Automatically suspend luks volume after delay

Question

Anyone have any ideas for how I can automatically do a luksSuspend on a luks volume after it's been unused for a certain amount of time. I was thinking of just scheduling a command with crontab or something, but I don't want it to suspend if I'm actually using the volume.

Answer 1

The intent of luksSetup is to be used when the device is still in use, but you want to temporarily lock all accesses to it until the passphrase is entered from an external source. Thus it doesn't make much sense to only call luksSetup when the device is unused: if it's unused, close it with luksClose.

There's no way to atomically enforce that the device is not in use and call luksSuspend. What you can do if you really want to suspend the device but only if it isn't in use is call luksSuspend, then check with fuser or lsof for any mounted file on the filesystem that's on the encrypted device; if the filesystem is in use, call luksResume immediately. That does have a small chance of requiring you to enter the passphrase.

To detect whether a filesystem is idle, I recommend to piggyback on an existing automounter such as autofs.

Answer 2

I've worked out a set of scripts that are working reasonably well, but still looking for other suggestions if anyone has any.

What I've done is to write one script that suspends the luks volume, one that sends a wall message, alerting all users (at terminals) that it's about to be suspended, and one that tells it to keep it open (by writing to a file at a reserved path in /var/run). I used cron to run the auto-suspend script every half hour, and the "alert" script 2 minutes before that (it only issues the alert if the volume is actually open). If anyone is interested in these scripts, I can post them, or at least more details about them.