I selected /home/ to be encrypted when I was installing Ubuntu. Now, is it possible to make locate
work with an encrypted partition like this?
3 Answers
I both "run locate (updatedb) when I'm logged in", as mentioned above, and I keep my part of the locate database under my encrypted $HOME.
export LOCATE_PATH="$HOME/var/mlocate.db"
and then I index the files in$HOME
with
updatedb -l 0 -o $HOME/var/mlocate.db -U $HOME
Now I have a complete index of $HOME
but the database isn't visible unless $HOME
is mounted and decrypted.
-
-
4I didn't. I just generated a db for my (encrypted) home tree, with
updatedb -l 0 -o $HOME/var/mlocate.db $HOME
.man locate
says it will search the default database (/var/lib/mlocate/mlocate.db
), then the list of databases in$LOCATE_PATH
. Jan 9, 2012 at 6:46 -
3Don't "remove
ecryptfs
from thePRUNEFS
definition in/etc/updatedb.conf
. When you're logged in,/home/$USER
is decrypted, but the encrypted files and filenames in/home/$USER/.Private
should be ignored. When your$HOME
is not mounted, others won't have access to the db or the (unencrypted) files of filenames. Jan 9, 2012 at 7:13 -
2
updatedb -l 0 -o $HOME/var/mlocate.db $HOME
there is missing-U
it should beupdatedb -l 0 -o $HOME/var/mlocate.db -U $HOME
– destanMar 22, 2012 at 12:17 -
2My bad, @destin I've extended my method to index removeable media, too, using Steve Collyer's bash_path_funcs ( linuxjournal.com/article/3645 ). With the removeable medium mounted (as
/media/_name_
) I doupdatedb -l 0 -o ~/var/mlocate/_name_.db -U /media/_name_
In my.bashrc
, I haveexport LOCATE_PATH="$HOME/var/mlocate/mlocate.db
for i in $HOME/var/mlocate/*.db ; do
addpath -p LOCATE_PATH $i
done
uniqpath -p LOCATE_PATH
andlocate
can show me filenames even when the medium is NOT mounted. Mar 23, 2012 at 4:42
How about running updatedb when your file system is decrypted and try to match environment variables to read/write it?
After reading the man page, add two variables to your BASH RC file.
man locate
echo "export LOCATE_PATH=$HOME/var/lib/mlocate/mlocate.db:$LOCATE_PATH" >> ~/.bashrc
echo "export DBPATH=$HOME/var/lib/mlocate/mlocate.db:$DBPATH" >> ~/.bashrc
Make the directory specified above and add $username to the mlocate group.
mkdir -p ~/var/lib/mlocate/
sudo usermod -a -G mlocate $username
Log out and in again to count your user in the mlocate group and get the new environment variables. Now when you run,
updatedb -o $LOCATE_PATH
are the decrypted files in a locate database now? Or, what did you do to make it work or better?
You may also want to add updatedb to user's crontab. First run:
crontab -e
And add the following line:
0 12 * * * updatedb -o $HOME/var/locate
-
See my comment to Martin. I'm trying to understand if there are any security considerations or proper configuration was just overlooked by Ubuntu.– m33lkyJan 10, 2011 at 0:23
-
Because of ecryptfs being listed in the PRUNEFS variable at /etc/updatedb.conf, you probably also need to use --prunefs "nfs" . This seems to be a good solution because it stores and updates the a per user index from the user profile. Jan 10, 2011 at 23:40
-
@m33lky The issue is this: you have asked to encrypt your homedir, so nobody (not even
root
!) can read it without the password. The smart solution is a per-user locate database. The easy solution for a single-user machine is to removeecryptfs
and scan when you are logged in. In the future, perhapslocate
could aggregate results from the global DB and the current user's home DB. Jun 22, 2013 at 12:29
It's not really possible to update the database index without being logged in. You should log in and run the updatedb command.
Check your config in /etc/updatedb.conf
. Remove ecryptfs
from PRUNEFS
and probably /home/.ecryptfs
from PRUNEPATHS
. Don't forget to run sudo updatedb
after.
-
1updatedb.conf prunes ecryptfs. Also, PRUNE_BIND_MOUNTS="yes". I'm trying to understand the reasoning behind such defaults as this is not user-friendly to have results from /home missing in your searches :)– m33lkyJan 10, 2011 at 0:21
-
I'm guessing the functionality for home is to have a per user indexer... but that's speculation. Jan 10, 2011 at 4:31
-
Without encryption /home gets indexed, so I expect the same behavior...– m33lkyJan 10, 2011 at 4:34
-
1
-
2If you encrypted the entire disk, this wouldn't be an issue, if you only had a home encryption then you now need to start indexing per user and using each individual encryption... in fact you might as well just stash the home index in the user's home folder.... all of which is major development and cost for something most users never see. Please report the bug against the locate database tools project. Jan 12, 2011 at 7:06
/home
is a virtual file system (ecryptfs). It is "mounted" as an accessible partition when you log in. Check your /etc/updatedb.conf and a) remove ecryptfs from ignored file systems (PRUNEFS) b) change to PRUNE_BIND_MOUNTS="no"sudo updatedb
to index new files.