QNAP eCryptFS Filesystem Broken Permissions

Question

Following an issue with my QNAP device I've had to do a whole load of manual recovery of data and only getting at my encrypted data remains.

It seems that QNAP use eCryptFS to do this. I've managed to set-up the passphrase (with ecryptfs-add-passphrase --fnek) and mounted the filesystem with:

mount /mnt/md3/.__eN__securedocs/ /mnt/md3/documents/Secure/ -t ecryptfs \
  -o rw,ecryptfs_sig=b04b010ba4c32521,ecryptfs_fnek_sig=4f23065f483e5b1c,ecryptfs_unlink_sigs,relatime,ecryptfs_cipher=aes,ecryptfs_key_bytes=32

I can see my files but the permissions are in a state I've never seen before making them impossible to interact with, not even enough to copy:

[~] # ll /mnt/md3/documents/Secure/                                                                                                                                                                                          
/bin/ls: cannot access /mnt/md3/documents/Secure/battle.net.txt: No such file or directory
/bin/ls: cannot access /mnt/md3/documents/Secure/steam.txt: No such file or directory
/bin/ls: cannot access /mnt/md3/documents/Secure/Work: No such file or directory
/bin/ls: cannot access /mnt/md3/documents/Secure/Passport Application Declaration.pdf: No such file or directory
/bin/ls: cannot access /mnt/md3/documents/Secure/Bills: No such file or directory
/bin/ls: cannot access /mnt/md3/documents/Secure/Car: No such file or directory
/bin/ls: cannot access /mnt/md3/documents/Secure/Receipts: No such file or directory
/bin/ls: cannot access /mnt/md3/documents/Secure/.DS_Store: No such file or directory
/bin/ls: cannot access /mnt/md3/documents/Secure/._.DS_Store: No such file or directory
/bin/ls: cannot access /mnt/md3/documents/Secure/House: No such file or directory
/bin/ls: cannot access /mnt/md3/documents/Secure/Banking: No such file or directory
/bin/ls: cannot access /mnt/md3/documents/Secure/hmpo_reminder_2016_02_25.pdf: No such file or directory
/bin/ls: cannot access /mnt/md3/documents/Secure/hmrc_tax_code_2017_2018.pdf: No such file or directory
/bin/ls: cannot access /mnt/md3/documents/Secure/hmrc_tax_refund_2016_2017_full.pdf: No such file or directory
/bin/ls: cannot access /mnt/md3/documents/Secure/hmrc_tax_refund_2016_2017.pdf: No such file or directory
/bin/ls: cannot access /mnt/md3/documents/Secure/2017_11_26_disclosure_scotland_details.pdf: No such file or directory
/bin/ls: cannot access /mnt/md3/documents/Secure/2017_11_29_disclosure_scotland_basic_disclosure.pdf: No such file or directory
/bin/ls: cannot access /mnt/md3/documents/Secure/passport_scan.pdf: No such file or directory
total 12K
drwxrwxrwx 10 admin administrators 4.0K Feb 13 10:21 ./
drwxrwxrwx  9 admin administrators 4.0K Feb 13 09:53 ../
-?????????  ? ?     ?                 ?            ? .DS_Store
-?????????  ? ?     ?                 ?            ? ._.DS_Store
drwxr-xr-x  2 admin administrators 4.0K Apr  9  2017 .digest/
-?????????  ? ?     ?                 ?            ? 2017_11_26_disclosure_scotland_details.pdf
-?????????  ? ?     ?                 ?            ? 2017_11_29_disclosure_scotland_basic_disclosure.pdf
d?????????  ? ?     ?                 ?            ? Banking/
d?????????  ? ?     ?                 ?            ? Bills/
d?????????  ? ?     ?                 ?            ? Car/
d?????????  ? ?     ?                 ?            ? House/
-?????????  ? ?     ?                 ?            ? Passport Application Declaration.pdf
d?????????  ? ?     ?                 ?            ? Receipts/
d?????????  ? ?     ?                 ?            ? Work/
-?????????  ? ?     ?                 ?            ? battle.net.txt
-?????????  ? ?     ?                 ?            ? hmpo_reminder_2016_02_25.pdf
-?????????  ? ?     ?                 ?            ? hmrc_tax_code_2017_2018.pdf
-?????????  ? ?     ?                 ?            ? hmrc_tax_refund_2016_2017.pdf
-?????????  ? ?     ?                 ?            ? hmrc_tax_refund_2016_2017_full.pdf
-?????????  ? ?     ?                 ?            ? passport_scan.pdf
-?????????  ? ?     ?                 ?            ? steam.txt

Other posts on the net say this is caused by the containing directory not having execute permission but as can be seen in the snippet above that this is not the cause here as the execute permission is present.

Any thoughts on how to overcome this last hurdle?

Answer 1

None of those directories have the execute permission. According to the information you have provided you have attempted to mount the directory as rw and ro. You will need to mount the file system as rwx. However, your issue could be due to how the file system permissions were mangled by the data recovery.

It appears other people who have your issue are using QNAP in a Windows Active Directory environment. This forum post involves this issue and could shed a little light if your environment is tied to a Windows Active Directory. This is another post involving Windows. I have also found this post. Not sure if they are applicable but they come up when searching about your issue.

I am referencing the Arch Linux Wiki on ecryptfs and the Arch Linux Wiki on NTFS mounting. Here is links to the QNAP Wiki on subfolder permissions and the Data Recovery Categories. These should also help provide more information on how to troubleshoot your issue.

Re-mount your File System and Fix Permissions

I would start all over. Reboot and remount your systems. If the mount command worked before to allow you to successful decrypt your file system and mount you then need to change permissions of the directory as root(sudo) to:

chmod go= [root directory name]

You can also try to manually mount the ecryptfs using the wrapper:

ecryptfs-mount-private Path/To/File/System

Again chmod could help after this step too if permissions continue to be missing. You will be prompted for the mount password for your ecryptfs with the above command.

If you can comment with any additional issues you are having I can update with answer with more relevant solutions. I believe that your issue could be tied to a mangled data recovery (to solve you will need to follow a guide on how QNAP recommends you do data recovery) or it could be related to NFS or NTFS access control list settings preventing proper permissions. This should only be related if your environment is also tied to Windows. If anyone has any corrections to add, I would greatly appreciate it. Best of Luck!

Answer 2

I had a similar problem due to defective hardware, but it wasn't on a QNAP so it might not apply.

However, I do remember the same weird ls output.

What I did was simply to mount the partition as read/write, then force both ownership and permissions. I remember having to do that twice, but I don't recall the reason (perhaps I mistyped something).

chmod -R a+rwx /mnt/md3/documents/Secure
chown -R admin:administrators /mnt/md3/documents/Secure

I also had some troubles with ACLs, solved the same way.

Luckily it was a document partition and I was in no hurry, I just couldn't be bothered to do a slow restore from backups.

You can try with one file or one directory and see whether this applies.

Assuming that the mount and fsck went okay, this means that your data should be useable. However, perform a backup of the unmounted encrypted container and, if at all possible, mount and experiment on the copy.

After recovery, get all the files safe on a backup disk, run a complete factory restore on the QNAP (probably removing the disks, formatting them and placing them back in is enough - the QNAP should reinitialise them on its own. I know that Synology and Terastore units do), then put the files back in. This way you'll know that you can trust the QNAP filesystem again.