1

Scenario

Have an external device, encrypted with LUKS, automatically mount when inserted and not cause any issues if not present on boot.

Most questions on this topic refer to mounting on boot - this is NOT what I am trying to do

Additionally, the mountpoint should be protected from accidental writes when the usb device is not present and I can do this with chattr +i <mountpoint>

Problem

  1. When the external device is NOT mounted, any attempt to access the mountpoint will hang until timeout - this can cause system instability.

  2. When the device is inserted, the passphrase is prompted for and device unlocked, but not mounted. I then have to mount the device manually with mount /mnt/backup or mount /dev/mapper/fit which appears to correctly use the fstab settings.

Configuration

# /etc/crypttab
fit   UUID=xxxxxxxx-xxxxx-xxxxxxxx-xxxxxxxxxx none luks,noauto
# /etc/fstab
/dev/mapper/fit    /mnt/backup   ext4    noatime,user,noauto,x-systemd.automount,x-systemd.device-timeout=5ms,x-systemd.mount-timeout=100ms    0   0

I happen to have a Samsung Fit usb flash drive if anyone was wondering about the name

Accessing the mountpoint when the external device is NOT present

# Accessing the mountpoint when the drive is NOT plugged in
andy@pop-os:mnt$ ll
ls: cannot access 'backup': No such device
total 0
d????????? ? ? ? ?            ? backup/

andy@pop-os:mnt$ mountpoint /mnt/backup
/mnt/backup is a mountpoint
# journalctl
Jan 21 16:33:34 pop-os systemd[1]: mnt-backup.automount: Got automount request for /mnt/backup, triggered by 5192 (ls)
Jan 21 16:33:34 pop-os systemd[1]: dev-mapper-fit.device: Job dev-mapper-fit.device/start timed out.
Jan 21 16:33:34 pop-os systemd[1]: Timed out waiting for device /dev/mapper/fit.
Jan 21 16:33:34 pop-os systemd[1]: Dependency failed for /mnt/backup.
Jan 21 16:33:34 pop-os systemd[1]: mnt-backup.mount: Job mnt-backup.mount/start failed with result 'dependency'.
Jan 21 16:33:34 pop-os systemd[1]: dev-mapper-fit.device: Job dev-mapper-fit.device/start failed with result 'timeout'.

Normal Removal Processes

# Absolute path is required if not using sudo (`user` was set in fstab)
andy@pop-os:mnt$ umount /mnt/backup

andy@pop-os:mnt$ sudo cryptsetup close fit

andy@pop-os:mnt$ sudo eject /dev/sdx

Temporary Resolution

I can unmount the mountpoint (even though no device is mounted anyway) to temporarly fix this issue but it will come back after a system reboot or after mounting/ummounting the device again.

andy@pop-os:mnt$ sudo umount backup

andy@pop-os:mnt$ ll
total 4.0K
drwxr-xr-x 2 root root 4.0K Jan 19 10:16 backup/

andy@pop-os:mnt$ lsattr
----i---------e------- ./backup

andy@pop-os:~$ mountpoint /mnt/backup
/mnt/backup is not a mountpoint

If I use noauto and don't include x-systemd.automount then I avoid the problem of the directory being a mountpoint on boot when no device is present, but I also don't get automounting - although the device still unlocks.

Mounting the external device

Passphrase is prompted for and device unlocked

andy@pop-os:mnt$ lsblk -f
NAME            FSTYPE      FSVER    LABEL     UUID                                   FSAVAIL FSUSE% MOUNTPOINTS
sdb             crypto_LUKS 2                  xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx                  
└─fit           ext4        1.0                yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy                  

andy@pop-os:mnt$ ll backup/
ls: cannot access 'backup/': No such device

Note that MOUNTPOINTS is empty

# journalctl -f
Jan 21 17:17:26 pop-os kernel: usb 6-2: new SuperSpeed USB device number 2 using xhci_hcd
Jan 21 17:17:26 pop-os kernel: usb 6-2: New USB device found, idVendor=090c, idProduct=1000, bcdDevice=11.00
Jan 21 17:17:26 pop-os kernel: usb 6-2: New USB device strings: Mfr=1, Product=2, SerialNumber=3
Jan 21 17:17:26 pop-os kernel: usb 6-2: Product: Flash Drive FIT
Jan 21 17:17:26 pop-os kernel: usb 6-2: Manufacturer: Samsung
Jan 21 17:17:26 pop-os kernel: usb 6-2: SerialNumber: 0123456789123
Jan 21 17:17:26 pop-os kernel: usb-storage 6-2:1.0: USB Mass Storage device detected
Jan 21 17:17:26 pop-os kernel: scsi host7: usb-storage 6-2:1.0
Jan 21 17:17:26 pop-os mtp-probe[10452]: checking bus 6, device 2: "/sys/devices/pci0000:00/0000:00:08.1/0000:0b:00.4/usb6/6-2"
Jan 21 17:17:26 pop-os mtp-probe[10452]: bus: 6, device: 2 was not an MTP device
Jan 21 17:17:26 pop-os mtp-probe[10467]: checking bus 6, device 2: "/sys/devices/pci0000:00/0000:00:08.1/0000:0b:00.4/usb6/6-2"
Jan 21 17:17:26 pop-os mtp-probe[10467]: bus: 6, device: 2 was not an MTP device
Jan 21 17:17:29 pop-os kernel: scsi 7:0:0:0: Direct-Access     Samsung  Flash Drive FIT  1100 PQ: 0 ANSI: 6
Jan 21 17:17:29 pop-os kernel: sd 7:0:0:0: Attached scsi generic sg1 type 0
Jan 21 17:17:29 pop-os kernel: sd 7:0:0:0: [sdb] 501253132 512-byte logical blocks: (257 GB/239 GiB)
Jan 21 17:17:29 pop-os kernel: sd 7:0:0:0: [sdb] Write Protect is off
Jan 21 17:17:29 pop-os kernel: sd 7:0:0:0: [sdb] Mode Sense: 43 00 00 00
Jan 21 17:17:29 pop-os kernel: sd 7:0:0:0: [sdb] Write cache: enabled, read cache: enabled, doesnt support DPO or FUA
Jan 21 17:17:29 pop-os kernel:  sdb: sdb1
Jan 21 17:17:29 pop-os kernel: sd 7:0:0:0: [sdb] Attached SCSI removable disk
Jan 21 17:17:41 pop-os systemd[1]: Starting Cryptography Setup for fit...
Jan 21 17:17:41 pop-os systemd-cryptsetup[10585]: Volume fit already active.
Jan 21 17:17:41 pop-os systemd[1]: Finished Cryptography Setup for fit.
Jan 21 17:17:41 pop-os systemd[1]: Reached target Block Device Preparation for /dev/mapper/fit.
Jan 21 17:17:41 pop-os gnome-shell[3744]: Unable to mount volume 257 GB Encrypted: Gio.IOErrorEnum: Operation was cancelled
Jan 21 17:17:41 pop-os udisksd[1382]: Unlocked device /dev/sdb1 as /dev/dm-4

Note that the second to last line "Operation was cancelled" is happening just before udisksd reports "Unlock device..."

I've tried this with two different devices, one with whole disk block encryption and the other with an encrypted partition, it makes no difference.

Sometimes moments later...

andy@pop-os:mnt$ mount /mnt/backup
mount: /mnt/backup: /dev/mapper/fit already mounted on /mnt/backup.

... but usually this just mounts the device as expected.

Other Issues

  • If I do not set x-systemd.device-timeout to something much less than the default 90s then my system will slowly become unresponsive and then crash. I thought systemd might be timing out waiting for me to type in my passphrase but longer timeouts didn't seem to help
  • I copied the configuration from an old Ubuntu 22.04 system to Pop!_OS 22.04, I would sometimes see the question marks while listing the directory in the unmounted state but the auto-mount worked perfectly. On the old system I didn't set the immutable attribute on the mountpoint.

Related


So, why does accessing the mountpoint try to access the device after it has been unmounted resulting in ?????????, and why does it not automount correctly when the device is inserted? Between the old fstab and new systemd I can't seem to find the magic variables.

Would also be useful to know why the system crashes if I don't set the device timeout?


Update August 2023

mount-vs-automount-systemd-units... explains the ????? as the .automount unit attempts to open the mountpoint on access.

I have still been unable to achieve the behaviour I want though, and wonder if it because without configuring anything udev is used and then the only problem is being able to customise the directory used as a mountpoint. As soon as an fstab entry is made, /run/systemd/generator systemd units are made and the behaviour changes.

There also seems to be a problem on my new system with plymouth as this spits out errors while systemd uses 100% CPU and hangs the system. This doesn't happen on my old laptop.

1 Answer 1

0

Just a quick idea...

Maybe use udev to launch script/app which make dir for your mount point and then do all cryptsetup stuff. This script may use key from usb drive.

Try do everything without using fstab.

(sorry for anwser, but I can't comment your question).

1
  • 1
    "Try do everything without using fstab" I think is the issue, that systemd units are being used under the hood - though I would need to spend some time getting my head around how they work properly.
    – a2k42
    Mar 22 at 15:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .