Add auto-unwrap flag to pam_ecryptfs (or let pam_mount handle the mounts)

[Florian Schmaus]

Change line 152 of pam_encryptfs.c to "if (!file_exists_dotecryptfs(homedir, "auto-mount") && !file_exists_dotecryptfs(homedir, "auto-unwrap"))", to add an extra option that tells pam_ecryptfs to only unwrap the passphrase without mounting.

[Dustin Kirkland  (kirkland)]

Hi Florian,

Thanks for this suggestion!

Can you give a bit more information? What's the use case? I presume you're wanting pam_ecryptfs to load keys into your keyring automatically on login, but not necessarily mount anything automatically?

[Florian Schmaus (flowdalic)]

Hi Dustin

I made these two bug reports - 805943 is the other one - when I configured an encrypted home with pam_mount. In this case pam_ecryptfs should only add the key to the keyring, as you already figured out. I have documented everything here: http://en.gentoo-wiki.com/wiki/Encrypt_home_directory_with_ecryptfs

[Tyler Hicks (tyhicks)]

I think the more appealing task that may come from this bug report is the opportunity to remove the mount functionality from pam_ecryptfs and let pam_mount handle that.

[Dustin Kirkland  (kirkland)]

Agreed, Tyler.

Thanks for that link, Florian. This is pretty interesting. I'll have a look at it.