Change eCryptFS mount options (remove nosuid)?

Question

Is there a way to modify the mount options for an encrypted home partition on Ubuntu, specifically to remove the nosuid option?

Relatedly, is removing nosuid likely to cause any difficulties mounting the encrypted home?

---

Adding more details because the original question was ambiguous.

I'm trying to build a project that requires it not be on a drive mounted with the nosuid mount option. Recently, after the update to Trusty, it started complaining about nosuid.

I checked fstab, but didn't see the option in use:

$ cat /etc/fstab

# <file system> <mount point>   <type>  <options>       <dump>  <pass>
proc            /proc           proc    nodev,noexec,nosuid 0       0
...
UUID=<snip> /               ext4    errors=remount-ro 0       1
...

So I checked /proc/mounts, and it looks like my home folder is a VFS mount used by eCryptFS because my home is encrypted:

$ cat /proc/mounts

...
/home/cdot/.Private /home/cdot ecryptfs rw,nosuid,nodev,relatime,ecryptfs_fnek_sig=<snip>,ecryptfs_sig=<snip>,ecryptfs_cipher=aes,ecryptfs_key_bytes=16,ecryptfs_unlink_sigs 0 0 gvfsd-fuse /run/user/1001/gvfs fuse.gvfsd-fuse rw,nosuid,nodev,relatime,user_id=1001,group_id=1001 0 0
...

But so far I can't find where the mount options eCryptFS is using were set, or how to change them. So that brings me back to the original questions: Where can I set this, and (bonus) is the nosuid option just precautionary or will removing it break eCryptFS?

Thanks in advance for any details.

Answer 1

I ran in to this problem building LinuxCNC to run on Ubuntu 18.04; the LinuxCNC code uses setuid root binaries to talk to the PREEMPT RT kernel extensions and specifically disallows execution as root. I built the code in my ecryptfs home directory and the LinuxCNC code did not have a useful error message but I eventually tracked it down to the 'nosuid' mount option ecryptfs adds.

My (temporary) workaround is to perform a run-time modification of the mount. This will not persist across reboots but has allowed me to test the application and it may be useful to others.

sudo mount -i -o remount,suid $HOME

Other than the security implications I do not expect the operation of the ecryptfs filesystem will be impacted.

Answer 2

You can modify the mount point in /etc/fstab. Ensure that whichever mount point you choose exists and has appropriate permissions.