gocryptfs on macOS BigSur, Apple M1

[corelanc0d3r]

Hi,

I am trying to run 'gocryptfs' on my 2020 MacBook Air, M1 processor. Latest version of BigSur.
I changed the Security Policy to allow kernel extension.

Setup:
OSXFuse:

brew install osxfuse

gocryptfs

brew install gocryptfs

I was able to initialize a new encrypted folder with gocryptfs -init /Users/corelanc0d3r/CTest

So far so good.

When trying to mount the encrypted folder, I get this:

gocryptfs /Users/corelanc0d3r/CTest /Users/corelanc0d3r/mnt/test                                                                                     
Password: 
Decrypting master key
fuse.NewServer failed: exit status 255

Any suggestions on getting it to work?
(Note: I was able to get it to work on a 2019 MacBook Pro, Intel processor, also running BigSur)

How can I help getting you the info you need to troubleshoot the problem?

thanks !

[corelanc0d3r]

I would like to add the following thoughts:

1. I have installed osxfuse, as well as macFuse 4.1.0 (via https://github.com/osxfuse/osxfuse/releases). (The names are a bit confusing, as they both refer to 'osxfuse'). macFuse seems to support M1. I am not sure about osxfuse though.

2. It looks like M1/BigSur devices are quite picky about kernel extension... I am a bit of a newbie, so I don't know if there is a way to actually test/check if osxfuse is working or not. Any help would be greatly appreciated.

3. This may be a dumb idea, but would there be a way for gocryptfs to use macfuse instead of osxfuse? I see a reference to osxfuse in the error message. But perhaps macfuse already works?

fuse.NewServer failed: exit status 255
Maybe you should run: /Library/Filesystems/osxfuse.fs/Contents/Resources/load_osxfuse

thanks !

[tracure1337]

Issue being discussed here issue 15

[rfjakob]

I suggest the following:

(1) Uninstall osxfuse. You must have macfuse 4.x for this to work on M1.
(2) Try and see if SSHFS works (download from https://osxfuse.github.io/ )

[litori]

Anyone have instructions on getting it to work with Macfuse on the M1?

[MarcelBochtler]

@litori

1. Install Macfuse
2. Install go
3. Download / Clone this repository
4. Run build.bash which will produce the gocryptfs binary.

Disclaimer: Didn't test this on a M1 Macbook. But it should work.

[litori]

Thanks! got it to work on the m1. Greatly appreciated

[Ashaman-]

@litori

1. Install Macfuse

2. Install go

3. Download / Clone this repository

4. Run [build.bash](https://github.com/rfjakob/gocryptfs/blob/master/build.bash) which will produce the gocryptfs binary.

Disclaimer: Didn't test this on a M1 Macbook. But it should work.

M1 MacBook Air with Big Sur gets the following output:

# pkg-config --cflags -- libcrypto Package libcrypto was not found in the pkg-config search path. Perhaps you should add the directory containing libcrypto.pc'
to the PKG_CONFIG_PATH environment variable
No package 'libcrypto' found
pkg-config: exit status 1`

[rawdigits]

@Ashaman- just try giving pkgconfig the proper paths and building again.

this worked for me:

export PKG_CONFIG_PATH="/opt/homebrew/opt/openssl@1.1/lib/pkgconfig"
export LDFLAGS="-L/opt/homebrew/opt/openssl@1.1/lib"
export CPPFLAGS="-I/opt/homebrew/opt/openssl@1.1/include"

[rfjakob]

You can also just run

./build-without-openssl.bash

and skip the optional dependency on openssl. I think it does not give you a speed advantage on the Apple M1, but maybe someone who built with openssl can post their openssl -speed results?

[rawdigits]

Ah, thanks for the info @rfjakob. Does the M1 not have any crypto acceleration offload capability?

edit/update:

% gocryptfs -speed
gocryptfs v2.0-beta4-5-g09870bf; go-fuse v2.1.1-0.20210423170155-a90e1f463c3f => github.com/rfjakob/go-fuse/v2 v2.1.1-0.20210508151621-62c5aa1919a7; 2021-05-25 go1.16.3 darwin/arm64
AES-GCM-256-OpenSSL 	1627.09 MB/s	(selected in auto mode)
AES-GCM-256-Go      	3746.85 MB/s	
AES-SIV-512-Go      	 452.57 MB/s	
XChaCha20-Poly1305-Go	 747.43 MB/s	(benchmark only, not selectable yet)

[rfjakob]

Wow! Added to https://github.com/rfjakob/gocryptfs/wiki/CPU-Benchmarks#apple-m1-launch-q42020 , thanks!

Looks like

1. the M1 does have a crypto accelerator
2. Go natively supports it
3. gocryptfs makes the wrong decision in auto-selecting between AES-GCM-256-OpenSSL and AES-GCM-256-Go

I suggest to always compile with

./build-without-openssl.bash

on the Apple M1. Using OpenSSL makes no sense here.

[rfjakob]

(3) is fixed now via 1d2ac1e

@litori

1. Install Macfuse
2. Install go
3. Download / Clone this repository
4. Run build.bash which will produce the gocryptfs binary.

Disclaimer: Didn't test this on a M1 Macbook. But it should work.

I followed these steps on an Intel MacBook and now my gocryptfs is entirely broken.

I installed the latest version of macFUSE (4.1.2), cloned the gocryptfs repository, checked out the latest stable tag (v2.0.1), built gocryptfs and mounted an encrypted directory.

Bad mistake.

Now the system.log gets spammed with "go-fuse: using reserved ID 1 for inode number" and then the mounted folder disappears and becomes unaccessible.
I have to forcefully unmount it via sudo diskutil umount force /path/.

When I look at the encrypted folder, I see a lot of files with 0 Bytes in size. When I delete these files from the encrypted folder, the error message disappears for some time, until it arises again after mounting and opening a directory.

I also cannot mount the file system as read-only anymore, as this results now in the error message

fs.Mount failed: read-only file system
Maybe you should run: /Library/Filesystems/osxfuse.fs/Contents/Resources/load_osxfuse

Running the suggested line does nothing.

Now my entire setup is broken and gocryptfs does not work anymore.

How can I mitigate this?

Edit: I also tried older versions of macFUSE, right now I have FUSE 3.11.2, but to no avail.

Edit2: I just discovered, that it happens whenever there's a write access to the mounted volume. When I open the volume in the Finder app, it tries to create a file called .DS_Store and fails. The same happens when I use the Terminal and touch /path/test.txt.
The result is

gocryptfs[3437]: go-fuse: rx 6: ACCESS n1 {u=501 g=20 x} 
gocryptfs[3437]: go-fuse: tx 6:     OK
gocryptfs[3437]: go-fuse: rx 8: LOOKUP n1 ["test.txt"] 9b
gocryptfs[3437]: go-fuse: using reserved ID 1 for inode number