Bug 467083 - Warn about CryFS's memory needs or rethink using it as the default backend
Summary: Warn about CryFS's memory needs or rethink using it as the default backend
Status: RESOLVED FIXED
Alias: None
Product: plasmashell
Classification: Plasma
Component: Vaults widget (other bugs)
Version First Reported In: 6.0.0
Platform: Neon Linux
: NOR wishlist
Target Milestone: 1.0
Assignee: Plasma Bugs List
URL:
Keywords: usability
Depends on:
Blocks:
 
Reported: 2023-03-08 22:47 UTC by Riccardo Robecchi
Modified: 2025-05-14 13:33 UTC (History)
3 users (show)

See Also:
Latest Commit:
Version Fixed/Implemented In: 6.4.0
Sentry Crash Report:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Riccardo Robecchi 2023-03-08 22:47:28 UTC
SUMMARY
I have a system with 16 GiB of RAM. I just found myself with 13 GB used and I tried to open a vault. The whole system crashed because it ran out of memory. Considering the vault is just a few kilobytes (it only stores a few .txt files), I do not think such high memory requirements are justified.

STEPS TO REPRODUCE
1. Try to open a Plasma vault

OBSERVED RESULT
If you have less than 4 GB of free RAM, the system starts closing down applications, potentially ending the whole session.

EXPECTED RESULT
The vault is opened even in low-memory situations or, if this is not possible, the user is alerted that there is not enough free memory.

SOFTWARE/OS VERSIONS
Linux: KDE neon
KDE Plasma Version: 5.27.1
KDE Frameworks Version: 5.103.0
Qt Version: 5.15.8

ADDITIONAL INFORMATION
Comment 1 Nate Graham 2023-03-13 18:43:46 UTC
What encryption backend is your vault using?

What process exactly uses up all the memory when you unlock the vault?
Comment 2 Riccardo Robecchi 2023-03-14 09:34:06 UTC
(In reply to Nate Graham from comment #1)
> What encryption backend is your vault using?
> 
> What process exactly uses up all the memory when you unlock the vault?

I'm using cryfs. I've just tested this, and it's the cryfs process taking up all the memory. It seems like this is intentional: https://github.com/cryfs/cryfs/issues/335#issuecomment-652338744
Cryfs is currently the default (it's the first on the list) when creating a new vault. It would be good to inform the user of this limitation, as it seems like it is intentionally made to use 4 GB of RAM: this makes it impossible to use it on devices with 4 GB of RAM or less.
From my limited testing, gocryptfs appears to use a lot less memory while providing similar (if not even better) performance.
Comment 3 Ivan Čukić 2023-03-14 10:18:22 UTC
Thanks for reporting this. I guess it is time to rethink the backends and whether to have a default... I like cryfs security-wise, but it was a pain point for a few times now...
Comment 4 medin 2025-05-14 10:36:35 UTC
cryfs slow browsing is still a problem for Plasma 6.3.5, it can't even handle a small folder containing 10gb of data, gocryptfs is much faster, but I don't know if it's safer than cryfs.
Comment 5 Riccardo Robecchi 2025-05-14 11:30:16 UTC
(In reply to medin from comment #4)
> cryfs slow browsing is still a problem for Plasma 6.3.5, it can't even
> handle a small folder containing 10gb of data, gocryptfs is much faster, but
> I don't know if it's safer than cryfs.

It is as safe as cryfs, there are some differences in implementation that make it more or less suitable for the encryption of individual files and folders, but that is not an issue with Vaults. There is no practical downside to using it.
Comment 6 medin 2025-05-14 13:26:36 UTC
(In reply to Riccardo Robecchi from comment #5)
> (In reply to medin from comment #4)
> > cryfs slow browsing is still a problem for Plasma 6.3.5, it can't even
> > handle a small folder containing 10gb of data, gocryptfs is much faster, but
> > I don't know if it's safer than cryfs.
> 
> It is as safe as cryfs, there are some differences in implementation that
> make it more or less suitable for the encryption of individual files and
> folders, but that is not an issue with Vaults. There is no practical
> downside to using it.

I found this page https://www.cryfs.org/comparison
It seems that cryfs split the whole data and hides its structure and metadata which makes it more suitable for uploading to cloud storages.
But for local storage I think others are more suitable to adopt.
Comment 7 Nate Graham 2025-05-14 13:33:03 UTC
In Plasma 6.4, only Gocryptfs is supported for new vaults, effectively fixing this automatically. Cryfs and Encfs vaults created in the past can still be used, but new ones have to be Gocryptfs, and it wouldn't be a bad idea to migrate your old vault content to a new Gocryptfs fault, too.