Chris Collins

Project

CryptoFS

A Linux kernel module that encrypts files transparently at the VFS layer with per-file AES-256-GCM keys — authorised processes see plaintext, everyone else sees ciphertext.

Started 1 March 2026 · updated 20 April 2026 · repository

Software engineering

CryptoFS is a stacked Linux filesystem, inspired by transparent-encryption products such as Thales CipherTrust, that encrypts file data at the VFS layer. Applications read and write normally; what lands on disk is ciphertext. Access is decided per process.

What it does

  • Transparent AES-256-GCM encryption through the kernel Crypto API, with per-extent authentication tags that detect tampering.

  • A unique 256-bit file encryption key per file, wrapped by a master key.

  • 4 KB extent-based processing, so random access does not decrypt whole files.

  • Per-process policies by UID, GID, executable path, binary SHA-256 hash, or process name: authorised processes see plaintext, others see ciphertext or are blocked from writing.

  • Full VFS support — sequential and random I/O, append, truncate, mmap, rename, links — and it mounts over any existing filesystem (ext4, xfs, btrfs) without reformatting.

  • A key-management daemon with Argon2id-protected master keys, a kernel audit log, and Docker bind-mount support.

How it is built

A C kernel module plus user-space tooling, with integration tests, a stress test that checks data integrity with SHA-256, fio benchmarks, and container tests. Development on macOS uses a Linux VM.

Status

A working prototype for learning and experimentation — not audited for production use.

Updates

  1. Transparent file encryption in the Linux kernel Article

    How I built CryptoFS, a stacked Linux filesystem that encrypts every file with its own AES-256-GCM key at the VFS layer — authorised processes see plaintext, everyone else sees ciphertext — and what it taught me about nonces.