I'm running Arch Linux and am trying to setup an encrypted folder with eCryptFS. I've followed the tutorial on Arch's Wiki for manual installation, it's actually working. The problem occurs when I try to automount this directory on boot time.
I have this entry in my /etc/fstab:
/home/henrique/.secret /home/henrique/secret ecryptfs user,rw,nosuid,nodev,relatime,ecryptfs_fnek_sig=5fe512dc3ad6af7e,ecryptfs_sig=e7a764a16f23b1e4,ecryptfs_cipher=aes,ecryptfs_key_bytes=16,ecryptfs_unlink_sigs 0 0
When booting, I obtain this in my journal:
Jun 08 01:45:15 henrique-pc kernel: Key type trusted registered
Jun 08 01:45:15 henrique-pc kernel: sha256_ssse3: Using AVX optimized SHA-256 implementation
Jun 08 01:45:15 henrique-pc kernel: Key type encrypted registered
Jun 08 01:45:15 henrique-pc mount.ecryptfs[595]: Key module [openssl] does not have a subgraph transition node; attempting to build a linear subgraph from its parameter list
Jun 08 01:45:15 henrique-pc mount.ecryptfs[595]: Key module [openssl] has empty parameter list
Jun 08 01:45:15 henrique-pc mount[594]: Select key type to use for newly created files:
Jun 08 01:45:15 henrique-pc mount[594]: 1) passphrase
Jun 08 01:45:15 henrique-pc mount[594]: 2) openssl
Jun 08 01:45:15 henrique-pc mount[594]: Selection: Error attempting to evaluate mount options: [-5] Input/output error
Jun 08 01:45:15 henrique-pc mount[594]: Check your system logs for details on why this happened.
Jun 08 01:45:15 henrique-pc mount[594]: Try updating your ecryptfs-utils package, and/or
Jun 08 01:45:15 henrique-pc mount[594]: submit a bug report on https://bugs.launchpad.net/ecryptfs
Jun 08 01:45:15 henrique-pc systemd[1]: home-henrique-secret.mount mount process exited, code=exited status=251
Jun 08 01:45:15 henrique-pc systemd[1]: Failed to mount /home/henrique/secret.
-- Subject: Unit home-henrique-secret.mount has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit home-henrique-secret.mount has failed.
--
-- The result is failed.
Jun 08 01:45:15 henrique-pc systemd[1]: Dependency failed for Local File Systems.
-- Subject: Unit local-fs.target has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit local-fs.target has failed.
--
-- The result is dependency.
Jun 08 01:45:15 henrique-pc systemd[1]: Triggering OnFailure= dependencies of local-fs.target.
Jun 08 01:45:15 henrique-pc systemd[1]: Unit home-henrique-secret.mount entered failed state.
Jun 08 01:45:15 henrique-pc systemd[1]: Closed CUPS Printing Service Sockets.
-- Subject: Unit cups.socket has finished shutting down
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
I've configured my /etc/security/pam_mount.conf.xml just as the tutorial says so:
<luserconf name=".pam_mount.conf.xml" />
<mntoptions require="" />
<lclmount>mount -i %(VOLUME) "%(before=\"-o\" OPTIONS)"</lclmount>
Here is the systemctl status of this process. I think it's strange that the mount script doesn't use the -i option that I've declared in my /etc/security/pam_mount.conf.xml:
● home-henrique-secret.mount - /home/henrique/secret
Loaded: loaded (/etc/fstab)
Active: failed (Result: exit-code) since Dom 2014-06-08 02:11:24 BRT; 1min 42s ago
Where: /home/henrique/secret
What: /home/henrique/.secret
Docs: man:fstab(5)
man:systemd-fstab-generator(8)
Process: 433 ExecMount=/bin/mount /home/henrique/.secret /home/henrique/secret -t ecryptfs -o user,rw,nosuid,nodev,relatime,ecryptfs_fnek_sig=5fe512dc3ad6af7e,ecryptfs_sig=e7a764a16f23b1e4,ecryptfs_cipher=aes,ecryptfs_key_bytes=16,ecryptfs_unlink_sigs (code=exited, status=251)[/b]
[b]Jun 08 02:11:24 henrique-pc mount[433]: Select key type to use for newly created files:
Jun 08 02:11:24 henrique-pc mount[433]: 1) passphrase
Jun 08 02:11:24 henrique-pc mount[433]: 2) openssl
Jun 08 02:11:24 henrique-pc mount[433]: Selection: Error attempting to evaluate mount options: [-5] Input/output error
Jun 08 02:11:24 henrique-pc mount[433]: Check your system logs for details on why this happened.
Jun 08 02:11:24 henrique-pc mount[433]: Try updating your ecryptfs-utils package, and/or
Jun 08 02:11:24 henrique-pc mount[433]: submit a bug report on [url]https://bugs.launchpad.net/ecryptfs[/url]
Jun 08 02:11:24 henrique-pc systemd[1]: home-henrique-secret.mount mount process exited, code=exited status=251
Jun 08 02:11:24 henrique-pc systemd[1]: Failed to mount /home/henrique/secret.
Jun 08 02:11:24 henrique-pc systemd[1]: Unit home-henrique-secret.mount entered failed state.
The problem, I think, is that my keyring is empty, but I'm not prompted to enter a passphrase. Although, I really shouldn't be prompted and the passphrase should be loaded with this script:
#!/bin/sh
#
# /usr/local/bin/doecryptfs
exit $(/usr/sbin/pmvarrun -u$PAM_USER -o0)
I've configured the files system-auth, login and gdm inside the /etc/pam.d directory with this:
auth [success=ignore default=1] pam_exec.so quiet /usr/local/bin/doecryptfs
But it doesn't work.
Another important thing: It seems like the $PAM_USER variable is never set, so this probably makes the script fail.
In order to mount this folder, I need to login first (without the entry in /etc/fstab), add the passphrases to my keyring and only after that, I can't mount it using mount.ecryptfs_private command.
The tutorial is kind of confusing. I'm not sure if I didn't screw it up at some point.
