pmount cannot mount removable encrypted usb disk

Question

I am creating a mapper file /dev/mapper/luks-672dcc74-d002-47dc-b61b-525baf91dc7c on boot in /etc/crypttab like this:

luks-672dcc74-d002-47dc-b61b-525baf91dc7c UUID=672dcc74-d002-47dc-b61b-525baf91dc7c     /home/user1/keyfile_sandisk120gb luks,keyscript=/bin/cat

Output of lsblk is this:

sdd                                             8:48   1 114,6G  0 disk  
└─luks-672dcc74-d002-47dc-b61b-525baf91dc7c   253:2    0 114,6G  0 crypt 

Then when I run my backup script I use pmount like this:

pmount /dev/mapper/luks-672dcc74-d002-47dc-b61b-525baf91dc7c

But I get:

Error: device /dev/dm-2 is not removable

This normally mounts the ext4 partition to /media/disk_by-partlabel_sandisk120gb. When the disk (removable USB flash drive) was not encrypted everything worked fine. But now pmount does not understand that the encrypted disk is on a pen drive. Maybe I need to add an option to crypttab? I want to use pmount and not mount because pmount does not require root.

I am on debian bullseye.

Answer 1

You did not mention the name nor version of your Linux distribution, but at least on Debian 11, pmount is capable of detecting LUKS and invoking cryptsetup automatically, so you should not need an entry in /etc/crypttab for it (but then you cannot use a keyfile, which you seem to be doing here).

Before mounting a device, pmount will require that either the device to be mounted is removable, or that the device has been specifically whitelisted in /etc/pmount.allow. Adding a generic device-mapper device node like /dev/dm-2 to pmount whitelist is probably not a very good idea, as it might easily refer to some other device after a reboot.

The goal of pmount is to allow regular users to use removable media without root access. But in your case, since you have created a crypttab entry, root access is already involved. You might make a regular /etc/fstab entry with the user mount option:

/dev/mapper/luks-672dcc74-d002-47dc-b61b-525baf91dc7c /media/disk_by-partlabel_sandisk120gb ext4 user,rw 0 0

If your /bin/mount command is setuid root (i.e. is owned by root and has permissions -r-s--x--x or greater), the user option in /etc/fstab should authorize regular users to mount that specific mountpoint only by running

mount /media/disk_by-partlabel_sandisk120gb

and likewise unmount it by

umount /media/disk_by-partlabel_sandisk120gb

When using mount as a non-root user, it is important to specify only the mountpoint or the device name, not both. This triggers mount to use the pre-authorized entry in /etc/fstab.

If you specify both the device name and the mountpoint, the command will assume you are doing a fully custom/ad-hoc mount operation, which will always require root access.

Note that unlike pmount, mount will also require that /media/disk_by-partlabel_sandisk120gb exists as an empty directory, so that it can be used as a mount point.