4

I have an encrypted loopback volume. I need to mount and umount the volume manually, so I use cryptsetup luksOpen and cryptsetup luksClose .

However, under all sessions (gnome/xfce/kde/unity), when I invoke this command it pops up the /dev/mapper device ...

And then it lets the one user mount (with password), access files, and unmount the volume.

It's quite annoying in a multi user server (you are working on your files and the volume is being unmounted). I want the volume to be owned and used by only root and the owner and not all users.

How can I define ownership and permission on the device ?

More informations :

  • I've tried chown and chmod approach witch gives nothing.
  • Cryptsetup doesn't have any options that let you do that.
  • crypttab auto mount the filesystem on boot witch is unwanted (only manual mount)

The permissions that cryptsetup put in the /dev/mapper/MyEncryptedVolume is owner root:root but with lrwxrwxrwx

whatever I do (like a chmod) won't do anything.

It's a device (/dev/mapper/MyEncryptedVolume) that is linked to /dev/dm-0 with rights brw-rw----

I've changed the rights of /dev/dm-0 with udev rule but nothing change : the volume is still shown to normal users due to the symbolic link.

Thank you

2
  • Ok My trouble wasn't with Cryptsetup but with losetup. However the udev rules had an impact for owner and permission. Going to post the answer to this question soon. Oct 15, 2012 at 9:00
  • Please edit this question to replace witch with which so that online language translators can work properly. While editing, the Thank you should be removed as well. Nov 15, 2021 at 22:29

1 Answer 1

5

The reality is that Cryptsetup uses Loop devices / Losetup in order to mount a loopback file to /dev/mapper/MyEncryptedVolume.

udev can resolve the situation.

There is two options : let cryptsetup choose the loopdevice or dedicate a loop device for this.

I chose the second part.

In this example I use /dev/loop5

  1. Create a file named 99-myspecial.rules into the folder /etc/udev/rules.d/
  2. insert this :

    KERNEL=="loop5" MODE="0600" OWNER="MyUser" GROUP="MyGroupUser" ENV{UDISKS_IGNORE}="1" ENV{UDISKS_PRESENTATION_HIDE}="1" ENV{ID_DRIVE_EJECTABLE}="0"

    This tells udisk (witch is the real trouble maker in that situation) to ignore the volume, to hide the icon, that the volume is not ejectable (aka it's not a cdrom). You also specify that only one user can access to that volume.

  3. Then Restart udev service

  4. Then I link the loop device like this :

    losetup /folder/myflatfile.img /dev/loop5
    

And then I use cryptsetup as I want with the loop device as source.

Hopes that helps someone more than me.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .