Tell me more ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.
up vote 7 down vote favorite
1

I selected /home/ to be encrypted when I was installing Ubuntu. Now, is it possible to make locate work with an encrypted partition like this?

share|improve this question
I have the same problem - locate will find files outside of my encrypted home partition but cannot see them inside it. (To be honest, I wish I'd never encrypted it when I installed Ubuntu in the first place, with all the problems I've had with it!) Please can someone explain in clear steps what I need to do to be able to make locate be able to index data on an encrypted home partition. I'm a relative newbie so it's not obvious what to do from reading the above:). – user11061 Feb 19 '11 at 14:40
2  
Your /home is a virtual file system (ecryptfs). It is "mounted" as an accessible partition when you log in. Check your /etc/updatedb.conf and a) remove ecryptfs from ignored file systems (PRUNEFS) b) change to PRUNE_BIND_MOUNTS="no" – m33lky Feb 26 '11 at 3:56
2  
After that you can run sudo updatedb to index new files. – m33lky Feb 26 '11 at 4:03
keep in mind that the database locate uses lives in unencrypted space, possibly compromising your encryption by disclosing filenames – Florian Heinle Feb 27 '11 at 12:59

3 Answers

up vote 1 down vote accepted

It's not really possible to update the database index without being logged in. You should log in and run the updatedb command.

Check your config in /etc/updatedb.conf

share|improve this answer
updatedb.conf prunes ecryptfs. Also, PRUNE_BIND_MOUNTS="yes". I'm trying to understand the reasoning behind such defaults as this is not user-friendly to have results from /home missing in your searches :) – m33lky Jan 10 '11 at 0:21
I'm guessing the functionality for home is to have a per user indexer... but that's speculation. – Martin Owens -doctormo- Jan 10 '11 at 4:31
Without encryption /home gets indexed, so I expect the same behavior... – m33lky Jan 10 '11 at 4:34
Then figure out how to make a global index of an encrypted partition that doesn't count as a security breach. You're asking for the logically impossible. – Martin Owens -doctormo- Jan 10 '11 at 4:42
You're making up an impossible problem. Encrypting the db would do just fine. – m33lky Jan 12 '11 at 6:52
show 2 more comments
up vote 5 down vote

I both "run locate (updatedb) when I'm logged in", as mentioned above, and I keep my part of the locate database under my encrypted $HOME. 

export LOCATE_PATH="$HOME/var/mlocate.db"

Thus, when my $HOME isn't mounted (and decrypted), it isn't visible.

share|improve this answer
That's a nice solution. How did you migrate your db there? – m33lky Jan 8 '12 at 23:51
1  
I didn't. I just generated a db for my (encrypted) home tree, with updatedb -l 0 -o $HOME/var/mlocate.db $HOME. man locate says it will search the default database (/var/lib/mlocate/mlocate.db), then the list of databases in $LOCATE_PATH. – waltinator Jan 9 '12 at 6:46
1  
Don't "remove ecryptfs from the PRUNEFS definition in /etc/updatedb.conf. When you're logged in, /home/$USER is decrypted, but the encrypted files and filenames in /home/$USER/.Private should be ignored. When your $HOME is not mounted, others won't have access to the db or the (unencrypted) files of filenames. – waltinator Jan 9 '12 at 7:13
1  
updatedb -l 0 -o $HOME/var/mlocate.db $HOME there is missing -U it should be updatedb -l 0 -o $HOME/var/mlocate.db -U $HOME – destan Mar 22 '12 at 12:17
My bad, @destin I've extended my method to index removeable media, too, using Steve Collyer's bash_path_funcs ( linuxjournal.com/article/3645 ). With the removeable medium mounted (as /media/_name_) I do updatedb -l 0 -o ~/var/mlocate/_name_.db -U /media/_name_ In my .bashrc, I have export LOCATE_PATH="$HOME/var/mlocate/mlocate.db for i in $HOME/var/mlocate/*.db ; do addpath -p LOCATE_PATH $i done uniqpath -p LOCATE_PATH and locate can show me filenames even when the medium is NOT mounted. – waltinator Mar 23 '12 at 4:42
up vote 1 down vote

How about running updatedb when your file system is decrypted and try to match environment variables to read/write it?

After reading the man page, add two variables to your BASH RC file.

man locate
echo "export LOCATE_PATH=$HOME/var/lib/mlocate/mlocate.db:$LOCATE_PATH" >> ~/.bashrc
echo "export DBPATH=$HOME/var/lib/mlocate/mlocate.db:$DBPATH" >> ~/.bashrc

Make the directory specified above and add $username to the mlocate group.

mkdir -p ~/var/lib/mlocate/
sudo usermod -a -G mlocate $username

Log out and in again to count your user in the mlocate group and get the new environment variables. Now when you run,

updatedb -o $LOCATE_PATH

are the decrypted files in a locate database now? Or, what did you do to make it work or better?

share|improve this answer
See my comment to Martin. I'm trying to understand if there are any security considerations or proper configuration was just overlooked by Ubuntu. – m33lky Jan 10 '11 at 0:23
Because of ecryptfs being listed in the PRUNEFS variable at /etc/updatedb.conf, you probably also need to use --prunefs "nfs" . This seems to be a good solution because it stores and updates the a per user index from the user profile. – João Pinto Jan 10 '11 at 23:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.