deluser --remove-home leaves ecryptfs data behind

[Martin Pitt]

Binary package hint: adduser

On experimenting with encrypted home directories, I repeatedly added and removed users with encrypted home directories (had to do that because of bug 347969).

It occurred to me that "deluser --remove-home foo" followed by "adduser --encrypt-home foo" doesn't work, because deluser leaves /var/lib/ecryptfs/foo behind.

ProblemType: Bug
Architecture: i386
DistroRelease: Ubuntu 9.04
Package: adduser 3.110ubuntu3
PackageArchitecture: all
ProcEnviron:
 PATH=(custom, user)
 LANG=de_DE.UTF-8
 SHELL=/bin/bash
SourcePackage: adduser
Uname: Linux 2.6.28-11-generic i686

[Dustin Kirkland  (kirkland)]

Thanks for the report, Martin.

I suppose removing /var/lib/ecryptfs/$USER should be safe, if you're removing their home directory too...

I'm adding a task against adduser, as that's where this code will need to live. I'll keep a task open against ecryptfs-utils for now, for tracking purposes.

:-Dustin

[Dustin Kirkland  (kirkland)]

Attaching a patch that solves this in deluser. Basically, we do a 'find' on /var/lib/ecryptfs/$user as well, and add those to the files/dirs to be removed. Note that there is a regex list of prohibited dirs that matches on "/var", so I added an exception condition for /var/lib/ecryptfs/$user.

Patch attached. I'm requesting some review of someone with more adduser/deluser expertise than I ;-)

:-Dustin

[Dustin Kirkland  (kirkland)]

I'm assigning the adduser bit to pitti, for his review and upload at his discretion. Earlier in the cycle, I'd do this myself. At this point, a second set of eyes is a good thing ;-)

:-Dustin

[Martin Pitt (pitti)]

This was uploaded with a wedged changelog, and thus no auto-closing:

+adduser (3.110ubuntu5) jaunty; urgency=low
+
+ * deluser: reworked previous upload slightly, per feedback from cjwatson,
+ should make the "rm /var/lib/ecryptfs/$user" code easier to read;
+ revert $version corruption (oops)
+
+ -- Dustin Kirkland <email address hidden> Fri, 27 Mar 2009 17:12:09 -0500
+
+adduser (3.110ubuntu4) jaunty; urgency=low
+
+ * deluser: remove all of /var/lib/ecryptfs/$user, if deluser --remove-home
+ is specified, LP: #347970
+
+ -- Dustin Kirkland <email address hidden> Tue, 24 Mar 2009 13:54:50 -0500
+

Thanks Dustin!

[Luis Mondesi (lemsx1)]

remember that on karmic the ecryptfs directory is now ~user/../.ecryptfs/user/.ecryptfs

luvly uh?

It's a better location for this, but your patch will not fix this

[Dustin Kirkland  (kirkland)]

This was fixed several months ago.

adduser (3.110ubuntu6) karmic; urgency=low

  * deluser: add logic to prune new location of ecryptfs config data,
    in /home/.ecryptfs/$user

 -- Dustin Kirkland <email address hidden> Mon, 03 Aug 2009 12:49:04 +0100

Please verify the functionality next time, before reopening the bug.