Encrypted File System actors

There are three types of users who can manage and use EFS keys:

Full or restricted access as root
The root access to the keys can be unlimited or limited. In either mode, it is not possible for root to simply su to a user and gain access to the user's encrypted file or keystore.
User keystore
The user keystore is managed automatically for most common operations. The efskeymgr command is used for maintenance tasks and advanced EFS use. Users can create encrypted files and directories with the efsmgr command. Key store management is integrated into most user admin commands. If a user is added to a group, then the user will automatically have access to the group keystore.

Parent topic: EFS Encrypted File System