diff --git a/README.md b/README.md index 044b0bf9..188c9375 100644 --- a/README.md +++ b/README.md @@ -88,10 +88,12 @@ Before using `fscrypt`, you should consider other solutions: disadvantages. eCryptfs is usually configured using [ecryptfs-utils](https://packages.debian.org/stretch/ecryptfs-utils). -* The [**ZFS**](https://en.wikipedia.org/wiki/ZFS) filesystem supports - encryption in its own way (not compatible with `fscrypt`). ZFS encryption has - some advantages; however, ZFS isn't part of the upstream Linux kernel and is - less common than other filesystems, so this solution usually isn't an option. +* Some Linux filesystems support encryption natively, but not in a way that is + compatible with the common API that `fscrypt` uses. Examples of this are + Bcachefs and ZFS. (Note: ZFS is not part of the upstream kernel.) Bcachefs + encryption is similar to dm-crypt in that it encrypts the full filesystem with + one key. ZFS encryption operates on a per-dataset basis. If you are using + one of these filesystems, refer to the documentation for that filesystem. Which solution to use? Here are our recommendations: @@ -101,9 +103,9 @@ Which solution to use? Here are our recommendations: filesystem encryption instead. The largest users of eCryptfs (Ubuntu and Chrome OS) have switched to dm-crypt or Linux native filesystem encryption. -* If you need fine-grained control of encryption within a filesystem, then use - `fscrypt`, or `fscrypt` together with dm-crypt/LUKS. If you don't need this, - then use dm-crypt/LUKS. +* If you need fine-grained control of encryption within a filesystem and you are + using a filesystem that supports `fscrypt`, then use `fscrypt`, or `fscrypt` + together with dm-crypt/LUKS. If you don't need this, then use dm-crypt/LUKS. To understand this recommendation: consider that the main advantage of `fscrypt` is to allow different files on the same filesystem to be encrypted