I created an encrypted container via

dd if=/dev/zero of=$1 bs=1 count=0 seek=$2
MAPPER=$(mktemp -up /dev/mapper)
LOOPDEV=$(losetup --find --show $1)
cryptsetup luksFormat $LOOPDEV
cryptsetup luksOpen $LOOPDEV $(basename $MAPPER)
mkfs.ext3 $MAPPER
cryptsetup luksClose $MAPPER
losetup -d $LOOPDEV

i.e. a file e.g. container specified to this script will contain a ext3 filesystem encrypted via cryptsetup luksFormat.

To mount it, I currently use another script, say dm.mount container /mnt/decrypted:

set -e
MAPPER=$(mktemp -up /dev/mapper)
LOOPDEV=$(losetup --find --show $1)
cryptsetup luksOpen $LOOPDEV $(basename $MAPPER) || losetup -d $LOOPDEV
mount $MAPPER $2 || (
  cryptsetup luksClose $MAPPER
  losetup -d $LOOPDEV

and to unmount it dm.umount /mnt/decrypted:

set -e
MAPPER=$(basename $(mount | grep $1 | gawk ' { print $1 } '))
LOOPDEV=$(cryptsetup status $MAPPER | grep device | gawk ' { print $2 } ')
umount $1
cryptsetup luksClose $MAPPER
losetup -d $LOOPDEV

There's a lot of redundancy and manually grabbing a loop device and mapper both of which could remain anonymous. Is there a way to simply do something like mount -o luks ~/container /mnt/decrypted (prompting for the passphrase) and umount /mnt/decrypted the easy way instead?

edit Basically I am happy with my scripts above (although the error checking could be improved...), so

How can a mount option -o luks=~/container be implemented similar to -o loop ~/loopfile using the scripts I wrote?

Can this be achieved without rewriting mount? Or alternatively, could -t luks -o loop ~/container be implemented?

  • Have you tried cryptmount?
    – jw013
    Nov 6, 2012 at 18:12
  • @jw013 I haven't and it might have simplified things a bit, but it also doesn't natively support directly using mount Nov 6, 2012 at 20:27

2 Answers 2


In fact, modifying mount is possible, as I learned from the existence of mount.ntfs-3g. I'm doing only guesswork, but I suspect mount -t sometype results in a call to mount.sometype $DEV $MOUNTPOINT $OPTIONS, feel free to correct me here or quote some actual documentation. Especially the option -o loop is already treated so there's no need for lopsetup anymore...

Symlink/create the mount script as /sbin/mount.crypto_LUKS. Remove the loopdevice part and instead just use the -o loop switch. Here's my /sbin/mount.crypto_LUKS:

set -e
if [[ $(mount | grep ${2%%/} | wc -l) -gt 0 ]]; then
  echo "Path $2 is already mounted!" >&2
  exit 9
  MAPPER=$(mktemp -up /dev/mapper)
  cryptsetup luksOpen $1 $(basename $MAPPER)
  mount $MAPPER $* || cryptsetup luksClose $(basename $MAPPER)

Now I just have to run mount -o loop ~/container /mnt/decrypted, and mount will prompt me for the password and then mount the container, automatically releasing the loopdevice once the container is closed. If the decrypted filesystem fails to mount, the container will be closed again, but you can modify that of course. Or implement some option parsing instead of passing everything on to mount.

I was hoping the same could be achieved via /sbin/umount.luks, but umount /mnt/decrypted (even with -t crypto_LUKS) still only does the usual unmount, leaving the container open. If you find a way to have umount call my dm.umount script instead, please let me know... At the moment, directly calling umount is discouraged since you will have to figure out the /dev/mapper name to manually cryptsetup luksClose $MAPPER. At least the loop device will be release automatically if mount -o loop was used before...


pam_mount, available from sourceforge, ships with a helpful mount.crypto_LUKS and umount.crypto_LUKS which overcome some of the shortcomings of the script provided by the other poster.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .