in:
Dave Hammer
2026-08-10 12:03:42 -04:00
committed by GitHub
parent 2010b199f0
commit 41b58c734d
3 changed files with 183 additions and 133 deletions
Download Patch File Download Diff File Expand all files Collapse all files
gocryptfs/README.md
+1 -1
View File
@@ -94,7 +94,7 @@ noctalia msg plugin davemhammer/gocryptfs:service all automount
On mount / auto-mount, the service prefers the session key; if missing, it hydrates from `secret-tool` into `keyctl`, then runs `gocryptfs -extpass keyctl pipe <id>`. Fallback: `gocryptfs -extpass secret-tool lookup …`.
- One-shot typed passwords use a short-lived file under `/dev/shm` (tmpfs) when available, then delete it.
- One-shot typed passwords use a short-lived file under a **private** tmpfs dir (`/dev/shm/noctalia-gocryptfs.$USER`, mode `0700`) when available, then delete it. Parent mode blocks other local users even if the file briefly inherits umask.
- Optional **advanced** passfile paths remain supported for users who manage their own files (plaintext by user choice; not recommended).
- **Forget** and volume remove clear both the desktop keyring entry and the session key.
- Passwords are not logged.