Suggestion: support for ecryptfs in Nautilus

[Mark Crutch]

Binary package hint: nautilus

Intrepid will include support for encrypted private directories - that is, each user will have an encrypted directory that is mounted to ~/Private at login using ecryptfs.

More extensive details are here: https://wiki.ubuntu.com/EncryptedPrivateDirectory
There is an effort to write a UI for controlling the (un)mounting of ~/Private here: https://bugs.launchpad.net/ubuntu/+source/ecryptfs-utils/+bug/257901

Presently the ~/Private directory suffers from several usability issues in Nautilus:

1) The ~/Private directory appears to be like any other directory (with the normal directory icon), however because it is actually a mount point, files that are drag-dropped into it are copied rather than moved as they would be with a normal directory. This could lead to people thinking that their data have been moved to a secure directory whilst there's still an unencrypted copy sitting in the original location. Perhaps the ~/Private directory could have a special icon in Nautilus to at least make it look less like the other directories. Ideally a drag-drop to this directory would default to a move operation.

2) The ~/Private directory gets listed alongside the other mount points in the Places panel in Nautilus. This means that it also gets an "eject" icon , but clicking the eject icon results in an error (unable to unmount because it's not in fstab, and you're not root).

3) Similarly it gets an "Unmount" option in the context menu, which produces the same error.

4) If a Nautilus window is open pointing at the content of ~/Private, it is updated as soon as the directory is mounted. It does not automatically refresh when the directory is unmounted, however, which could lead to confusion as to whether or not the directory is mounted.

This bug is a request for enhancement to integrate ecryptfs mounted ~/Private directories into Nautilus in a more seamless manner. It is likely that Nautilus will need to have special-case code, either specifically for the ~/Private directory in Intrepid, or more generally for any ecryptfs mounted directories.

Intrepid SRU TEST CASE:
 - Set up ecryptfs ~/Private, as on https://help.ubuntu.com/community/EncryptedPrivateDirectory
 - with intrepid final glib, your home folder gets both a "Private" folder and mount icon. The mount icon is fairly useless, it cannot be used for unmounting, is redundant, and it exposes an implementation detail.
 - with this update, you just see the "Private" folder.

[Sebastien Bacher (seb128)]

thank you for your bug report, describing several issues on the same bugs is not really pratical, marking as a wishlist but report upstream issues on bugzilla.gnome.org would probably be a good idea there

[Mark Crutch (markc-qsiuk)]

Although I've identified several specific examples, the underlying request is really just one thing: support for encryptfs mounted Private directories in Nautilus.

There didn't seem to be much point in submitting each issue individually, as they will all rely on some lower-level recognition of encryptfs mount points in Nautilus, and until that is in place there's not much point dwelling on the specifics of the UI.

I'm also not sure how relevant this is to upstream Nautilus. At the moment the use of ecryptfs mounted ~/Private directories is very specifically a Ubuntu thing. If it leads to further uptake of ecryptfs in a similar manner, then this might be worth pushing upstream, but at the moment I see it as largely a Ubuntu Nautilus requirement, rather than a Gnome Nautilus requirement.

This is most definitely a "wishlist" feature, but if encrypted ~/Private directories do start to see widespread use with the release of Intrepid, it would make life much simpler for end users if there was some consistency in the way they are handled.

[Sebastien Bacher (seb128)]

whatever those directory configuration is it should be able to be set up on other distributions too and nautilus should handle those correctly, so there is no reason that should not be something upstream should accept changing, anyway the ubuntu desktop team doesn't have the ressources to work on such changes so it's a contributor or upstream wishlist

[Tobias Wolf (towolf)]

I feel that unless these integration issues are clearly resolved the Private folder will become a usability debacle.
I think that unless there is really good integration this feature should not be enabled by default.

1. Presentation: to much technical wording at the moment, too much understanding of underlying mechanisms required
2. It's an irregular mount, unlike fstab or gvfs mounts. Not handled by nautilus unmount mechanisms; the copy not move issue, etc
3. Suid root, and hence not configurable and no localization possible
4. Filenames are not encrypted. This is suboptimal for a secure file vault feature.
5. Should be locked/unlocked in situ, i.e., directly in the view of the Private folder. This is only possible upstream, I think.

[Sebastien Bacher (seb128)]

replying to the previous comment, the feature is an ubuntu server one and not a desktop one and it'll not be enabled by default or available on normal installation

[Martin Pitt (pitti)]

I think the worst usability problems would be fixed with nautilus ignoring the ecryptfs mount entirely. This would get rid of the "Private" mount on the desktop and Places menu, and the inability to unmount (which isn't possible for an user anyway), and just keep the "Private" directory. Do you agree?

[Martin Pitt (pitti)]

Test package uploaded to my ppa (https://launchpad.net/~pitti/+archive), and fix sent to upstream for discussion.

[Dustin Kirkland  (kirkland)]

On Tue, Oct 28, 2008 at 4:12 PM, Martin Pitt <email address hidden> wrote:
> I think the worst usability problems would be fixed with nautilus
> ignoring the ecryptfs mount entirely. This would get rid of the
> "Private" mount on the desktop and Places menu

I agree that mounts with filesystem type "ecryptfs" should be ignored
by Gnome, whatever creates the icon on the desktop and link under
Places.

> and the inability to
> unmount (which isn't possible for an user anyway), and just keep the
> "Private" directory. Do you agree?

That's not entirely accurate... A normal user can unmount, but they
have to specifically use /sbin/umount.ecryptfs_private.

However, on the whole, I agree with your direction. Thanks for
opening the upstream bug.

Cheers,
:-Dustin

[Michael Rooney (mrooney)]

On Tue, Oct 28, 2008 at 5:12 PM, Martin Pitt <email address hidden> wrote:
> I think the worst usability problems would be fixed with nautilus
> ignoring the ecryptfs mount entirely.

I think this could be a great improvement, too. For Jaunty I wouldn't
mind working with Dustin and creating a GUI for ecryptfs-utils, if
there is interest, that allows the user to set it up, mount/unmount,
and toggle configuration options (bug #257901). This would allow a
desktop user to go through the whole process without touching a
terminal. Granted [un]mount support in nautilus would be slick.

[Biji (biji)]

Hi martin... i have added your ppa, but which package to update?

[Martin Pitt (pitti)]

Biji [2008-10-29 0:36 -0000]:
> Hi martin... i have added your ppa, but which package to update?

libglib2.0-0_2.18.2-0ubuntu2~ppa1_i386.deb
libglib2.0-data_2.18.2-0ubuntu2~ppa1_all.deb
libglib2.0-dev_2.18.2-0ubuntu2~ppa1_i386.deb

[Martin Pitt (pitti)]

Accepted into intrepid-proposed, please test and give feedback here. Please see https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you in advance!

[Albert Damen (albrt)]

+1

- with libglib2.0-0 from intrepid, the disk icon for Private was shown on several places (desktop, places menu and under places in Nautilus)
- with libglib2.0-0 from intrepid-proposed the disk icons are not shown anymore. Only the Private directory is visible in Nautilus.
- The Private functionality still works fine. After login ~/Private shows the un-encrypted contents. After unmounting .Private, Private only shows the instruction to run mount.ecryptfs_private.

[Martin Pitt (pitti)]

Copied intrepid-proposed to jaunty.

[Nicolò Chieffo (yelo3)]

Some things are still missing:
- directory icon
- move instead of copy on drag and drop
- a way to umount it without using the console

[Martin Pitt (pitti)]

Copied to intrepid-updates.

[Antti Kaihola (akaihola)]

In Lucid with ecryptfs-utils 82-0ubuntu2:

- files are still copied into ~/Private when dragging and dropping
- I can't find a GUI way to unmount ~/Private
- a ~/Private window is NOT refreshed automatically when it's mounted
  (confusing esp. when using the "Access Your Private Data" link)
- a ~/Private window is NOT refreshed automatically when it's unmounted
- ~/Private has no special "encryption" icon

However, these seem to be fixed:

- ~/Private is not listed in Places anymore
- ~/Private doesn't have a mount icon anymore
- filenames are now encrypted