mount.crypt broken: Luks volumes won't mount anymore

Bug #63066 reported by Bas Zoetekouw
2
Affects Status Importance Assigned to Milestone
libpam-mount (Ubuntu)
Fix Released
Undecided
Unassigned

Bug Description

Binary package hint: libpam-mount

Since my upgrade this afternoon of libpam-mount to 0.15-1ubuntu1, pam_mount stopped mounting my dm_crypt/Luks encrypted homedir automaticaly at login.

After some debugging, it turns out that in /sbin/mount.crypt, which sets up the decrypted device and mount it, the following code (taken from libpam-mount 0.13)

  if "$CRYPTSETUP" isLuks "$DEVICE" 2>/dev/null; then
      LUKS=true;
      "$CRYPTSETUP" luksOpen "$DEVICE" "$DMDEVICE";
  else

was replaced by

  if "$CRYPTSETUP" isLuks "$DEVICE" 2>/dev/null; then
      LUKS=true;
      "$CRYPTSETUP" luksOpen --key-file=/dev/fd/0 "$DEVICE" "$DMDEVICE";
  else

causing mount.crypt to try to read the encryption key from a floppy disk, rather than using the use password, that was passed from pam to the mount command.

I'm not sure why this change was made, but it makes absolutely no sense to me, it breaks existing setups terribly, and it contradicts the text of Readme.Debian. Also, in Debian sid (libpam-mount version 0.18), the --key-file=/dev/fd/0 part is not present.

Revision history for this message
Sebastian Rode (sebastian-ro-deactivatedaccount) wrote :

Thank you for taking the time to report this bug and helping to make Ubuntu better. You reported this bug a while ago and there hasn't been any activity in it recently. We were wondering is this still an issue for you?
 Thanks in advance.

Changed in libpam-mount:
status: New → Incomplete
Revision history for this message
Bas Zoetekouw (baszoetekouw) wrote :

Have you actually read the bugreport before adding thsi comment? It is trivial to check if this issue is still present, as I pointed out exactly what the problem was in my original report.

Anyway, I am no longer using any Ubuntu systems, so I really don't feel like checking myself.

Changed in libpam-mount:
status: Incomplete → Confirmed
Revision history for this message
Jochen Sprickerhof (v-launchpad-jochen-sprickerhof-de) wrote :

Those scripts have been replaced in 2016 and /dev/df/0 is not in there anymore. So closing.

Changed in libpam-mount (Ubuntu):
status: Confirmed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.