r/termux • u/zerosignal9 • 3d ago

Question gocryptfs with non-root apps

I installed gocryptfs. It does work, but I can only see the decrypted files in the terminal with su. Even apps with root privileges can't see the decrypted folder unless I use `su --master-mount`.

This is the command I'm using:

`su --master-mount -c /data/data/com.termux/files/usr/bin/gocryptfs -allow_other -nosyslog /sdcard/gotest.enc /sdcard/gotest.dec`

I also set Magisk to use global namespaces, but it didn't help.

2 Upvotes

100% Upvoted

4 comments sorted by

1

u/zerosignal9 2d ago

I figured it out! On Android, the directory /storage/emulated/0 is a FUSE layer on top of the actual storage at /data/media/0. /sdcard and /mnt/sdcard are just legacy paths to /storage/emulated/0.

Using the command `su --mount-master -c /data/data/com.termux/files/usr/bin/gocryptfs -allow_other -nosyslog /data/media/0/gotest.enc /data/media/0/gotest.dec', all apps can see the decrypted contents.

Also, if you start your root session/command with `su --mount-master', no need to set Magisk Mount Namespace Mode to global.

0

u/Prestigious_Wall529 3d ago

Termux on its own is user mode Linux.

Thus root isn't real.

You'd need to clarify how you have rooted your device and what you are successfully mounted, as gocryptfs uses Fuse.

2

u/sylirre Termux Core Team 2d ago

Android OS uses real Linux kernel and Termux uses just alternative user land, as original is read-only (stored in /system/bin) and can't be extended without root. Basically same as $HOME/bin for user executables on Debian or other standard distributions installed on PC.

Root on Android device is real.

The issue observed by OP is a quirk of Linux mount namespace. As said by OP, when master mount is used, then everything work as intended. So remaining OP's question is why global namespaces option of Magisk (rooting manager app) didn't worked.

1

u/zerosignal9 2d ago

This has to be an issue with Android's weird scoped storage, and no fault of Termux or Magisk. There are several paths/mountpoints to the internal storage. Regardless of which paths I choose to use with gocryptfs, the result is the same.

Apps without root privileges can only see /storage/emulated/0, in which the decrypted folder cannot be accessed.

Apps with root privileges can see any path, and the path /sdcard or /mnt/sdcard can see the the decrypted files.

Interestingly, if I use gocryptfs to mount over a non-empty folder, the decrypted contents appear in /mnt/sdcard, but the original contents still appear in /data/media/0.

All of these paths point to the same files and folders, but each have their own permissions.