Ask HN: Are there wrapper/runner programs that encrypt writes and decrypt reads?

6 points

2 years ago

Are there any wrapper programs that run a program and make the program transparently encrypt its writes and decrypt its reads?

i.e. with the program launched being oblivious to the fact that the file it is reading from and writing to, is in fact encrypted on disk (on top of a file system, what could be an unencrypted file system)

I'm specifically interested in being able to run a program with a wrapper program, type a password, and only that process that is started being able to read from and write to the file, transparently (I don't want to use file permissions to limit which processes can read from or write to the file)

Oh and by the way, I know disk encryption file systems exist, I use LUKS, not really what I'm asking about.

I've done some searches and I was only able to find FUSE filesystems that can transparently encrypt files on top of a file system, they work by initializing a directory, to store the encrypted files in, and then mounting that directory to a FUSE filesystem mount point, a mount point where any process can access and read or write (if one doesn't leverage file-system permissions, which is not what I'm looking for)

Here's a useful page that talks about and compares these open-source file encryption solutions (gocryptfs, encfs, ecryptfs, cryptomator, securefs, CryFS): https://nuetzlich.net/gocryptfs/comparison/ (https://archive.is/gMwpV)

Inspiration to think of using such a program came from reading about NixGL[1], a program that wraps and runs programs (programs installed with Nix on a distro that is not NixOS), to make OpenGL or Vulkan applications able to run and work on distros that are not NixOS, it works like this:

  $ nixGL program
  $ nixVulkan program

I imagine this program does some things so the program it wraps/runs correctly loads the right graphics driver libraries, something that's not really analogous to changing the behavior of file-system operations (I think).

What would it take/require to change the behavior of file-system operations/syscalls/APIs in a program (besides recompiling it)? syscalls or APIs like fopen(), write(), fsync(), fflush(), fclose(), FlushFileBuffers() (on Windows).

How can a program accomplish this? by using/doing something like virtualization? emulation? syscall/API translation? e.g. like WINE?

  [1] https://github.com/nix-community/nixGL

10 comments