Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm running Arch Linux and am trying to setup an encrypted folder with eCryptFS. I've followed the tutorial on Arch's Wiki for manual installation, it's actually working. The problem occurs when I try to automount this directory on boot time.

I have this entry in my /etc/fstab:

/home/henrique/.secret /home/henrique/secret ecryptfs user,rw,nosuid,nodev,relatime,ecryptfs_fnek_sig=5fe512dc3ad6af7e,ecryptfs_sig=e7a764a16f23b1e4,ecryptfs_cipher=aes,ecryptfs_key_bytes=16,ecryptfs_unlink_sigs  0 0

When booting, I obtain this in my journal:

Jun 08 01:45:15 henrique-pc kernel: Key type trusted registered
Jun 08 01:45:15 henrique-pc kernel: sha256_ssse3: Using AVX optimized SHA-256 implementation
Jun 08 01:45:15 henrique-pc kernel: Key type encrypted registered
Jun 08 01:45:15 henrique-pc mount.ecryptfs[595]: Key module [openssl] does not have a subgraph transition node; attempting to build a linear subgraph from its parameter list
Jun 08 01:45:15 henrique-pc mount.ecryptfs[595]: Key module [openssl] has empty parameter list
Jun 08 01:45:15 henrique-pc mount[594]: Select key type to use for newly created files:
Jun 08 01:45:15 henrique-pc mount[594]: 1) passphrase
Jun 08 01:45:15 henrique-pc mount[594]: 2) openssl
Jun 08 01:45:15 henrique-pc mount[594]: Selection: Error attempting to evaluate mount options: [-5] Input/output error
Jun 08 01:45:15 henrique-pc mount[594]: Check your system logs for details on why this happened.
Jun 08 01:45:15 henrique-pc mount[594]: Try updating your ecryptfs-utils package, and/or
Jun 08 01:45:15 henrique-pc mount[594]: submit a bug report on https://bugs.launchpad.net/ecryptfs
Jun 08 01:45:15 henrique-pc systemd[1]: home-henrique-secret.mount mount process exited, code=exited status=251
Jun 08 01:45:15 henrique-pc systemd[1]: Failed to mount /home/henrique/secret.
-- Subject: Unit home-henrique-secret.mount has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- Unit home-henrique-secret.mount has failed.
-- 
-- The result is failed.
Jun 08 01:45:15 henrique-pc systemd[1]: Dependency failed for Local File Systems.
-- Subject: Unit local-fs.target has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- Unit local-fs.target has failed.
-- 
-- The result is dependency.
Jun 08 01:45:15 henrique-pc systemd[1]: Triggering OnFailure= dependencies of local-fs.target.
Jun 08 01:45:15 henrique-pc systemd[1]: Unit home-henrique-secret.mount entered failed state.
Jun 08 01:45:15 henrique-pc systemd[1]: Closed CUPS Printing Service Sockets.
-- Subject: Unit cups.socket has finished shutting down
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel

I've configured my /etc/security/pam_mount.conf.xml just as the tutorial says so:

<luserconf name=".pam_mount.conf.xml" />
<mntoptions require="" /> 
<lclmount>mount -i %(VOLUME) "%(before=\"-o\" OPTIONS)"</lclmount> 

Here is the systemctl status of this process. I think it's strange that the mount script doesn't use the -i option that I've declared in my /etc/security/pam_mount.conf.xml:

‚óŹ home-henrique-secret.mount - /home/henrique/secret
   Loaded: loaded (/etc/fstab)
   Active: failed (Result: exit-code) since Dom 2014-06-08 02:11:24 BRT; 1min 42s ago
    Where: /home/henrique/secret
     What: /home/henrique/.secret
     Docs: man:fstab(5)
           man:systemd-fstab-generator(8)
  Process: 433 ExecMount=/bin/mount /home/henrique/.secret /home/henrique/secret -t ecryptfs -o user,rw,nosuid,nodev,relatime,ecryptfs_fnek_sig=5fe512dc3ad6af7e,ecryptfs_sig=e7a764a16f23b1e4,ecryptfs_cipher=aes,ecryptfs_key_bytes=16,ecryptfs_unlink_sigs (code=exited, status=251)[/b]

[b]Jun 08 02:11:24 henrique-pc mount[433]: Select key type to use for newly created files:
Jun 08 02:11:24 henrique-pc mount[433]: 1) passphrase
Jun 08 02:11:24 henrique-pc mount[433]: 2) openssl
Jun 08 02:11:24 henrique-pc mount[433]: Selection: Error attempting to evaluate mount options: [-5] Input/output error
Jun 08 02:11:24 henrique-pc mount[433]: Check your system logs for details on why this happened.
Jun 08 02:11:24 henrique-pc mount[433]: Try updating your ecryptfs-utils package, and/or
Jun 08 02:11:24 henrique-pc mount[433]: submit a bug report on [url]https://bugs.launchpad.net/ecryptfs[/url]
Jun 08 02:11:24 henrique-pc systemd[1]: home-henrique-secret.mount mount process exited, code=exited status=251
Jun 08 02:11:24 henrique-pc systemd[1]: Failed to mount /home/henrique/secret.
Jun 08 02:11:24 henrique-pc systemd[1]: Unit home-henrique-secret.mount entered failed state.

The problem, I think, is that my keyring is empty, but I'm not prompted to enter a passphrase. Although, I really shouldn't be prompted and the passphrase should be loaded with this script:

#!/bin/sh
#
#    /usr/local/bin/doecryptfs

exit $(/usr/sbin/pmvarrun -u$PAM_USER -o0)

I've configured the files system-auth, login and gdm inside the /etc/pam.d directory with this:

auth    [success=ignore default=1]    pam_exec.so     quiet /usr/local/bin/doecryptfs

But it doesn't work.

Another important thing: It seems like the $PAM_USER variable is never set, so this probably makes the script fail.

In order to mount this folder, I need to login first (without the entry in /etc/fstab), add the passphrases to my keyring and only after that, I can't mount it using mount.ecryptfs_private command.

The tutorial is kind of confusing. I'm not sure if I didn't screw it up at some point.

share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.