All OSes:
diff --git a/doc/html/ru/Mounting VeraCrypt Volumes.html b/doc/html/ru/Mounting VeraCrypt Volumes.html
index acf0ab81..d4759120 100644
--- a/doc/html/ru/Mounting VeraCrypt Volumes.html
+++ b/doc/html/ru/Mounting VeraCrypt Volumes.html
@@ -62,12 +62,22 @@
параметр, что уменьшает записи метаданных, вызванные только доступом к файлам. Несколько параметров можно
указать через запятую, например noatime,nosuid,nodev. Неподдерживаемые параметры обрабатываются
операционной системой и могут привести к ошибке монтирования.
-Настройка Linux Монтировать тома NTFS с помощью драйвера ntfs3 ядра Linux по умолчанию отключена.
-Если она включена, VeraCrypt проверяет расшифрованное виртуальное устройство с помощью blkid -p и
-монтирует обнаруженные файловые системы NTFS с помощью встроенного в ядро драйвера ntfs3 вместо
-стандартного NTFS-бэкенда. Если определить NTFS не удалось, VeraCrypt использует обычный автоматический выбор
-файловой системы. Если ntfs3 недоступен или заблокирован дистрибутивом Linux, монтирование может
-завершиться ошибкой. Эта необязательная настройка может помочь на системах, где ждущий режим или гибернация
+
Настройка Linux Монтировать тома NTFS с помощью встроенного в ядро драйвера Linux по умолчанию отключена.
+Если она включена и явный тип файловой системы не указан, VeraCrypt проверяет расшифрованное виртуальное
+устройство с помощью blkid -p и
+монтирует обнаруженные файловые системы NTFS с помощью доступного встроенного в ядро драйвера вместо
+стандартного NTFS-бэкенда. VeraCrypt использует ntfs, когда он положительно определен как
+современный драйвер с чтением и записью или ожидается в Linux 7.1 и новее; иначе используется
+ntfs3. Вспомогательные программы монтирования,
+такие как mount.ntfs и ntfs-3g, обходятся. Если определить NTFS не удалось, VeraCrypt
+использует обычный автоматический выбор файловой системы. Если поддерживаемый встроенный в ядро драйвер NTFS
+недоступен или не может быть загружен, монтирование завершается ошибкой. В командной строке
+--filesystem=ntfs3 закрепляет встроенный в ядро драйвер ntfs3,
+--filesystem=kernel-ntfs принудительно включает выбор драйвера ядра VeraCrypt для монтирования NTFS, а
+-m kernelntfs включает выбор по обнаруженной NTFS для текущего монтирования.
+Селекторы файловой системы ntfs3 и kernel-ntfs предназначены только для монтирования;
+при создании нового тома NTFS используйте NTFS.
+Эта необязательная настройка может помочь на системах, где ждущий режим или гибернация
зависают, если файловые системы FUSE, работающие в пользовательском пространстве, такие как
ntfs-3g/fuseblk, заморожены во время синхронизации файловых систем ядром.
Фактический тип смонтированной файловой системы можно
diff --git a/src/Common/Language.xml b/src/Common/Language.xml
index ccc76751..bd893690 100644
--- a/src/Common/Language.xml
+++ b/src/Common/Language.xml
@@ -1668,8 +1668,9 @@
You have chosen an Argon2 PIM value that is larger than VeraCrypt default value.\nPlease note that this can require more memory and lead to much slower mounting.
You have chosen an Argon2 PIM value that is smaller than the default VeraCrypt value. Please note that if your password is not strong enough, this could lead to weaker security.\n\nDo you confirm that you are using a strong password?
Password must contain 20 or more characters in order to use the specified Argon2 PIM.\nShorter passwords can only be used if the Argon2 PIM is 12 or greater.
- Mount NTFS volumes with the Linux kernel ntfs3 driver
- Linux only. When enabled, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with ntfs3 instead of the default NTFS backend. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If ntfs3 is unavailable or blocked by the distribution, mounting may fail. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.
+ Mount NTFS volumes with an in-kernel Linux driver
+ Linux only. When enabled and no explicit filesystem type was supplied, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with an available in-kernel NTFS driver, bypassing mount helpers such as ntfs-3g. VeraCrypt uses ntfs when it is positively identified as a modern read/write driver or expected on Linux 7.1 or later, and otherwise uses ntfs3. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If no supported in-kernel NTFS driver is available or loadable, mounting fails. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.
+ No supported in-kernel NTFS driver is available or loadable. To use the system default NTFS backend, disable the NTFS kernel-driver preference or do not request kernel NTFS explicitly.
Normal unmount of volume {0} failed. This can happen when applications still have files or directories open on the volume, or when the backing device was disconnected and the mount became stale.\n\nIf the device is still connected, choose No, close applications using the volume, and try unmounting again.\n\nIf the device was disconnected or the mount is stale, VeraCrypt can attempt emergency cleanup by lazy-detaching the filesystem and removing or scheduling removal of VeraCrypt kernel objects. Pending writes may have failed, data may be lost, and cleanup may remain pending until applications close open files. Check the filesystem with fsck or the appropriate repair tool before using it again.\n\nContinue?
Emergency cleanup for volume {0} has been initiated. If the volume was disconnected, the mount was stale, or there were pending writes, check the filesystem with fsck or the appropriate repair tool before using it again.
Creating volume data. Please wait.
diff --git a/src/Core/CoreException.h b/src/Core/CoreException.h
index 06b1a29b..2c0f531c 100644
--- a/src/Core/CoreException.h
+++ b/src/Core/CoreException.h
@@ -49,6 +49,7 @@ namespace VeraCrypt
TC_EXCEPTION (EncryptedSystemRequired); \
TC_EXCEPTION (HigherFuseVersionRequired); \
TC_EXCEPTION (KernelCryptoServiceTestFailed); \
+ TC_EXCEPTION (KernelNtfsDriverUnavailable); \
TC_EXCEPTION (LoopDeviceSetupFailed); \
TC_EXCEPTION (MountPointRequired); \
TC_EXCEPTION (MountPointUnavailable); \
diff --git a/src/Core/MountOptions.cpp b/src/Core/MountOptions.cpp
index 5ba78295..092f1b3b 100644
--- a/src/Core/MountOptions.cpp
+++ b/src/Core/MountOptions.cpp
@@ -25,7 +25,7 @@ namespace VeraCrypt
TC_CLONE (FilesystemOptions);
TC_CLONE (FilesystemType);
#ifdef TC_LINUX
- TC_CLONE (MountNtfsWithNtfs3);
+ TC_CLONE (MountNtfsWithKernelDriver);
#endif
TC_CLONE_SHARED (KeyfileList, Keyfiles);
TC_CLONE_SHARED (DirectoryPath, MountPoint);
@@ -66,7 +66,7 @@ namespace VeraCrypt
sr.Deserialize ("FilesystemOptions", FilesystemOptions);
sr.Deserialize ("FilesystemType", FilesystemType);
#ifdef TC_LINUX
- sr.Deserialize ("MountNtfsWithNtfs3", MountNtfsWithNtfs3);
+ sr.Deserialize ("MountNtfsWithKernelDriver", MountNtfsWithKernelDriver);
#endif
Keyfiles = Keyfile::DeserializeList (stream, "Keyfiles");
@@ -139,7 +139,7 @@ namespace VeraCrypt
sr.Serialize ("FilesystemOptions", FilesystemOptions);
sr.Serialize ("FilesystemType", FilesystemType);
#ifdef TC_LINUX
- sr.Serialize ("MountNtfsWithNtfs3", MountNtfsWithNtfs3);
+ sr.Serialize ("MountNtfsWithKernelDriver", MountNtfsWithKernelDriver);
#endif
Keyfile::SerializeList (stream, "Keyfiles", Keyfiles);
diff --git a/src/Core/MountOptions.h b/src/Core/MountOptions.h
index 40546dd1..93fcbd59 100644
--- a/src/Core/MountOptions.h
+++ b/src/Core/MountOptions.h
@@ -27,7 +27,7 @@ namespace VeraCrypt
:
CachePassword (false),
#ifdef TC_LINUX
- MountNtfsWithNtfs3 (false),
+ MountNtfsWithKernelDriver (false),
#endif
NoFilesystem (false),
NoHardwareCrypto (false),
@@ -55,7 +55,7 @@ namespace VeraCrypt
wstring FilesystemOptions;
wstring FilesystemType;
#ifdef TC_LINUX
- bool MountNtfsWithNtfs3;
+ bool MountNtfsWithKernelDriver;
#endif
shared_ptr Keyfiles;
shared_ptr MountPoint;
diff --git a/src/Core/Unix/CoreUnix.cpp b/src/Core/Unix/CoreUnix.cpp
index 6bcc2fea..e4167806 100644
--- a/src/Core/Unix/CoreUnix.cpp
+++ b/src/Core/Unix/CoreUnix.cpp
@@ -18,6 +18,9 @@
#include
#include
#include
+#ifdef TC_LINUX
+#include
+#endif
#include
#include
#include "Platform/FileStream.h"
@@ -30,6 +33,10 @@ namespace VeraCrypt
{
#ifdef TC_LINUX
static string GetTmpUser ();
+ static bool GetLinuxKernelVersion (int &kernelMajor, int &kernelMinor);
+ static bool IsLinuxKernelModuleLoaded (const string &moduleName);
+ static bool IsLinuxKernelVersionAtLeast (int major, int minor);
+ static bool IsNtfsReadWriteKernelModuleAvailable ();
static bool SamePath (const string& path1, const string& path2);
#endif
@@ -747,6 +754,82 @@ namespace VeraCrypt
}
#ifdef TC_LINUX
+ static bool GetLinuxKernelVersion (int &kernelMajor, int &kernelMinor)
+ {
+ struct utsname kernelInfo;
+ if (uname (&kernelInfo) != 0)
+ return false;
+
+ kernelMajor = 0;
+ kernelMinor = 0;
+ int versionFields = sscanf (kernelInfo.release, "%d.%d", &kernelMajor, &kernelMinor);
+
+ if (versionFields < 1)
+ return false;
+
+ return true;
+ }
+
+ static bool IsLinuxKernelVersionAtLeast (int major, int minor)
+ {
+ int kernelMajor = 0;
+ int kernelMinor = 0;
+ if (!GetLinuxKernelVersion (kernelMajor, kernelMinor))
+ return false;
+
+ return kernelMajor > major || (kernelMajor == major && kernelMinor >= minor);
+ }
+
+ static bool IsLinuxKernelModuleLoaded (const string &moduleName)
+ {
+ string modulePath = "/sys/module/" + moduleName;
+ struct stat moduleStat;
+ return stat (modulePath.c_str(), &moduleStat) == 0 && S_ISDIR (moduleStat.st_mode);
+ }
+
+ static bool IsNtfsReadWriteKernelModuleAvailable ()
+ {
+ list args;
+ args.push_back ("-F");
+ args.push_back ("description");
+ args.push_back ("ntfs");
+
+ try
+ {
+ string description = StringConverter::ToLower (StringConverter::Trim (Process::Execute ("modinfo", args, 2000)));
+ // The upstream fs/ntfs module reports "NTFS read-write filesystem driver".
+ // ntfs3 compatibility aliases report different wording, such as read/write.
+ return description.find ("ntfs") != string::npos
+ && description.find ("read-write") != string::npos
+ && description.find ("filesystem driver") != string::npos;
+ }
+ catch (...) { }
+
+ return false;
+ }
+
+ bool CoreUnix::IsNtfsReadWriteKernelFilesystemTypeAvailable () const
+ {
+ if (!IsNtfsReadWriteKernelModuleAvailable ())
+ return false;
+
+ if (!IsLinuxKernelModuleLoaded ("ntfs"))
+ {
+ list args;
+ args.push_back ("-q");
+ args.push_back ("-b");
+ args.push_back ("ntfs");
+
+ try
+ {
+ Process::Execute ("modprobe", args, 5000);
+ }
+ catch (...) { }
+ }
+
+ return IsLinuxKernelModuleLoaded ("ntfs") && IsFilesystemTypeRegistered ("ntfs");
+ }
+
string CoreUnix::DetectFilesystemType (const DevicePath &devicePath) const
{
list args;
@@ -767,9 +850,113 @@ namespace VeraCrypt
return string();
}
}
+
+ bool CoreUnix::IsFilesystemTypeRegistered (const string &filesystemType) const
+ {
+ FILE *procFilesystems = fopen ("/proc/filesystems", "r");
+ if (!procFilesystems)
+ return false;
+
+ bool registered = false;
+ char line[256];
+ finally_do_arg (FILE *, procFilesystems, fclose (finally_arg););
+
+ while (fgets (line, sizeof (line), procFilesystems))
+ {
+ string entry = StringConverter::Trim (line);
+ size_t separator = entry.find_last_of (" \t");
+
+ if (separator != string::npos)
+ entry = entry.substr (separator + 1);
+
+ if (entry == filesystemType)
+ {
+ registered = true;
+ break;
+ }
+ }
+
+ return registered;
+ }
+
+ bool CoreUnix::IsKernelFilesystemTypeAvailable (const string &filesystemType) const
+ {
+ if (IsFilesystemTypeRegistered (filesystemType))
+ return true;
+
+ // This is only used from mount-time paths that run with root-equivalent privileges.
+ // If a future unprivileged caller uses it, modprobe is expected to fail silently here.
+ list moduleNames;
+ moduleNames.push_back (filesystemType);
+ moduleNames.push_back ("fs-" + filesystemType);
+
+ foreach (const string &moduleName, moduleNames)
+ {
+ list args;
+ args.push_back ("-q");
+ args.push_back ("-b");
+ args.push_back (moduleName);
+
+ try
+ {
+ Process::Execute ("modprobe", args, 5000);
+ }
+ catch (...) { }
+
+ if (IsFilesystemTypeRegistered (filesystemType))
+ return true;
+ }
+
+ return false;
+ }
+
+ string CoreUnix::SelectNtfsKernelFilesystemType () const
+ {
+ bool kernelHasStandaloneNtfs = IsLinuxKernelVersionAtLeast (7, 1);
+
+ // Linux 6.9-7.0 may expose an "ntfs" compatibility alias from ntfs3,
+ // but that legacy mount path is forced read-only. Only use "ntfs" where
+ // the standalone read/write in-kernel driver is expected upstream, or when
+ // module metadata and /sys/module positively identify a loaded backport as
+ // the modern driver. Do not trust a pre-existing "ntfs" registration on
+ // pre-7.1 kernels; it may belong to ntfs3's read-only compatibility path.
+ if (!kernelHasStandaloneNtfs && IsNtfsReadWriteKernelFilesystemTypeAvailable ())
+ return "ntfs";
+
+ if (kernelHasStandaloneNtfs && IsKernelFilesystemTypeAvailable ("ntfs"))
+ return "ntfs";
+
+ if (IsKernelFilesystemTypeAvailable ("ntfs3"))
+ return "ntfs3";
+
+ throw KernelNtfsDriverUnavailable (SRC_POS);
+ }
+
+ void CoreUnix::ResolveNtfsKernelMountOptions (const DevicePath &devicePath, bool mountNtfsWithKernelDriver,
+ wstring &filesystemType, bool &internalMountOnly) const
+ {
+ string requestedFilesystemType = StringConverter::ToLower (StringConverter::ToSingle (filesystemType));
+ bool explicitKernelNtfsRequest = requestedFilesystemType == "kernel-ntfs" || requestedFilesystemType == "ntfs-kernel";
+
+ if (requestedFilesystemType == "ntfs3")
+ {
+ // mount.ntfs3 helpers are not required; -i keeps mount(8) on the kernel path.
+ internalMountOnly = true;
+ return;
+ }
+
+ if (!explicitKernelNtfsRequest
+ && !(mountNtfsWithKernelDriver
+ && filesystemType.empty()
+ && DetectFilesystemType (devicePath) == "ntfs"))
+ return;
+
+ filesystemType = StringConverter::ToWide (SelectNtfsKernelFilesystemType());
+ internalMountOnly = true;
+ }
#endif
- void CoreUnix::MountFilesystem (const DevicePath &devicePath, const DirectoryPath &mountPoint, const string &filesystemType, bool readOnly, const string &systemMountOptions) const
+ void CoreUnix::MountFilesystem (const DevicePath &devicePath, const DirectoryPath &mountPoint, const string &filesystemType, bool readOnly, const string &systemMountOptions, bool internalMountOnly) const
{
if (GetMountedFilesystems (DevicePath(), mountPoint).size() > 0)
throw MountPointUnavailable (SRC_POS);
@@ -777,6 +964,9 @@ namespace VeraCrypt
list args;
string options;
+ if (internalMountOnly)
+ args.push_back ("-i");
+
if (!filesystemType.empty())
{
#ifdef TC_SOLARIS
@@ -1118,19 +1308,17 @@ namespace VeraCrypt
if (!options.NoFilesystem && options.MountPoint && !options.MountPoint->IsEmpty())
{
wstring filesystemType = options.FilesystemType;
+ bool internalMountOnly = false;
#ifdef TC_LINUX
- if (options.MountNtfsWithNtfs3 && filesystemType.empty()
- && DetectFilesystemType (loopDev) == "ntfs")
- {
- filesystemType = L"ntfs3";
- }
+ ResolveNtfsKernelMountOptions (loopDev, options.MountNtfsWithKernelDriver, filesystemType, internalMountOnly);
#endif
MountFilesystem (loopDev, *options.MountPoint,
StringConverter::ToSingle (filesystemType),
options.Protection == VolumeProtection::ReadOnly,
- StringConverter::ToSingle (options.FilesystemOptions));
+ StringConverter::ToSingle (options.FilesystemOptions),
+ internalMountOnly);
}
return loopDev;
diff --git a/src/Core/Unix/CoreUnix.h b/src/Core/Unix/CoreUnix.h
index 44681bb6..e693d56c 100644
--- a/src/Core/Unix/CoreUnix.h
+++ b/src/Core/Unix/CoreUnix.h
@@ -70,12 +70,19 @@ namespace VeraCrypt
virtual uid_t GetRealUserId () const;
virtual gid_t GetRealGroupId () const;
virtual string GetTempDirectory () const;
- virtual void MountFilesystem (const DevicePath &devicePath, const DirectoryPath &mountPoint, const string &filesystemType, bool readOnly, const string &systemMountOptions) const;
+ // internalMountOnly maps to mount(8) -i and suppresses /sbin/mount. helpers.
+ virtual void MountFilesystem (const DevicePath &devicePath, const DirectoryPath &mountPoint, const string &filesystemType, bool readOnly, const string &systemMountOptions, bool internalMountOnly = false) const;
virtual DevicePath MountAuxVolumeImage (const DirectoryPath &auxMountPoint, const MountOptions &options) const;
virtual void MountVolumeNative (shared_ptr volume, MountOptions &options, const DirectoryPath &auxMountPoint) const { throw NotApplicable (SRC_POS); }
virtual void UpdateMountedVolumeInfo (shared_ptr mountedVolume) const { (void) mountedVolume; }
#ifdef TC_LINUX
string DetectFilesystemType (const DevicePath &devicePath) const;
+ bool IsFilesystemTypeRegistered (const string &filesystemType) const;
+ bool IsKernelFilesystemTypeAvailable (const string &filesystemType) const;
+ bool IsNtfsReadWriteKernelFilesystemTypeAvailable () const;
+ void ResolveNtfsKernelMountOptions (const DevicePath &devicePath, bool mountNtfsWithKernelDriver,
+ wstring &filesystemType, bool &internalMountOnly) const;
+ string SelectNtfsKernelFilesystemType () const;
#endif
private:
diff --git a/src/Core/Unix/FreeBSD/CoreFreeBSD.cpp b/src/Core/Unix/FreeBSD/CoreFreeBSD.cpp
index 66cd81e8..0055fa8d 100644
--- a/src/Core/Unix/FreeBSD/CoreFreeBSD.cpp
+++ b/src/Core/Unix/FreeBSD/CoreFreeBSD.cpp
@@ -183,8 +183,10 @@ namespace VeraCrypt
return mountedFilesystems;
}
- void CoreFreeBSD::MountFilesystem (const DevicePath &devicePath, const DirectoryPath &mountPoint, const string &filesystemType, bool readOnly, const string &systemMountOptions) const
+ void CoreFreeBSD::MountFilesystem (const DevicePath &devicePath, const DirectoryPath &mountPoint, const string &filesystemType, bool readOnly, const string &systemMountOptions, bool internalMountOnly) const
{
+ (void) internalMountOnly;
+
std::string chosenFilesystem = "msdos";
std::string modifiedMountOptions = systemMountOptions;
diff --git a/src/Core/Unix/FreeBSD/CoreFreeBSD.h b/src/Core/Unix/FreeBSD/CoreFreeBSD.h
index 1dfaf497..d5ebed42 100644
--- a/src/Core/Unix/FreeBSD/CoreFreeBSD.h
+++ b/src/Core/Unix/FreeBSD/CoreFreeBSD.h
@@ -30,7 +30,7 @@ namespace VeraCrypt
virtual DevicePath AttachFileToLoopDevice (const FilePath &filePath, bool readOnly) const;
virtual void DetachLoopDevice (const DevicePath &devicePath) const;
virtual MountedFilesystemList GetMountedFilesystems (const DevicePath &devicePath = DevicePath(), const DirectoryPath &mountPoint = DirectoryPath()) const;
- virtual void MountFilesystem (const DevicePath &devicePath, const DirectoryPath &mountPoint, const string &filesystemType, bool readOnly, const string &systemMountOptions) const;
+ virtual void MountFilesystem (const DevicePath &devicePath, const DirectoryPath &mountPoint, const string &filesystemType, bool readOnly, const string &systemMountOptions, bool internalMountOnly = false) const;
private:
CoreFreeBSD (const CoreFreeBSD &);
diff --git a/src/Core/Unix/Linux/CoreLinux.cpp b/src/Core/Unix/Linux/CoreLinux.cpp
index 34c02a8e..fc61716b 100644
--- a/src/Core/Unix/Linux/CoreLinux.cpp
+++ b/src/Core/Unix/Linux/CoreLinux.cpp
@@ -455,7 +455,7 @@ namespace VeraCrypt
return mountedFilesystems;
}
- void CoreLinux::MountFilesystem (const DevicePath &devicePath, const DirectoryPath &mountPoint, const string &filesystemType, bool readOnly, const string &systemMountOptions) const
+ void CoreLinux::MountFilesystem (const DevicePath &devicePath, const DirectoryPath &mountPoint, const string &filesystemType, bool readOnly, const string &systemMountOptions, bool internalMountOnly) const
{
bool fsMounted = false;
@@ -466,14 +466,14 @@ namespace VeraCrypt
stringstream userMountOptions;
userMountOptions << "uid=" << GetRealUserId() << ",gid=" << GetRealGroupId() << ",umask=077" << (!systemMountOptions.empty() ? "," : "");
- CoreUnix::MountFilesystem (devicePath, mountPoint, filesystemType, readOnly, userMountOptions.str() + systemMountOptions);
+ CoreUnix::MountFilesystem (devicePath, mountPoint, filesystemType, readOnly, userMountOptions.str() + systemMountOptions, internalMountOnly);
fsMounted = true;
}
}
catch (...) { }
if (!fsMounted)
- CoreUnix::MountFilesystem (devicePath, mountPoint, filesystemType, readOnly, systemMountOptions);
+ CoreUnix::MountFilesystem (devicePath, mountPoint, filesystemType, readOnly, systemMountOptions, internalMountOnly);
}
void CoreLinux::MountVolumeNative (shared_ptr volume, MountOptions &options, const DirectoryPath &auxMountPoint) const
@@ -629,17 +629,15 @@ namespace VeraCrypt
if (!options.NoFilesystem && options.MountPoint && !options.MountPoint->IsEmpty())
{
wstring filesystemType = options.FilesystemType;
+ bool internalMountOnly = false;
- if (options.MountNtfsWithNtfs3 && filesystemType.empty()
- && DetectFilesystemType (nativeDevPath) == "ntfs")
- {
- filesystemType = L"ntfs3";
- }
+ ResolveNtfsKernelMountOptions (nativeDevPath, options.MountNtfsWithKernelDriver, filesystemType, internalMountOnly);
MountFilesystem (nativeDevPath, *options.MountPoint,
StringConverter::ToSingle (filesystemType),
options.Protection == VolumeProtection::ReadOnly,
- StringConverter::ToSingle (options.FilesystemOptions));
+ StringConverter::ToSingle (options.FilesystemOptions),
+ internalMountOnly);
filesystemMounted = true;
}
diff --git a/src/Core/Unix/Linux/CoreLinux.h b/src/Core/Unix/Linux/CoreLinux.h
index a53aa8c7..b3f958c4 100644
--- a/src/Core/Unix/Linux/CoreLinux.h
+++ b/src/Core/Unix/Linux/CoreLinux.h
@@ -33,7 +33,7 @@ namespace VeraCrypt
virtual void DismountNativeVolumeDeferred (shared_ptr mountedVolume) const;
virtual MountedFilesystemList GetMountedFilesystems (const DevicePath &devicePath = DevicePath(), const DirectoryPath &mountPoint = DirectoryPath()) const;
virtual bool IsLoopDeviceAttached (const DevicePath &devicePath) const;
- virtual void MountFilesystem (const DevicePath &devicePath, const DirectoryPath &mountPoint, const string &filesystemType, bool readOnly, const string &systemMountOptions) const;
+ virtual void MountFilesystem (const DevicePath &devicePath, const DirectoryPath &mountPoint, const string &filesystemType, bool readOnly, const string &systemMountOptions, bool internalMountOnly = false) const;
virtual void MountVolumeNative (shared_ptr volume, MountOptions &options, const DirectoryPath &auxMountPoint) const;
private:
diff --git a/src/Core/Unix/OpenBSD/CoreOpenBSD.cpp b/src/Core/Unix/OpenBSD/CoreOpenBSD.cpp
index 4c7eb010..e5e9247d 100644
--- a/src/Core/Unix/OpenBSD/CoreOpenBSD.cpp
+++ b/src/Core/Unix/OpenBSD/CoreOpenBSD.cpp
@@ -141,8 +141,10 @@ namespace VeraCrypt
return mountedFilesystems;
}
- void CoreOpenBSD::MountFilesystem (const DevicePath &devicePath, const DirectoryPath &mountPoint, const string &filesystemType, bool readOnly, const string &systemMountOptions) const
+ void CoreOpenBSD::MountFilesystem (const DevicePath &devicePath, const DirectoryPath &mountPoint, const string &filesystemType, bool readOnly, const string &systemMountOptions, bool internalMountOnly) const
{
+ (void) internalMountOnly;
+
try
{
// Try to mount FAT by default as mount is unable to probe filesystem type on BSD
diff --git a/src/Core/Unix/OpenBSD/CoreOpenBSD.h b/src/Core/Unix/OpenBSD/CoreOpenBSD.h
index 3992422c..4830d7e2 100644
--- a/src/Core/Unix/OpenBSD/CoreOpenBSD.h
+++ b/src/Core/Unix/OpenBSD/CoreOpenBSD.h
@@ -33,7 +33,7 @@ namespace VeraCrypt
virtual DevicePath AttachFileToLoopDevice (const FilePath &filePath, bool readOnly) const;
virtual void DetachLoopDevice (const DevicePath &devicePath) const;
virtual MountedFilesystemList GetMountedFilesystems (const DevicePath &devicePath = DevicePath(), const DirectoryPath &mountPoint = DirectoryPath()) const;
- virtual void MountFilesystem (const DevicePath &devicePath, const DirectoryPath &mountPoint, const string &filesystemType, bool readOnly, const string &systemMountOptions) const;
+ virtual void MountFilesystem (const DevicePath &devicePath, const DirectoryPath &mountPoint, const string &filesystemType, bool readOnly, const string &systemMountOptions, bool internalMountOnly = false) const;
private:
CoreOpenBSD (const CoreOpenBSD &);
diff --git a/src/Core/Unix/Solaris/CoreSolaris.cpp b/src/Core/Unix/Solaris/CoreSolaris.cpp
index 131028f2..a6e222c6 100644
--- a/src/Core/Unix/Solaris/CoreSolaris.cpp
+++ b/src/Core/Unix/Solaris/CoreSolaris.cpp
@@ -157,8 +157,10 @@ namespace VeraCrypt
return mountedFilesystems;
}
- void CoreSolaris::MountFilesystem (const DevicePath &devicePath, const DirectoryPath &mountPoint, const string &filesystemType, bool readOnly, const string &systemMountOptions) const
+ void CoreSolaris::MountFilesystem (const DevicePath &devicePath, const DirectoryPath &mountPoint, const string &filesystemType, bool readOnly, const string &systemMountOptions, bool internalMountOnly) const
{
+ (void) internalMountOnly;
+
try
{
// Try to mount FAT by default as mount is unable to probe filesystem type on Solaris
diff --git a/src/Core/Unix/Solaris/CoreSolaris.h b/src/Core/Unix/Solaris/CoreSolaris.h
index b789049e..3420c208 100644
--- a/src/Core/Unix/Solaris/CoreSolaris.h
+++ b/src/Core/Unix/Solaris/CoreSolaris.h
@@ -30,7 +30,7 @@ namespace VeraCrypt
virtual DevicePath AttachFileToLoopDevice (const FilePath &filePath, bool readOnly) const;
virtual void DetachLoopDevice (const DevicePath &devicePath) const;
virtual MountedFilesystemList GetMountedFilesystems (const DevicePath &devicePath = DevicePath(), const DirectoryPath &mountPoint = DirectoryPath()) const;
- virtual void MountFilesystem (const DevicePath &devicePath, const DirectoryPath &mountPoint, const string &filesystemType, bool readOnly, const string &systemMountOptions) const;
+ virtual void MountFilesystem (const DevicePath &devicePath, const DirectoryPath &mountPoint, const string &filesystemType, bool readOnly, const string &systemMountOptions, bool internalMountOnly = false) const;
private:
CoreSolaris (const CoreSolaris &);
diff --git a/src/Main/CommandLineInterface.cpp b/src/Main/CommandLineInterface.cpp
index 0b509ab9..7579cc78 100644
--- a/src/Main/CommandLineInterface.cpp
+++ b/src/Main/CommandLineInterface.cpp
@@ -367,8 +367,20 @@ namespace VeraCrypt
ArgFilesystem = VolumeCreationOptions::FilesystemType::Ext4;
else if (str.IsSameAs (L"NTFS", false))
ArgFilesystem = VolumeCreationOptions::FilesystemType::NTFS;
+ else if (str.IsSameAs (L"kernel-ntfs", false)
+ || str.IsSameAs (L"ntfs-kernel", false))
+ {
+ if (ArgCommand == CommandId::CreateVolume)
+ throw_err (LangString["UNKNOWN_OPTION"] + L": " + str);
+
+ ArgMountOptions.FilesystemType = L"kernel-ntfs";
+ ArgFilesystem = VolumeCreationOptions::FilesystemType::NTFS;
+ }
else if (str.IsSameAs (L"ntfs3", false))
{
+ if (ArgCommand == CommandId::CreateVolume)
+ throw_err (LangString["UNKNOWN_OPTION"] + L": " + str);
+
ArgMountOptions.FilesystemType = L"ntfs3";
ArgFilesystem = VolumeCreationOptions::FilesystemType::NTFS;
}
@@ -466,6 +478,10 @@ namespace VeraCrypt
ArgMountOptions.PartitionInSystemEncryptionScope = true;
else if (token == L"timestamp" || token == L"ts")
ArgMountOptions.PreserveTimestamps = false;
+#ifdef TC_LINUX
+ else if (token == L"kernelntfs" || token == L"kernel-ntfs")
+ ArgMountOptions.MountNtfsWithKernelDriver = true;
+#endif
#ifdef TC_WINDOWS
else if (token == L"removable" || token == L"rm")
ArgMountOptions.Removable = true;
diff --git a/src/Main/Forms/PreferencesDialog.cpp b/src/Main/Forms/PreferencesDialog.cpp
index 075febd1..9481f7f7 100644
--- a/src/Main/Forms/PreferencesDialog.cpp
+++ b/src/Main/Forms/PreferencesDialog.cpp
@@ -28,14 +28,14 @@
namespace VeraCrypt
{
#ifdef TC_LINUX
- class Ntfs3HelpIconWindow : public wxWindow
+ class KernelNtfsHelpIconWindow : public wxWindow
{
public:
- Ntfs3HelpIconWindow (wxWindow *parent)
+ KernelNtfsHelpIconWindow (wxWindow *parent)
: wxWindow (parent, wxID_ANY, wxDefaultPosition, wxSize (16, 16))
{
SetMinSize (wxSize (16, 16));
- Bind (wxEVT_PAINT, &Ntfs3HelpIconWindow::OnPaint, this);
+ Bind (wxEVT_PAINT, &KernelNtfsHelpIconWindow::OnPaint, this);
}
protected:
@@ -98,18 +98,18 @@ namespace VeraCrypt
FilesystemOptionsTextCtrl->SetValue (Preferences.DefaultMountOptions.FilesystemOptions);
#ifdef TC_LINUX
- wxBoxSizer *ntfs3PreferenceSizer = new wxBoxSizer (wxHORIZONTAL);
- MountNtfsWithNtfs3CheckBox = new wxCheckBox (FilesystemSizer->GetStaticBox(), wxID_ANY, LangString["LINUX_PREF_MOUNT_NTFS_WITH_NTFS3"]);
- MountNtfsWithNtfs3CheckBox->SetToolTip (LangString["LINUX_PREF_MOUNT_NTFS_WITH_NTFS3_HELP"]);
- ntfs3PreferenceSizer->Add (MountNtfsWithNtfs3CheckBox, 0, wxALIGN_CENTER_VERTICAL | wxRIGHT, 5);
+ wxBoxSizer *kernelNtfsPreferenceSizer = new wxBoxSizer (wxHORIZONTAL);
+ MountNtfsWithKernelDriverCheckBox = new wxCheckBox (FilesystemSizer->GetStaticBox(), wxID_ANY, LangString["LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER"]);
+ MountNtfsWithKernelDriverCheckBox->SetToolTip (LangString["LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER_HELP"]);
+ kernelNtfsPreferenceSizer->Add (MountNtfsWithKernelDriverCheckBox, 0, wxALIGN_CENTER_VERTICAL | wxRIGHT, 5);
- wxWindow *ntfs3HelpIcon = new Ntfs3HelpIconWindow (FilesystemSizer->GetStaticBox());
- ntfs3HelpIcon->SetToolTip (LangString["LINUX_PREF_MOUNT_NTFS_WITH_NTFS3_HELP"]);
- ntfs3PreferenceSizer->Add (ntfs3HelpIcon, 0, wxALIGN_CENTER_VERTICAL | wxLEFT, 10);
+ wxWindow *kernelNtfsHelpIcon = new KernelNtfsHelpIconWindow (FilesystemSizer->GetStaticBox());
+ kernelNtfsHelpIcon->SetToolTip (LangString["LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER_HELP"]);
+ kernelNtfsPreferenceSizer->Add (kernelNtfsHelpIcon, 0, wxALIGN_CENTER_VERTICAL | wxLEFT, 10);
- FilesystemSizer->Add (ntfs3PreferenceSizer, 0, wxALL, 5);
+ FilesystemSizer->Add (kernelNtfsPreferenceSizer, 0, wxALL, 5);
- MountNtfsWithNtfs3CheckBox->SetValidator (wxGenericValidator (&Preferences.DefaultMountOptions.MountNtfsWithNtfs3));
+ MountNtfsWithKernelDriverCheckBox->SetValidator (wxGenericValidator (&Preferences.DefaultMountOptions.MountNtfsWithKernelDriver));
#endif
int index, prfInitialIndex = 0;
diff --git a/src/Main/Forms/PreferencesDialog.h b/src/Main/Forms/PreferencesDialog.h
index b8b059db..33c8fc5a 100644
--- a/src/Main/Forms/PreferencesDialog.h
+++ b/src/Main/Forms/PreferencesDialog.h
@@ -56,7 +56,7 @@ namespace VeraCrypt
KeyfilesPanel *DefaultKeyfilesPanel;
#ifdef TC_LINUX
- wxCheckBox *MountNtfsWithNtfs3CheckBox;
+ wxCheckBox *MountNtfsWithKernelDriverCheckBox;
#endif
int LastVirtualKeyPressed;
unique_ptr mTimer;
diff --git a/src/Main/Forms/WaitDialog.cpp b/src/Main/Forms/WaitDialog.cpp
index 34b16a98..ceb7d488 100644
--- a/src/Main/Forms/WaitDialog.cpp
+++ b/src/Main/Forms/WaitDialog.cpp
@@ -53,6 +53,7 @@ namespace VeraCrypt
VC_CONVERT_EXCEPTION (EncryptedSystemRequired);
VC_CONVERT_EXCEPTION (HigherFuseVersionRequired);
VC_CONVERT_EXCEPTION (KernelCryptoServiceTestFailed);
+ VC_CONVERT_EXCEPTION (KernelNtfsDriverUnavailable);
VC_CONVERT_EXCEPTION (LoopDeviceSetupFailed);
VC_CONVERT_EXCEPTION (MountPointRequired);
VC_CONVERT_EXCEPTION (MountPointUnavailable);
diff --git a/src/Main/UserInterface.cpp b/src/Main/UserInterface.cpp
index 3b427550..b563bf1d 100644
--- a/src/Main/UserInterface.cpp
+++ b/src/Main/UserInterface.cpp
@@ -526,6 +526,7 @@ namespace VeraCrypt
EX2MSG (InvalidSecurityTokenKeyfilePath, LangString["INVALID_TOKEN_KEYFILE_PATH"]);
EX2MSG (HigherVersionRequired, LangString["NEW_VERSION_REQUIRED"]);
EX2MSG (KernelCryptoServiceTestFailed, LangString["LINUX_EX2MSG_KERNELCRYPTOSERVICETESTFAILED"]);
+ EX2MSG (KernelNtfsDriverUnavailable, LangString["LINUX_KERNEL_NTFS_DRIVER_UNAVAILABLE"]);
EX2MSG (KeyfilePathEmpty, LangString["ERR_KEYFILE_PATH_EMPTY"]);
EX2MSG (LoopDeviceSetupFailed, LangString["LINUX_EX2MSG_LOOPDEVICESETUPFAILED"]);
EX2MSG (MissingArgument, LangString["LINUX_EX2MSG_MISSINGARGUMENT"]);
@@ -1307,13 +1308,22 @@ const FileManager fileManagers[] = {
" option specifies the filesystem to be created on the new volume.\n"
" Filesystem type 'none' disables mounting or creating a filesystem.\n"
#ifdef TC_LINUX
- " On Linux, filesystem type 'ntfs3' mounts an NTFS volume using the\n"
- " in-kernel ntfs3 driver. The ntfs3 kernel module must be available\n"
- " and allowed by the distribution; otherwise mounting may fail.\n"
- " The Linux preference \"Mount NTFS volumes with the Linux kernel ntfs3\n"
+ " On Linux, filesystem type 'ntfs3' mounts with the in-kernel ntfs3\n"
+ " driver and bypasses mount helpers. Filesystem type 'kernel-ntfs'\n"
+ " mounts an NTFS volume using an available in-kernel NTFS driver.\n"
+ " These Linux driver selectors are mount-only; use filesystem type\n"
+ " 'NTFS' when creating a new NTFS volume.\n"
+ " VeraCrypt uses ntfs when it is positively identified as a modern\n"
+ " read/write driver or expected on Linux 7.1 or later;\n"
+ " otherwise it selects ntfs3.\n"
+ " The Linux preference \"Mount NTFS volumes with an in-kernel Linux\n"
" driver\" is disabled by default. When enabled, VeraCrypt probes the\n"
- " decrypted virtual device with blkid -p and applies ntfs3 only when\n"
- " NTFS is detected and no explicit filesystem type was supplied. If\n"
+ " decrypted virtual device with blkid -p and uses an available in-kernel\n"
+ " NTFS driver only when NTFS is detected and no explicit filesystem type\n"
+ " was supplied. The mount option -m kernelntfs enables the same detected\n"
+ " NTFS selection for the current mount; use --filesystem=kernel-ntfs to\n"
+ " force kernel-driver selection. If no supported in-kernel NTFS driver is\n"
+ " available, mounting fails instead of falling back to ntfs-3g. If\n"
" detection fails, VeraCrypt uses the normal automatic filesystem\n"
" selection. This can avoid suspend or hibernate hangs caused by frozen\n"
" user-space FUSE filesystems during kernel filesystem sync; use findmnt\n"
@@ -1369,6 +1379,10 @@ const FileManager fileManagers[] = {
" is unmounted (note that the operating system under certain circumstances\n"
" does not alter host-file timestamps, which may be mistakenly interpreted\n"
" to mean that this option does not work).\n"
+#ifdef TC_LINUX
+ " kernelntfs: Use an available in-kernel NTFS driver when NTFS is\n"
+ " detected and no filesystem type was supplied.\n"
+#endif
" See also option --fs-options.\n"
"\n"
"--new-keyfiles=KEYFILE1[,KEYFILE2,KEYFILE3,...]\n"
@@ -1468,8 +1482,8 @@ const FileManager fileManagers[] = {
"veracrypt -t -k \"\" --pim=0 --protect-hidden=no volume.hc /media/veracrypt1\n"
"\n"
#ifdef TC_LINUX
- "Mount an NTFS volume using the Linux in-kernel ntfs3 driver:\n"
- "veracrypt -t --filesystem=ntfs3 volume.hc /media/veracrypt1\n"
+ "Mount an NTFS volume using a Linux in-kernel NTFS driver:\n"
+ "veracrypt -t --filesystem=kernel-ntfs volume.hc /media/veracrypt1\n"
"\n"
#endif
"Unmount a volume:\n"
@@ -1762,6 +1776,7 @@ const FileManager fileManagers[] = {
VC_CONVERT_EXCEPTION (EncryptedSystemRequired);
VC_CONVERT_EXCEPTION (HigherFuseVersionRequired);
VC_CONVERT_EXCEPTION (KernelCryptoServiceTestFailed);
+ VC_CONVERT_EXCEPTION (KernelNtfsDriverUnavailable);
VC_CONVERT_EXCEPTION (LoopDeviceSetupFailed);
VC_CONVERT_EXCEPTION (MountPointRequired);
VC_CONVERT_EXCEPTION (MountPointUnavailable);
diff --git a/src/Main/UserPreferences.cpp b/src/Main/UserPreferences.cpp
index 61734667..f59ce844 100644
--- a/src/Main/UserPreferences.cpp
+++ b/src/Main/UserPreferences.cpp
@@ -103,7 +103,9 @@ namespace VeraCrypt
DefaultMountOptions.Protection = readOnly ? VolumeProtection::ReadOnly : VolumeProtection::None;
#ifdef TC_LINUX
- if (configMap.count(L"MountNtfsWithNtfs3") > 0) { SetValue (configMap[L"MountNtfsWithNtfs3"], DefaultMountOptions.MountNtfsWithNtfs3); configMap.erase (L"MountNtfsWithNtfs3"); }
+ if (configMap.count(L"MountNtfsWithKernelDriver") > 0) { SetValue (configMap[L"MountNtfsWithKernelDriver"], DefaultMountOptions.MountNtfsWithKernelDriver); configMap.erase (L"MountNtfsWithKernelDriver"); }
+ else if (configMap.count(L"MountNtfsWithNtfs3") > 0) { SetValue (configMap[L"MountNtfsWithNtfs3"], DefaultMountOptions.MountNtfsWithKernelDriver); }
+ configMap.erase (L"MountNtfsWithNtfs3");
#endif
if (configMap.count(L"MountVolumesRemovable") > 0) { SetValue (configMap[L"MountVolumesRemovable"], DefaultMountOptions.Removable); configMap.erase (L"MountVolumesRemovable"); }
if (configMap.count(L"NoHardwareCrypto") > 0) { SetValue (configMap[L"NoHardwareCrypto"], DefaultMountOptions.NoHardwareCrypto); configMap.erase (L"NoHardwareCrypto"); }
@@ -225,7 +227,7 @@ namespace VeraCrypt
TC_CONFIG_ADD (MountFavoritesOnLogon);
formatter.AddEntry (L"MountVolumesReadOnly", DefaultMountOptions.Protection == VolumeProtection::ReadOnly);
#ifdef TC_LINUX
- formatter.AddEntry (L"MountNtfsWithNtfs3", DefaultMountOptions.MountNtfsWithNtfs3);
+ formatter.AddEntry (L"MountNtfsWithKernelDriver", DefaultMountOptions.MountNtfsWithKernelDriver);
#endif
formatter.AddEntry (L"MountVolumesRemovable", DefaultMountOptions.Removable);
formatter.AddEntry (L"NoHardwareCrypto", DefaultMountOptions.NoHardwareCrypto);