If you ran a program / script from the USB itself, you should be able to figure out what LUKS map/name and device it's on (or just tell the script the device or mapped name if you know it) and watch for when the device "disappears" when it's removed. Then unmount it.
I'm pretty sure that unplugging a USB will cause the device (
/dev/sdXn) to disappear, but in case it doesn't you'd have to watch
dmesg or look in the syslog, or find it somewhere in
Here's a proof-of-concept bash script that looks like it should work, but I don't have any LUKS partitions on usb's to test with, so I'm not sure if
umount might need options like
map=$( df --output=source $PWD |tail -n1 )
device=$( sudo cryptsetup status "$map" | grep -o "device:.*"|cut -d' ' -f 3 )
while [ -b "$device" ]
echo "Device $device is missing, unmounting"
sudo umount -v "$map"
If it's run from inside the mounted LUKS container,
$PWD should find the LUKS name it's mapped on, and then the device, and if the device stops being a block special file then unmount the mapped device.
PS If the device was mounted rw (writeable) the filesystem can be corrupted by suddenly unplugging it. FAT seems especially vulnerable, while a journaling filesystem should be more robust. If it's mounted ro (read-only) at least you could avoid that problem, mount accepts
-o ro and cryptsetup accepts
--readonly (both probably aren't necessary)