detect users with encrypted home for kernel bug reports

[Leann Ogasawara]

Binary package hint: apport

I wrote another patch to also detect if a user reporting a kernel bug also has an encrypted home. I've pushed this to a branch at:

http://bazaar.launchpad.net/~leannogasawara/ubuntu/karmic/apport/kernel/revision/174

=== modified file 'data/package-hooks/source_linux.py'
--- data/package-hooks/source_linux.py 2009-10-06 01:24:53 +0000
+++ data/package-hooks/source_linux.py 2009-10-06 01:53:16 +0000
@@ -25,6 +25,12 @@

        attach_file_if_exists(report, "/etc/fstab", key="Fstab")

+ if os.path.exists(os.path.expanduser("~/.Private")) and \
+ os.path.exists(os.path.expanduser("~/.ecryptfs")):
+ report['EncryptedHome'] = "Yes"
+ else:
+ report['EncryptedHome'] = "No"
+
        version_signature = report.get('ProcVersionSignature', '')
        if not version_signature.startswith('Ubuntu '):
                report['UnreportableReason'] = _('The running kernel is not an Ubuntu kernel')

~

ProblemType: Bug
ApportLog:

Architecture: i386
CheckboxSubmission: 27199aa7e30bbcb25cde0f30adca2f2c
CheckboxSystem: 8baff8f3b5cdd90914588b077dfd5f83
CrashReports:
 600:1000:1000:28778:2009-09-29 13:30:21.000000000 -0700:2009-09-29 13:30:29.000000000 -0700:/var/crash/_usr_bin_usb-creator-gtk.1000.crash
 600:1000:1000:612541:2009-09-29 13:43:07.000000000 -0700:2009-09-30 05:06:39.000000000 -0700:/var/crash/_usr_bin_seahorse-agent.1000.crash
 600:1000:1000:1755053:2009-09-28 17:47:12.000000000 -0700:2009-09-28 17:47:18.000000000 -0700:/var/crash/_usr_bin_gnome-keyring-daemon.1000.crash
 600:0:0:11501:2009-09-29 13:42:34.000000000 -0700:2009-09-30 05:06:55.000000000 -0700:/var/crash/_usr_share_usb-creator_usb-creator-helper.0.crash
 600:1000:1000:141740:2009-10-02 00:18:45.000000000 -0700:2009-10-02 00:18:50.000000000 -0700:/var/crash/_usr_bin_synergyc.1000.crash
Date: Tue Oct 6 08:55:22 2009
DistroRelease: Ubuntu 9.10
Package: apport 1.9.1-0ubuntu3
PackageArchitecture: all
ProcEnviron:
 PATH=(custom, user)
 LANG=en_US.UTF-8
 SHELL=/bin/bash
ProcVersionSignature: Ubuntu 2.6.31-11.36-generic
SourcePackage: apport
Uname: Linux 2.6.31-11-generic i686

[Martin Pitt (pitti)]

> + if os.path.exists(os.path.expanduser("~/.Private")) and \
> + os.path.exists(os.path.expanduser("~/.ecryptfs")):

I'm not sure whether this is correc/sufficient. It seems to cover the "encrypted private directory" case, but not the "encrypted home dir" case. Dustin, what would be a good check for the latter?

[Dustin Kirkland  (kirkland)]

cat ~/.ecryptfs/Private.mnt

Inside of that file will be the path of the encrypted mountpoint,
which might be $HOME, $HOME/Private, or any other directory owned by
the user.

[Martin Pitt (pitti)]

Hello Dustin,

Dustin Kirkland [2009-11-05 14:51 -0000]:
> cat ~/.ecryptfs/Private.mnt
>
> Inside of that file will be the path of the encrypted mountpoint,
> which might be $HOME, $HOME/Private, or any other directory owned by
> the user.

Ah, interesting, thanks. I don't even have that, but then again my
/home is already very old (I think I set up ecryptfs ~/Private in
intrepid or even earlier; whenever it came up first)

So would you think that this is an appropriate test for "Has encrypted
(bits of) home directory"?

(in shell syntax)

  [ -d ~/.Private -a -d ~/.ecryptfs ] || [ -e ~/.ecryptfs/Private.mnt ]

Thanks,

Martin
--
Martin Pitt | http://www.piware.de
Ubuntu Developer (www.ubuntu.com) | Debian Developer (www.debian.org)

[Dustin Kirkland  (kirkland)]

Sorry, so if ~/.ecryptfs/wrapped-passphrase exists, but Private.mnt
does not, the assumption is that you have an Encrypted-Private.

If ~/.ecryptfs/wrapped-passphrase exists, and ~/.ecryptfs/Private.mnt
exists, then Private.mnt is consulted for the mount point for the
eCryptfs mount.

In most cases, this is either $HOME or $HOME/Private. However, some
users change this to other various directories. It really doesn't
matter to mount.ecryptfs_private, as long as the user OWNS the
directory specified in the file.

To be very specific, something like this, Martin...

if [ -e ~/.ecryptfs/wrapped-passphrase ]; then
  [ -e ~/.ecryptfs/Private.mnt ] && echo $(cat
~/.ecryptfs/Private.mnt) "is encrypted" || echo "$HOME/Private is
encrypted"
else
  echo "No automounted eCryptfs here. Move along."
fi

[Martin Pitt (pitti)]

Thanks Dustin! Leann, does that give you enough info?

[Leann Ogasawara (leannogasawara)]

Hi Martin,

Yes, this would be great.

[Martin Pitt (pitti)]

Taking Leann's comment as "Martin, please do that yourself" :-)

[Martin Pitt (pitti)]

trunk r1648

[Martin Pitt (pitti)]

Sorry, wrong bug.

[Martin Pitt (pitti)]

trunk r1649

[Launchpad Janitor (janitor)]

This bug was fixed in the package apport - 1.9.6-0ubuntu1

---------------
apport (1.9.6-0ubuntu1) lucid; urgency=low

  [ Brian Murray ]
  * debian/local/apport-collect: Strongly encourage collectors who are not
    the bug reporter to file a new bug report.

  [ Marco Rodrigues ]
  * debian/control: Fix lintian warnings. Move python-distutils-extra
    to b-d-i and add misc:Depends to apport-qt.

  [ Martin Pitt ]
  * New upstream version 1.9.5 and 1.9.6:
    - apport-retrace: Fix crash if InterpreterPath/ExecutablePath do not
      exist.
    - hookutils.py, attach_alsa(): Attach /proc/cpuinfo too, for CPU flags.
    - Fix crash if InterpreterPath does not exist any more at the time of
      reporting. (LP: #428289)
    - apport-gtk: Connect signals properly, to repair cancel/window close
      buttons. (LP: #427814)
    - Update German translations and fix "konnre" typo. (LP: #484119)
    - launchpad.py: Ensure that text attachments on initial bug filing are
      valid UTF-8. (LP: #453203)
    - man/apport-retrace.1: Document -R option.
    - Add pm-utils hook to record current operation, so that apportcheckresume
      can check it. Before this was kept in Ubuntu's pm-utils package.
    - general-hooks/generic.py: Check if using ecryptfs, and which directory.
      (LP: #444656)
  * data/general-hooks/ubuntu.py: Add distro release codename tag.
    (LP: #404250)
  * debian/local/apport-chroot: Fix last occurrence of "--no-dpkg" to be
    "--no-pkg". (LP: #487056)
  * debian/local/apport-collect: Use "apport-collect data" as comment for the
    apport-collect attachments to enable bug mail filtering. Thanks to Bryce
    Harrington for the suggestion.
 -- Martin Pitt <email address hidden> Wed, 02 Dec 2009 00:01:06 +0100