On Debian 8.3 I want to mount an encrypted container /usr/local/share/test.img with pam_mount at login at the mountpoint /home/test (which is owned by test, of course). The LUKS encrypted disk image test.img has the same password as the login password of the user test.

This is my /etc/security/pam_mount.conf.xml:

<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE pam_mount SYSTEM "pam_mount.conf.xml.dtd">
<debug enable="0" />

<volume user="test" fstype="crypt" path="/usr/local/share/test.img" mount="/home/test" />
<mntoptions allow="nosuid,nodev,loop,encryption,fsck,nonempty,allow_root,allow_other" />
<mntoptions require="nosuid,nodev" />
<logout wait="0" hup="0" term="0" kill="0" />
<mkmountpoint enable="1" remove="true" />
<cryptmount>mount.crypt %(VOLUME) %(MNTPT)</cryptmount>
<cryptumount>umount.crypt %(MNTPT)</cryptumount>

Strangely, I had to add to /etc/fstab the line:

/usr/local/share/test.img /home/test crypt   user,noauto     0       0

Otherwise pam_mount complains that it can't find it in fstab!?

It works as it should except one problem: /home/test becomes owned by root and is not writable by the user test!

Adding noroot="1" doesn't work, too, pam_mount the complains that it can't set up the loopback device for the encrypted container.

How do I mount /home/test with pam_mount so that it is owned by test?


I've changed the last line in /etc/fstab to:

/usr/local/share/test.img /home/test crypt   user,noauto,uid=1000     0       0

1000 is the uid of the user test.

And added uid to the allowed options in /etc/security/pam_mount.conf.xml:

<mntoptions allow="nosuid,uid,nodev,loop,encryption,fsck,nonempty,allow_root,allow_other" />

Now it works. But it's not clear to me why.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.