Open a LUKS volume as a non-root user?

Question

I'm using cryptsetup to create a LUKS file-based device to stash information in:

# create a file as a container
dd if=/dev/zero of=zulu.bin bs=1024 count=102400
# create a key
dd if=/dev/urandom bs=1 count=8192 2>/dev/null | \
  base64 | \
  cut -b 1-8192 | \
  tr -d '\n' | \
  gpg2 --output zulu-key.gpg -aser DEADBEEF
# format the file-based "device"
gpg2 --decrypt zulu-key.gpg | \
  cryptsetup luksFormat --iter-time=10000 --hash sha256 \
    --cipher aes-cbc-essiv:sha256 --key-size 256 --key-file - \
    zulu.bin

There are a lot of things less than optimal here, namely block-device encryption provides no cryptographic authentication, etc.

In any case, I cannot open this device as a non-root user:

$ gpg2 --decrypt zulu-key.gpg | \
    cryptsetup open -d - zulu.bin zulu
Cannot initialize device-mapper, running as non-root user.

What I essentially need is an entire filesystem that is encrypted but stored in a file. I need to be able to open and close this encrypted filesystem at will and without elevated privileges.

I have thought about simply creating a tmpfs or ramfs and then simply dding the "device" directly piped into GnuPG and then I'd get GnuPG's encryption, authentication, and non-repudiation, but I'm not sure if this will work.

Is there a good known way to allocate a filesystem of an arbitrary size as a file that is encrypted at rest via GnuPG, can be opened into RAM, and then can be again piped into GnuPG for encryption to take the device offline again? Is it possible to do this as a normal user using FUSE?

---

My use case is needing an arbitrarily sized filesystem which is encrypted so that programs writing files to said filesystem need not know about encryption at all; GnuPG would handle the encryption when "closing" the device and writing ciphertext to disk as a file.

Answer 1

Create a blank image and folder in your home folder:

cd
dd if=/dev/zero of=zulu.bin bs=1024 count=102400
mkdir myvault

Add the following to /etc/cryptmount/cmtab:

LUKS {
    keyformat=luks
    dev=/home/user/zulu.bin  keyfile=/home/user/zulu.bin
    dir=/home/user/myvault/       fstype=ext2
}

As root, run the following:

cryptmount --generate-key 32 LUKS
cryptmount --prepare LUKS
mke2fs /dev/mapper/LUKS
cryptmount --release LUKS

Now a user can mount the image by typing

cryptmount LUKS

and unmount by typing

cryptmount -u LUKS

By using chown/chgrp/chmod, you should be able to prevent other users from myvault.

Not sure how to bring GPG2 into this but according to the cryptmount manpage, it is possible to specify a keyfile and cipher in the cmtab file.