I did it. The solution's adapted from here: https://wiki.archlinux.org/index.php/TrueCrypt#Mount_volumes_as_a_normal_user and from my other question regarding modern sudoers config: adding local content in /etc/sudoers.d/ instead of directly modifying sodoers file via visudo
- Create a new group called say
veracryptusers and give it the necessary permissions to use VeraCrypt without root password. Any user that belongs to that group will be able to use VeraCrypt.
Note: this dramatically increases attack surface for user rights elevation, so be sure to add only trusted users to this group.
# groupadd veracryptusers
- Now let's give this group sudo permissions limited to VeraCrypt:
$ sudo visudo -f /etc/sudoers.d/veracrypt
GNU nano 2.5.3 File: /etc/sudoers.d/veracrypt.tmp
# Users in the veracryptusers group are allowed to run veracrypt as root.
%veracryptusers ALL=(root) NOPASSWD:/usr/bin/veracrypt
Also please make sure that
/usr/bin have the proper permissions and are NOT writable by groups nor others:
$ ls -al /usr/bin/vera*
-rwxr-xr-x 1 root root 6341016 paź 17 2016 /usr/bin/veracrypt
$ ls -ald /usr/bin
drwxr-xr-x 2 root root 69632 lip 25 10:09 /usr/bin
Otherwise a malicious user may replace the executable and gain total root right at his wish.
Now reboot (or relogin) to have groups membership revaluated and voilà - you can mount and unmount your favourite volumes.
Please also be sure to review privilege escalation loophole described at the link below and before adding users to the group consider whether you can trust them