2

It seems I am trying to do the same as the user who asked this question: Unlock LUKS partition using keyfile without root access?

The answer from frostschutz explains that this is impossible. I am hoping to understand the alternatives in more detail.

  • udisksctl works without root access, using udiskctl loop-setup followed by udiskctl unlock (I tested it). How does it work around not having root access? [Not admitting keyfiles is a major drawback anyway, but it would still be helpful to know.]
  • cryptmount http://cryptmount.sourceforge.net/ looks like it might work but it's also unclear to me how cryptmount works around not having root access. Moreover, I prefer to minimize extra packages where possible, particularly cryptographic ones.
  • GPG-encrypted tar, as explained by frostschutz, would be a sensible alternative, but I'd hope to make LUKS work.
  • Are there any other options I haven't considered? Fiddling with udev/sudoers?
  • You're referring to en.wikipedia.org/wiki/Setuid binaries - you effectively are using root access with those. – frostschutz Apr 14 '15 at 19:47
  • i.e. udiskctl and cryptmount both use setuid under the hood? – SauceCode Apr 14 '15 at 20:13
  • Do you have assess to root (or can you ask your admin), to set things up? There will be tools that can do it, but need root for at least the install. (if they need special privileges, then there is no way to install without root access. ) – ctrl-alt-delor Apr 14 '15 at 20:18
  • Yes, I have access to root for the purpose of setting things up. – SauceCode Apr 14 '15 at 20:45
  • @SauceCode udisks is not setuid root, but it communicates with a service daemon over dbus which runs as root, and it's that daemon that does the real work. cryptmount, I don't know about — it may or may not be setuid. – Celada Apr 14 '15 at 21:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.