mount.ecryptfs_private can't mount in 17.10

[Hadmut Danisch]

Hi,

I am using several ecryptfs mounts with ecryptfs-add-passphrase and mount.ecryptfs_private, configured in ~/.ecryptfs/xxx.conf and ~/.ecryptfs/xxx.sig, which was working well for years up to 17.04.

With 17.10 I can't mount these file systems anymore.

ecryptfs-add-passphrase says

Inserted auth tok with sig [....] into the user session keyring

with the correct sig (!).

Trying to mount with mount.ecryptfs_private then says
mount: No such file or directory

although all directories present and correct.

the Kernel then says (dmesg):

[10149.247972] Could not find key with description: [...]
[10149.247994] process_request_key_err: No key
[10149.248000] Could not find valid key in user session keyring for sig specified in mount option: [...]
[10149.248012] One or more global auth toks could not properly register; rc = [-2]
[10149.248019] Error parsing options; rc = [-2]

with exactly the same sig!

So although ecryptfs-add-passphrase claimed to have added the key to the keyring, the kernel complains that it could not find such a key.

ProblemType: Bug
DistroRelease: Ubuntu 17.10
Package: ecryptfs-utils 111-0ubuntu5
ProcVersionSignature: Ubuntu 4.13.0-16.19-generic 4.13.4
Uname: Linux 4.13.0-16-generic x86_64
NonfreeKernelModules: zfs zunicode zavl zcommon znvpair
ApportVersion: 2.20.7-0ubuntu3
Architecture: amd64
CurrentDesktop: LXDE
Date: Tue Oct 24 15:31:45 2017
InstallationDate: Installed on 2017-10-24 (0 days ago)
InstallationMedia: Lubuntu 17.10 "Artful Aardvark" - Release amd64 (20171017.1)
SourcePackage: ecryptfs-utils
UpgradeStatus: No upgrade log present (probably fresh install)

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[mprotic (mprotic)]

Something to do with this one, perhaps (systemd regression) ?

https://bugs.archlinux.org/task/55943

https://bbs.archlinux.org/viewtopic.php?id=230834

[mprotic (mprotic)]

This workaround might do the trick:

https://bugs.launchpad.net/ubuntu/+source/ecryptfs-utils/+bug/1718658

[forevertheuni (forevertheuni)]

I have the exact same problem. I keep trying and later on (without doing anything different it just mounts). I checked my .bash_history did all the same steps. No success until randomly it works. It is such an annoying bug. I had this Dir for 3 years always working, suddenly @17.10 it doesn't.
I noticed that if I use my passphrase the ID is different from what it needs, however it I add the unwrapped password the id matches.
But still I have that error

[forevertheuni (forevertheuni)]

The workaround of running of ecryptfs-manager did the trick

[Tim Ritberg (xpert-reactos)]

I have the same error in kernel log. But I can't see any problem. System works fine.
So what went wrong?

[forevertheuni (forevertheuni)]

Anyway of doing this automatically? as in, start ecryptfs-manager exit and mount?
Or maybe we can make something like run, sleep 1s, killall -TERM, mount.ecryptfs_private "mountname"?

 It is very annoying to every time I login I have to open a terminal an type everything.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[forevertheuni (forevertheuni)]

I upgraded to 18.04 today. This problem does not exist there.

[Emilio (emilio-moretti)]

I upgraded from 17.10 to 18.04LTS today. The problem appeared there for the first time. 18.04LTS is definitely affected.

[Redsandro (redsandro)]

Doing a manual mount like so (used for safely storing private data in the cloud) used to work since Ubuntu 12 or so.

However, today after updating from Ubuntu 16.04 LTS to 18.04 LTS, the entire thing wouldn't mount anymore:

```
$ echo mypassphrase | sudo ecryptfs-add-passphrase --fnek -

Inserted auth tok with sig [abc] into the user session keyring
Inserted auth tok with sig [123] into the user session keyring

$ sudo /bin/mount -it ecryptfs "/media/locked" "/media/unlocked" -o ecryptfs_cipher=aes,ecryptfs_key_bytes=32,ecryptfs_sig=abc,ecryptfs_fnek_sig=123

mount: /home/local/Dropbox.unlocked: mount(2) system call failed: No such file or directory.
```

I read the following messages in `/var/log/syslog`:

```
kernel: [ 5608.396634] Could not find key with description: [abc]
kernel: [ 5608.396641] Could not find valid key in user session keyring for sig specified in mount option: [abc]
```

Apparently there are different keyrings now.

This fixed my script:

```
$ sudo keyctl link @u @s
$ sudo /bin/mount -it ecryptfs "/media/locked" "/media/unlocked" -o ecryptfs_cipher=aes,ecryptfs_key_bytes=32,ecryptfs_sig=abc,ecryptfs_fnek_sig=123
```

For now everything works again, but the thing seems buggy. Ubuntu even dropped the encrypted home because of it.

Ecryptfs seems to be eol. Looking for fresh solutions to protect the privacy of my cloud files.

[Redsandro (redsandro)]

Oops sorry, I missed the duplicate warning!

[Lucas Levrel (llev)]

For those who may not be subscribers of the other bug (this one is marked as duplicate), try this solution: keyctl link @u @s
I've put it in my .profile and it works around the problem "automatically".