Set Up and Check ext4 Directory Encryption with e4crypt

You will finish with a checked ext4 encryption policy on an empty directory, or with a read-only inspection of an existing policy. The examples use e4crypt from e2fsprogs 1.47.0, the version installed here. This is per-directory encryption management, not whole-disk encryption.

Allow about twenty minutes for a first test, plus time to plan key handling. You need an ext4 file system, a shell, the e2fsprogs package and a directory whose contents you can safely protect. Some operations may need elevated privileges, depending on the directory and keyring access. Do not test against a directory containing the only copy of important data.

1. Confirm the installed command

Check the binary and package before copying an example. These are ordinary, read-only commands:

$ command -v e4crypt
/usr/bin/e4crypt
$ dpkg-query -W -f='${Package} ${Version}\n' e2fsprogs
e2fsprogs 1.47.0-2.4~exp1ubuntu4.1
$ e4crypt help set_policy

USAGE:
  e4crypt set_policy [ -p pad ] policy path ...

Sets the policy for the directories specified on the command line.

The installed help is useful when a distribution has changed details. In this version, add_key requires a salt with -S. The manpage documents salt formats, keyrings and directory-name padding in more detail.

$ findmnt -no FSTYPE,TARGET /path/to/ext4-mount
ext4 /path/to/ext4-mount

If the result is not ext4, stop. This command manages ext4 encryption policies and is not a general directory encryption tool.

2. Make a deliberately empty test directory

Policy setup requires every target directory to be empty. Create a new directory under a location you control, then verify that it is empty:

$ mkdir -p /path/to/ext4-mount/encryption-test
$ find /path/to/ext4-mount/encryption-test -mindepth 1 -maxdepth 1 -print
$ test -d /path/to/ext4-mount/encryption-test && echo 'directory is ready'
directory is ready

The find command should print nothing. If it prints a name, do not apply a policy there. Move or remove only files you have positively identified as disposable, and keep a backup until the test has succeeded. A policy is not a reversible label that can simply be cleared with another e4crypt command.

3. Add the encryption key to a keyring

Use add_key to enter a passphrase and insert the derived key into a keyring. The command below uses an explicit text salt and does not attach the key to a directory yet:

$ e4crypt add_key -S 's:REPLACE_WITH_A_UNIQUE_SALT'
Enter passphrase: 
Added key with descriptor: 0123456789abcdef

The passphrase prompt is interactive. Do not put the passphrase on the command line, in shell history or in a service unit. The descriptor in the output is an example shape, not a value to copy. Your machine will print its own 16-character hexadecimal key identifier.

A salt can also be supplied as hexadecimal with 0x, from a file with f: or a path, or as a UUID. Use one documented representation consistently. A salt is not a secret replacement for the passphrase, but changing it changes the derived key, so do not improvise a new value when recovering an existing encrypted directory.

By default, the key goes to the session keyring when one exists, otherwise the user session keyring. You can select another keyring with -k, but do so only when you understand its lifetime and access rules. The optional -p value controls directory-name padding and accepts only 4, 8, 16 or 32.

4. Apply a policy to the empty directory

Use the exact descriptor printed by add_key. The policy argument is 16 hexadecimal characters:

$ e4crypt set_policy 0123456789abcdef /path/to/ext4-mount/encryption-test

On success, the command normally returns to the prompt without a success message. Check the status immediately:

$ printf 'set_policy exit status: %s\n' "$?"
set_policy exit status: 0

This is a security-sensitive state change. If you use sudo, use it only when the target directory or keyring requires it, and make sure the key is available to the process that will later access the files. A privileged command can place the key in a different keyring context from the user who needs it.

There is no documented unset-policy operation in e4crypt. For a disposable empty test directory, the practical rollback is to stop using it, confirm it contains no needed data, and remove and recreate that directory according to your local change controls. Do not do that to a directory containing encrypted data as a casual cleanup step. For a real directory, preserve the data and plan recovery through your key-management process instead.

5. Verify the policy without changing it

Ask get_policy for the directory:

$ e4crypt get_policy /path/to/ext4-mount/encryption-test
Encryption policy for /path/to/ext4-mount/encryption-test:
        Policy version: 0
        Master key descriptor: 0123456789abcdef
        Policy flags: 0x0
        Log2 data unit size: 12
        Log2 filename padding: 0
        Direct key descriptor: 0000000000000000

Exact fields can vary with the kernel and policy features. The important checks are that the command succeeds, the path is the one you intended, and the master key descriptor matches the key you recorded. Do not treat a successful lookup as proof that a future process will have the key in its keyring.

For an existing directory, start with get_policy, not set_policy. If a policy is already present, set_policy validates that the requested policy matches it; it does not provide a safe way to replace an existing encryption policy.

6. Start a new session only when you mean to discard keys

new_session gives the invoking process a new session keyring and discards its old session keyring. It is not a routine verification command:

$ e4crypt new_session

After this command, keys held only in the old session keyring are no longer available to the shell. That can make encrypted directories inaccessible until the correct key is added again. Use it only as a deliberate key-lifetime or recovery test, and record the exact commands and key-management procedure needed to restore access. Closing a shell is not a substitute for understanding which keyring held the key.

7. Diagnose the common failures

If set_policy rejects the directory, inspect it with find. A non-empty directory violates the command's requirement. If it rejects the policy, check that the identifier is exactly 16 hexadecimal characters and that the key descriptor came from the intended keyring setup.

If get_policy reports that no policy exists, the directory may be an ordinary unencrypted directory, or you may have supplied the wrong path. Check the mount point and spelling. If a policy exists but file access fails, inspect key availability and the process's keyring rather than changing the policy.

Do not infer success from a quiet command. For state-changing commands, check the exit status. For policy state, use get_policy. For valuable data, test access as the actual service or user account before relying on the setup in production.