Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feature Request: Enable some way for pam_fscrypt to not lock policies on logout #357

Closed
josephlr opened this issue May 16, 2022 · 3 comments · Fixed by #367
Closed

Feature Request: Enable some way for pam_fscrypt to not lock policies on logout #357

josephlr opened this issue May 16, 2022 · 3 comments · Fixed by #367

Comments

@josephlr
Copy link
Member

josephlr commented May 16, 2022

My use case is the following:

Normally, I have a a directory (say /mnt/foo/bar) that is unlocked whenever I login, and is protected by my login passphrase. It uses pam_fscrypt to automatically unlock directory bar, and everything works fine. This directory's contents are also read by system services running on the machine.

However, things get weird if I manually unlock the directory. This sometimes is necessary to fix system bugs (unrelated to fscrypt) or when accessing the computer over SSH (where I don't provide a passphrase on login). Even if I manually unlock the directory with a different, non-login protector, the directory is locked on logout.

This is different from the behavior of a directory only protected with a non-login protector, where it will not be locked on logout.

I see some potential ways to make this more user-friendly:

  • When unlocking the directory, print a message to the user if it will be autolocked on logout.
  • Only auto-lock policies that were unlocked with the login passphrase (maybe this should be opt-in?)
  • A non-default options to pam_fscrypt to just disable directory locking on logout.

@ebiggers what are your thoughts here?

@plumbeo
Copy link

plumbeo commented Oct 12, 2022

Hi, I didn't see this and replied on #281 where the option was removed.

My use case is a partially headless machine with the occasional VM and where long-running processes are often executed under screen or tmux: when I logout from the SSH session now everything gets locked.

If there is a way to prevent locking when screen/tmux are running that would be good enough for me without needing an option to disable it globally, but I couldn't find anything that worked.

ebiggers added a commit that referenced this issue Oct 18, 2022
Now that it's been requested by users, bring back the "unlock_only"
option, which was originally proposed as part of
#281 but was dropped in the final
version of that pull request.

Resolves #357
ebiggers added a commit that referenced this issue Oct 19, 2022
Now that it's been requested by users, bring back the "unlock_only"
option, which was originally proposed as part of
#281 but was dropped in the final
version of that pull request.

Resolves #357
ebiggers added a commit that referenced this issue Oct 20, 2022
Now that it's been requested by users, bring back the "unlock_only"
option, which was originally proposed as part of
#281 but was dropped in the final
version of that pull request.

Resolves #357
@ebiggers
Copy link
Collaborator

On the master branch, pam_fscrypt supports the unlock_only option now. @plumbeo can you check whether it works for you?

@plumbeo
Copy link

plumbeo commented Oct 20, 2022

I just tested 0.3.3 with this patch added and it works as expected, thank you very much!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants