I wrote a new udev rule to create a symlink to a luks-encrypted partition on a USB flash drive when the drive is plugged in. The new udev rule I wrote does create the symlink to the USB drive's partition that is luks-encrypted. But, when run 'cryptsetup luksOpen' specifying the symlink to get the /dev/mapper/ object that I can then mount the ext4 filesystem, the symlink disappears as soon as the cryptsetup command has ended. That is not expected and I want the symlink to remain until the USB drive is ejected.
The udev rule:
SUBSYSTEM!="block", GOTO="usb_luks_rules_end"
ENV{DEVTYPE}!="partition", GOTO="usb_luks_rules_end"
ACTION=="add", ENV{ID_FS_TYPE}=="crypto_LUKS", SYMLINK+="myusbluks"
LABEL="usb_luks_rules_end"
I start with the drive unplugged and therefore no symlink:
# ls /dev/my*
ls: cannot access /dev/my*: No such file or directory
I plug in the usb flash drive that has one luksFormat-ed partition on it. Inside the encrypted partition is an ext4 filesystem. The usb drive becomes /dev/sdc. I want my symlink to point at that partition so that I can 'cryptsetup luksOpen' the symlink name instead of specifying the unpredictable /dev/sdc1 name.
# ls -l /dev/my*
lrwxrwxrwx. 1 root root 4 Mar 24 15:51 /dev/myusbluks -> sdc1
The udev rule worked and created the symlink just like I expected. Now I run cryptsetup luksOpen on the symlink, and upon regaining control, the symlink is gone!
# cryptsetup luksOpen /dev/myusbluks cr_diskbackup
Enter passphrase for /dev/myusbluks: (I enter passphrase successfully.)
# ls -l /dev/my*
ls: cannot access /dev/my*: No such file or directory
# ls -l /dev/mapper/cr_diskbackup
lrwxrwxrwx. 1 root root 8 Mar 24 15:53 /dev/mapper/cr_diskbackup -> ../dm-92
# blkid /dev/mapper/cr_diskbackup
/dev/mapper/cr_diskbackup: LABEL="backupdisk1" UUID="54e2dfcb-20d9-4699-8f7c-0834fda1b4a6" TYPE="ext4"
# ls -l /dev/sdc1
brw-rw----. 1 root disk 8, 33 Mar 24 15:53 /dev/sdc1
# blkid /dev/sdc1
/dev/sdc1: UUID="dd5c374e-963f-4604-8ca3-d271a26abc90" TYPE="crypto_LUKS"
I certainly have accomplished one of the goals of using the symlink to cryptsetup luksOpen the drive instead of having to use "/dev/sdc1". But, I would like for the symlink to persist until the usb drive is physically unplugged.
I ran strace on the same command after another setup. I can see the symlink name being opened and stat-ed, but I do not see anything deleting the symlink in the cryptsetup strace.
The following is from "udevadm monitor" from the point when cryptsetup luksOpen is issued:
KERNEL[2064243.853683] change /devices/pci0000:00/0000:00:14.0/usb1/1-10/1-10.2/1-10.2:1.0/host29/target29:0:0/29:0:0:0/block/sdc/sdc1 (block)
KERNEL[2064243.854830] add /devices/virtual/bdi/253:92 (bdi)
KERNEL[2064243.855452] add /devices/virtual/block/dm-92 (block)
UDEV [2064243.856682] add /devices/virtual/bdi/253:92 (bdi)
KERNEL[2064243.856781] change /devices/virtual/block/dm-92 (block)
UDEV [2064243.858320] add /devices/virtual/block/dm-92 (block)
UDEV [2064243.897808] change /devices/pci0000:00/0000:00:14.0/usb1/1-10/1-10.2/1-10.2:1.0/host29/target29:0:0/29:0:0:0/block/sdc/sdc1 (block)
UDEV [2064244.124652] change /devices/virtual/block/dm-92 (block)
The fact that a "change" event is occurring is probably involved in this. I am not sure whether it is cryptsetup or device mapper that is causing that. But since /dev/sdc1 remains as a device after cryptsetup luksOpen completes, I do not understand why the symlink is not left alone so that it can continue to point at that same device. On the system where I am doing this, there can be other USB drives without a luks partition that might be plugged in. Thus, the desire for a symlink to the luks partition if it exists.
What am i missing here? Is a symlink to the base encrypted partition considered to be some kind of security problem if it has been opened and something is making sure such a symlink does not exist?