LinuxQuestions.org - [SOLVED] Luks encryption

Page 1 of 2

Show 50 post(s) from this thread on one page

LinuxQuestions.org (/questions/)

- Slackware (https://www.linuxquestions.org/questions/slackware-14/)

- - Luks encryption (https://www.linuxquestions.org/questions/slackware-14/luks-encryption-4175712504/)

pchristy

05-23-2022 08:47 AM

Luks encryption

If I plug a Luks encrypted external drive into my laptop, I enter the password and it opens. If I mount an internal Luks encrypted partition (noauto in fstab), as well as the password, it asks for the root password as well, despite the fact that I am the "owner" of the partition.

Why? And How do I stop it?

--
Pete

rknichols

05-23-2022 11:32 AM

Does your fstab entry include the "user" option? You need that to allow a non-root user to mount. Using "users" instead of "user" allows any user to unmount, not just the user who mounted it.

Note: You really should include the "nosuid" and "nodev" options also. Think about the security implications of a user-mounted filesystem that might include suid and device inodes.

pchristy

05-23-2022 11:45 AM

Quote:

Originally Posted by rknichols (Post 6355848)

Does your fstab entry include the "user" option? You need that to allow a non-root user to mount. Using "users" instead of "user" allows any user to unmount, not just the user who mounted it.

I had "owner" in there instead of "user", but changing it to "user" has made no difference.

Quote:

Originally Posted by rknichols (Post 6355848)

Note: You really should include the "nosuid" and "nodev" options also. Think about the security implications of a user-mounted filesystem that might include suid and device inodes.

I'll bear that in mind, once I get it working as I want! Its really irritating having to use two passwords when one ought to do it...!

Thanks for the advice!

--
Pete

rknichols

05-23-2022 12:00 PM

Quote:

Originally Posted by pchristy (Post 6355853)

I had "owner" in there instead of "user", but changing it to "user" has made no difference.

Are you perhaps issuing the mount command with both the device and the mount point? You need to use just one of those and have the mount command get the other from /etc/fstab. When you supply both, /etc/fstab is ignored.

pchristy

05-23-2022 12:14 PM

I'm actually doing it from Dolphin (Plasma5's file manager).

If I plug in an encrypted external drive, it appears in the devices window, I click on it, enter the password and it opens. The external drive doesn't have a defined mount point, and gets mounted under /run/media/myname/ExtDrive. I've tried commenting out the line in fstab, hoping it would be treated the same way as an external drive, but it didn't make any difference. It still mounted, but only after supplying the root password as well.

But here's a thing that may be relevant: Even when the fstab line is active, it still mounts the drive under /run/media/myname/ rather than its designated mount point! I have no idea why. I'm assuming that the filesystem type should be ext4 (or whatever) in fstab, and not luks, or some derivation? I've not tried this before, so I'm guessing some stuff here!

I'll come back shortly and post an anonymised version of the fstab line, see if I've done everything right. I've never had a problem before adding drives or nfs shares.

--
Pete

Markus Wiesner

05-23-2022 12:16 PM

Quote:

Originally Posted by rknichols (Post 6355848)

Note: You really should include the "nosuid" and "nodev" options also. Think about the security implications of a user-mounted filesystem that might include suid and device inodes.

That's already the default, see man mount:

Code:

      owner

          Allow an ordinary user to mount the filesystem if that user

          is the owner of the device. This option implies the

          options nosuid and nodev (unless overridden by subsequent

          options, as in the option line owner,dev,suid).

[..]

      users

          Allow any user to mount and to unmount the filesystem, even

          when some other ordinary user mounted it. This option

          implies the options noexec, nosuid, and nodev (unless

          overridden by subsequent options, as in the option line

          users,exec,dev,suid).

rknichols

05-23-2022 12:33 PM

Quote:

Originally Posted by pchristy (Post 6355862)

I'm actually doing it from Dolphin (Plasma5's file manager).

I think you'll find that mounting from the command line works just fine. For a GUI file manager, all bets are off!

pchristy

05-23-2022 01:04 PM

Here's the relevant line from fstab:

Code:

/dev/sdaX /mnt/hd ext4 rw,noauto,owner 1 2

Despite the /mnt/hd directory command, it still gets mounted to /run/media/myname which makes me think that the fstab entry is being ignored. But why?

I am the "owner" of the partition I'm trying to mount. I'm not sure if it should be necessary or not, but I'm in the sys and disk groups. I can't think of any other reason why this doesn't work!

All ideas welcome!

--
Pete

Petri Kaukasoina

05-23-2022 03:19 PM

Quote:

Originally Posted by pchristy (Post 6355892)

I'm not sure if it should be necessary or not, but I'm in the sys and disk groups.

No user should be in the disk group. It means you can read, write and destroy anything on the disk.

zeebra

05-23-2022 03:47 PM

Quote:

Originally Posted by pchristy (Post 6355792)

I'm not 100% sure, because I just returned to Slackware, but I've been using KDE for a long time, and in other distroes it mounts in /var/run/media with owner/group as root. So you can't access the disk, even if everthing in there is owned by user user. I'm fairly sure polkit is the one causing the password prompt, and fairly sure polkit allows you to "escalate" you to do something you wouldn't normally be allowed to do.

You can write a polkit rule to get rid of the password prompt. Should be in /usr/share/polkit/rules.d.

Personally I didn't use an external disk much, so I would go into the folder and change the owner/group, and as far as I remember you only need to do that once for each disk. But that's only advisable if the disk is only for user owned stuff anyways.

pchristy

05-23-2022 04:08 PM

Quote:

Originally Posted by Petri Kaukasoina (Post 6355935)

No user should be in the disk group. It means you can read, write and destroy anything on the disk.

Noted. Thanks!

Quote:

Originally Posted by zeebra

'm not 100% sure, because I just returned to Slackware, but I've been using KDE for a long time, and in other distroes it mounts in /var/run/media with owner/group as root. So you can't access the disk, even if everthing in there is owned by user user. I'm fairly sure polkit is the one causing the password prompt, and fairly sure polkit allows you to "escalate" you to do something you wouldn't normally be allowed to do.

You can write a polkit rule to get rid of the password prompt. Should be in /usr/share/polkit/rules.d.

There seems to be a rule in there already that allows those in the "plugdev" group to mount and unmount things. But perhaps that only applies to plugable devices? It would explain why I don't get asked for root password when I plug in an external drive. I think you are on to something here.

I need to figure out the syntax and apply it to a non-plugable partition, and looking at it now, it that looks above my pay-grade! ;)

I'll have a look in the morning when I'm not half-asleep!

Many thanks for the suggestions!

--
Pete

pchristy

05-23-2022 04:43 PM

I found a suggestion over on the archlinux board from someone who was having a similar issue. The suggestion there was to create a "10-mount-system.rules" file containing:

Code:

polkit.addRule(function(action, subject) {

    if (action.id == "org.freedesktop.udisks2.filesystem-mount-system" &&

          subject.active &&

          subject.isInGroup("storage")) {

          return polkit.Result.YES;

    }

});

Tried it, but it didn't work. I'm not familiar with polkit rules, but from what I've read, it sounds like the right approach.

Any hints welcome!

--
Pete

zeebra

05-24-2022 03:15 AM

Quote:

Originally Posted by pchristy (Post 6355952)

I found a suggestion over on the archlinux board from someone who was having a similar issue. The suggestion there was to create a "10-mount-system.rules" file containing:

Code:

polkit.addRule(function(action, subject) {

    if (action.id == "org.freedesktop.udisks2.filesystem-mount-system" &&

          subject.active &&

          subject.isInGroup("storage")) {

          return polkit.Result.YES;

    }

});

Tried it, but it didn't work. I'm not familiar with polkit rules, but from what I've read, it sounds like the right approach.

Any hints welcome!

--
Pete

That doesn't change anything, because that's basically the same as the (first part of) plugdev rule you mentioned above, except the group under that rule in this case has another name. So in a way the group is irrelevant, if you read the rules backward (which makes it easier to understand). It's the long org.xy.z thing that actually matters.

Here is alot of information: (but the basics about how it works are at the start)
https://develop.kde.org/docs/use/kauth/
https://develop.kde.org/docs/use/kauth/using_kauth/

To list the actions you can use:

Code:

pkaction

And to get information on what they do:

Code:

pkaction --action-id org.freedesktop.udisks2.filesystem-mount-system --verbose

I would guess one of these could be relevant:
org.freedesktop.udisks2.filesystem-mount
org.freedesktop.udisks2.open-device
org.freedesktop.udisks2.open-device-system

So, you could test and make the same rule as above, but you can use a group like myusergroup or any group you're a member of by now.

But I'm no expert on polkit, and like I said I don't really use external disks very much, and when I do I don't use polkit for it.

pchristy

05-24-2022 04:23 AM

Thanks for the info! I'll have a read of that documentation - thanks for the pointer! I'll also checkout that pkaction command.

I'm beginning to wonder if I'm looking at this from the wrong angle. The actual message that comes up is "Authentication is required to unlock the encrypted device", and I've just noticed that it is generated by "PolicyKit1 Kde Agent" (this latter only appears in the small box on the panel at the bottom of the screen, not the main window). To me, that is pointing to the pkaction command you mention. I'll go and have a closer look at this.

What is puzzling me is why I don't need the root password to mount external encrypted disks, but I do for internal ones.

<sigh!> Whoever said computers were logical! :(

UPDATE: All those polkit scripts seem to refer to removable devices, which aren't the problem. I'm beginning to think I'm asking the impossible! Google shows quite a few similar questions, but no solutions!

--
Pete

zeebra

05-24-2022 04:31 AM

Quote:

Originally Posted by pchristy (Post 6356094)

The actual message that comes up is "Authentication is required to unlock the encrypted device",

<sigh!> Whoever said computers were logical! :(

It's only as logic as those who implement the logic ;)
Sorry, I put the wrong link in there:
https://develop.kde.org/docs/use/kauth/

Anyways, looking at that message, I guess it would be one of these 2:
org.freedesktop.udisks2.encrypted-unlock
org.freedesktop.udisks2.encrypted-unlock-system

Quote:

Originally Posted by pchristy (Post 6356094)

UPDATE: All those polkit scripts seem to refer to removable devices, which aren't the problem. I'm beginning to think I'm asking the impossible! Google shows quite a few similar questions, but no solutions!

Well, since it does that, it should mean that there is an action for that purpose. The purpose of making a polkit rule like above with "YES", is that it automatically grants the request (without password) to people in that particular group it refers to.

But I have no idea what action it is, sorry.

Btw. If you make/test rules, put a high leading number in front, so it's loaded last. Like 90-myrule.rules

All times are GMT -5. The time now is 05:28 PM.

Page 1 of 2

Show 50 post(s) from this thread on one page