1

When an encrypted directory is mounted using EncFS as a regular user, you cannot execute a script in it with sudo (as root):

$ sudo /run/media/yeti/usbdrive/encfs/test.sh
sudo: /run/media/yeti/usbdrive/encfs/test.sh: command not found

This is a security feature, but how can I still grant root permissions to this mounted directory (without mounting as root)?

More details

I am using Arch Linux, and I have an encrypted directory using EncFS:

sudo pacman -S encfs
usbpath="/run/media/yeti/usbdrive"
encfs "$usbpath/.encfs" "$usbpath/encfs"
echo 'echo hello world' > "$usbpath/encfs/test.sh"
sudo chmod +x "$usbpath/encfs/test.sh"

Then this command works just like expected:

$ /run/media/yeti/usbdrive/encfs/test.sh
hello world

But when I use sudo, I get an error:

$ sudo /run/media/yeti/usbdrive/encfs/test.sh
sudo: /run/media/yeti/usbdrive/encfs/test.sh: command not found

Then I realized that this is a security feature of EncFS, which is actually quite good. When I do a directory listing as root (after su), I find the following:

$ ls /run/media/yeti/usbdrive/encfs/
ls: cannot access '/run/media/yeti/usbdrive/encfs': Permission denied
[...]
d?????????? ? ?    ?        ?            ?  encfs
drwxrwxrwx  1 yeti yeti     0 Sep 30 00:31  .encfs
[...]

But in my case, I am on a system where I am in fact root, and where sudo could be passwordless. Therefore, this security feature is only getting in the way. However, I do not want to mount the encrypted directory as root either (because then I'd need to run my filemanager and other applications as root too).

What I did as a workaround to this problem is to copy the file outside of the encrypted directory (cp "$usbpath/encfs/test.sh" /tmp/test.sh), and then execute it as root (sudo /tmp/test.sh).

Next to documenting this question for other people who may experience the same issue, the question I still have left is: Is there a better way to do this?

2

Encfs uses fuse under the hood. It includes an -o option to pass options to fuse. Adding -o allow_root will allow root to access the filesystem in addition to the user mounting (also note the similar but exclusive allow_others flag). To use this option, you will need to enable it in fuse config. In /etc/fuse.conf, add the user_allow_other directive

See mount.fuse(8) and encfs(1)

  • 1
    Thank you, adding user_allow_other to /etc/fuse.conf and then using encfs -o allow_root works. – Yeti Sep 30 '17 at 20:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.