Decrypt LUKS partition by a script in udev rules

Question

I am trying to decrypt a LUKS partition when I plug in an external HDD. Thus, I have configured the udev rules with the following:

ACTION=="add", KERNEL=="sdb1", SUBSYSTEM=="block", ATTR{size}=="1048576000", RUN+="/home/user/myfile.sh

myfile.sh script:

password=`su - user -c 'export DISPLAY=:0;kdialog --password "Decrypt HDD"'`
sleep 5
echo "$password" | cryptsetup luksOpen /dev/sdb1 backups
mount /dev/mapper/backups /media/backups/

The script read the password through kdialog, after decrypt the partition and mount it. If I run manually it works. The problem is that when I plug in the USB, the kdialog is launched but the /dev/sdb1 encrypted partition is not detected until the script has finished. Therefore the cryptsetup luksOpen and mount do not anything (because are launched before the encrypted partition is detected)...

The file with the udev rules is 90-crypt.rules in /etc/udev/rules.d

Answer 1

Finally I found the problem. With RUN you can not execute long programs/scripts. And the solution is create a service that run your script and use the rule SYSTEMD_WANTS with your service.

From man udev:

RUN{type} Add a program to the list of programs to be executed after processing all the rules for a specific event, depending on "type":

   "program"
       Execute an external program specified as the assigned value. If no absolute path is given, the program is expected to live in /lib/udev; otherwise, the absolute path must be specified.          

       This is the default if no type is specified.

   "builtin"
       As program, but use one of the built-in programs rather than an external one.

   The program name and following arguments are separated by spaces. Single quotes can be used to specify arguments with spaces.                                                                         

   This can only be used for very short-running foreground tasks. Running an event process for a long period of time may block all further events for this or a dependent device.                        

   Starting daemons or other long-running processes is not appropriate for udev; the forked processes, detached or not, will be unconditionally killed after the event handling has finished.            

   Note that running programs that access the network or mount/unmount filesystems is not allowed inside of udev rules, due to the default sandbox that is enforced on systemd-udevd.service.   

Solution:

Create a service in /etc/systemd/system/myservice.service>

[Unit]
Description=Auto backup

[Service]
ExecStart=/home/manu/Sysadmin/auto-backup.sh

And change the udev rule:

ACTION=="add", KERNEL=="sdb1", SUBSYSTEM=="block", ATTR{size}=="1048576000", ENV{SYSTEMD_WANTS}="myservice.service"