Automatic mount of encrypted external harddrives

Question

I have encrypted my external harddrives using cryptsetup and a key file. My goal is now to automatically decrypt and mount them upon plugin. I used to do so using this blog post (unfortunately in German). This used to work on my old Ubuntu 16.04 machine, but since I upgraded to Focal this does not work anymore. What I have done specifically is:

1. Added /dev/mapper/extdrive /mnt/extdrive xfs defaults,noauto 0 2 to /etc/fstab.
2. Added ACTION=="add", SUBSYSTEM=="block", ENV{DEVTYPE}=="partition", ATTRS{serial}=="123456789", RUN+="/sbin/cryptsetup --key-file /root/.kf luksOpen $env{DEVNAME} extdrive" to /etc/udev/rules.d/85-extdrive.rules
3. Added ACTION=="add|change", SUBSYSTEM=="block", ENV{DM_NAME}=="extdrive", RUN+="/bin/mount /dev/mapper/$env{DM_NAME}" to /etc/udev/rules.d/85-extdrive.rules

It seems like the drive is opened via luksOpen but is not mounted, i.e., the "add|change" rule does not fire. How can I figure out why the automount fails? If I execute the respective commands manually, all seems fine. Bonus: Why did this approach used to work in 16.04 but does not anymore in 20.04?

Thank you!

Answer 1

mount won't work in UDev rules because UDev runs with its own mount namespace. You need to use systemd-mount instead, see this arch wiki article for details.

From udev manpage:

Note that running programs that access the network or mount/unmount filesystems is not allowed inside of udev rules, due to the default sandbox that is enforced on systemd-udevd.service.

This is relatively new change (about 3 years ago I think) so I guess this was not yet present in 16.04 .