1

Is there a way to modify the mount options for an encrypted home partition on Ubuntu, specifically to remove the nosuid option?

Relatedly, is removing nosuid likely to cause any difficulties mounting the encrypted home?


Adding more details because the original question was ambiguous.

I'm trying to build a project that requires it not be on a drive mounted with the nosuid mount option. Recently, after the update to Trusty, it started complaining about nosuid.

I checked fstab, but didn't see the option in use:

$ cat /etc/fstab

# <file system> <mount point>   <type>  <options>       <dump>  <pass>
proc            /proc           proc    nodev,noexec,nosuid 0       0
...
UUID=<snip> /               ext4    errors=remount-ro 0       1
...

So I checked /proc/mounts, and it looks like my home folder is a VFS mount used by eCryptFS because my home is encrypted:

$ cat /proc/mounts

...
/home/cdot/.Private /home/cdot ecryptfs rw,nosuid,nodev,relatime,ecryptfs_fnek_sig=<snip>,ecryptfs_sig=<snip>,ecryptfs_cipher=aes,ecryptfs_key_bytes=16,ecryptfs_unlink_sigs 0 0 gvfsd-fuse /run/user/1001/gvfs fuse.gvfsd-fuse rw,nosuid,nodev,relatime,user_id=1001,group_id=1001 0 0
...

But so far I can't find where the mount options eCryptFS is using were set, or how to change them. So that brings me back to the original questions: Where can I set this, and (bonus) is the nosuid option just precautionary or will removing it break eCryptFS?

Thanks in advance for any details.

  • Can you please describe your exact eCryptFS setup? Which folders are mounted where on what occasion? – David Foerster Mar 2 '15 at 12:19
  • Thanks @DavidFoerster, I've added the /proc/mounts output - this is the encrypted home setup that you can enabled out-of-the-box on Ubuntu. – C. Andrew Warren Mar 3 '15 at 3:39
  • @C.AndrewWarren you should not try to remove nosuid, this option was added because of a possible privilege escalation, see CVE-2012-3409 for more Details – Murmel Nov 15 '15 at 20:18
-1

You can modify the mount point in /etc/fstab. Ensure that whichever mount point you choose exists and has appropriate permissions.

  • Thanks Nolan, unfortunately the current mount options aren't showing up in /etc/fstab - I've added more output above with details. I think this is a VFS being mounted at boot-time by eCryptFS. – C. Andrew Warren Mar 3 '15 at 3:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.