Creating and using encrypted partitions as non-root

v00d00101 · 06-25-2006, 04:09 PM

Is this possible?

I've followed a guide and created a partition that is mountable by root, but am having a few problems getting it to mount as a user.

I thought it might have been a disk group issue so i added my main account to the disk group, but that didnt work.

I checked the permissions on /dev/mapper and they are owned by root.root. Would altering this to root.disk be a way of securing write access to /dev/mapper by a non-root account?

Also would doing any of this create any major security implications on the system?

The error message i get when running cryptsetup as a user is as follows:

Code:

[m1@Shadow1 /]$ cryptsetup -y -c twofish-cbc-essiv:sha256 create secure /dev/sda5
mlockall failed: Cannot allocate memory
WARNING!!! Possibly insecure memory. Are you root?
Command failed: Invalid argument

Is there a way to get around this error and allow the creation?

Sorry if this is longwinded. I've so far searched Google and LQ looking for anything to do with mounting encrypted partitions as a non root to no avail.

acid_kewpie · 06-25-2006, 04:23 PM

a non root user should never be allowed to meddle with disk partitions. i would suggest maybe an encrypted fs within a file, mounted via a loopback in fuse?

sundialsvcs · 06-25-2006, 04:52 PM

An encrypted filesystem within a file is, indeed, what I would do. Basically it becomes an encrypted folder, which is much easier to manage. While it is true that you still have to be mindful of temporary files and such, an entire disk volume is rather an extremely-large thing to encrypt (and

to lose...).

v00d00101 · 06-25-2006, 05:31 PM

As it happens i have found a utility called cryptmount that seems to achieve what i wanted.

As for the size of a file versus the size of a partition, well this partition is the first partition on this particular disk, so it offers extremely fast access times, but a file could be anywhere which may not have the same access times. Also a 10gb file may not be as fast as accessing a 10gb partition. I will do some benchmarks on it once i have it running.

Losing the partition isnt really that much of a big deal, i've already created a cronjob to back it up using dd every night to two other drives. This allows me to recreate it with ease, should i need to.

But thanks for the help guys.