[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fEq-ZW-S2Wv91OQZJcGWsNZjtxd7aybC7TCEXAOMp0_8":3},{"item":4,"related":44},{"id":5,"type":6,"title":7,"slug":8,"summary":9,"body":10,"coverUrl":11,"productScreenshots":12,"productLinks":13,"authorName":14,"authorUrl":15,"authorSubject":16,"category":17,"tags":22,"sourceLabel":35,"sourceName":35,"sourceUrl":36,"status":37,"seoTitle":7,"seoDescription":9,"canonicalUrl":38,"isFeatured":39,"sno":40,"sortOrder":41,"publishedAt":42,"updatedAt":43,"createdAt":43},"9865c835-21fc-4f74-b154-19c054173557","article","fscrypt：只给手机里的某个文件夹加密，系统怎么做到？","linux-fscrypt-file-based-encryption","Linux fscrypt 在支持的文件系统中为目录树、文件内容和文件名提供文件级加密。它与整盘加密保护的范围不同，也不会隐藏所有文件系统元数据；本文从解锁密钥说到备份与恢复的边界。","整盘加密很像给整栋房子装上一把总锁：设备关机或磁盘被拆走时，锁住的范围很大。但有时系统希望更细地管理数据，例如只保护某个用户目录，或者在设备已解锁时仍让不同应用的文件按密钥策略隔开。Linux 的 fscrypt 就是面向支持文件系统的文件级加密框架。\n\n## 加密发生在文件系统这一层\n\n应用照常打开、读取和写入文件；文件系统在数据落到存储设备之前，根据目录策略和密钥完成加解密。fscrypt 可以保护文件内容，也能对文件名进行加密。密钥可由用户空间提供，再交给内核管理；目录策略决定新建文件如何继承加密设置。\n\n可以把它想成带锁的文件柜，而不是整间仓库封死。你打开柜门并提供密钥后，应用仍以普通文件路径访问内容；数据写入底层存储时则以加密形式保存。对移动设备、用户目录和应用私有数据而言，这种透明性让上层软件不必自己实现整套磁盘加密流程。\n\n## 文件加密不等于所有信息都消失\n\n文件系统需要保留一些管理信息才能工作。即便文件内容和文件名受到保护，目录结构、文件大小、修改时间、访问模式或其他元数据是否暴露，仍取决于具体文件系统和实现。fscrypt 也不等于整盘加密：没有被加密策略覆盖的文件或分区仍可能以明文存储。\n\n密钥管理同样是安全边界的一部分。设备运行且密钥已加载时，拥有相应权限的软件仍可能访问明文；若忘记密钥、没有正确备份恢复凭据，数据可能无法找回。加密能降低设备丢失、存储介质被离线读取的风险，却无法阻止已登录账户被恶意软件滥用。\n\n实践中，使用前要确认文件系统支持 fscrypt、内核与用户空间工具配置正确，并理解目录策略如何继承。备份时也要考虑密钥恢复。把 fscrypt 看作“文件系统提供的一种数据静态保护机制”，比把它叫作“给文件加锁后万事无忧”更准确。\n\n来源：[Linux 内核文档：Filesystem-level encryption](https:\u002F\u002Fdocs.kernel.org\u002Ffilesystems\u002Ffscrypt.html)","\u002Fuploads\u002F2026-10-17\u002Fdec803fe-0da3-4a9e-8ffc-47427cf599d6.jpg",[],[],"Foundit","https:\u002F\u002Ffoundit.cn","foundit-ai-editorial",{"id":18,"name":19,"slug":20,"description":21},"6179d3b6-dc34-4483-9ded-3cd9f1b37a47","科普","abbreviation","介绍各领域新兴概念",[23,27,31],{"id":24,"name":25,"slug":26},"7c76bfc2-f80f-4ee0-a95d-27bd8708b434","技术","slug",{"id":28,"name":29,"slug":30},"a202d639-99a6-488a-a712-4d4c6ffd7e15","开发","dev",{"id":32,"name":33,"slug":34},"4c2bbea6-eab7-40a8-8447-1de478ff7749","分析","analyse","Linux Kernel Documentation","https:\u002F\u002Fdocs.kernel.org\u002Ffilesystems\u002Ffscrypt.html","published",null,false,41,0,"2026-10-17T00:00:00.000Z","2026-10-17T03:08:37.641Z",[45,54,63],{"id":46,"type":6,"title":47,"slug":48,"summary":49,"coverUrl":50,"authorName":14,"sno":51,"publishedAt":52,"createdAt":53},"9ccde95c-d754-4808-91f7-488f392e3eeb","你的品牌在AI眼里到底存不存在？这套系统说了算","automated-geo-monitoring-system","靠手动抽查来验证GEO效果，本质上是在跟概率玩游戏。赢一次，不代表能一直赢。","\u002Fuploads\u002F2026-08-07\u002Fdf111c0d-f14a-4b2a-8347-141e96b71654.jpg",1,"2026-08-07T00:00:00.000Z","2026-08-07T04:31:30.843Z",{"id":55,"type":6,"title":56,"slug":57,"summary":58,"coverUrl":59,"authorName":14,"sno":60,"publishedAt":61,"createdAt":62},"56d3ebcb-170a-4f96-9134-ae85fb65542b","DANE\u002FTLSA：DNSSEC 能否帮助验证网站的 TLS 证书？","dane-tlsa-dnssec-tls-authentication","DANE 使用 DNS 中的 TLSA 记录发布与 TLS 服务证书或公钥相关的约束，并依赖 DNSSEC 验证记录来源。本文解释它如何补充信任路径，以及为什么它不等于所有网站都能抛弃 CA。","\u002Fuploads\u002F2026-10-13\u002F8c7d9bf5-62c6-47d4-b8eb-c4db7a21fa61.jpg",42,"2026-10-13T00:00:00.000Z","2026-10-13T02:13:55.563Z",{"id":64,"type":6,"title":65,"slug":66,"summary":67,"coverUrl":68,"authorName":14,"sno":69,"publishedAt":42,"createdAt":70},"1cc0b372-1c09-4718-b058-75e8eccae8df","QUIC DATAGRAM：有些实时数据为什么不值得重传？","quic-datagram-unreliable-transport","QUIC DATAGRAM 扩展让应用在加密 QUIC 连接中传递不保证重传、也不保证有序的短消息，适合过期即无用的实时数据。它仍受拥塞控制，也需要双方协商支持；本文用语音与游戏状态说明取舍。","\u002Fuploads\u002F2026-10-17\u002Fd0072eed-769d-4cdb-9bd7-7e2eedf7bbda.jpg",43,"2026-10-17T03:08:42.958Z"]