-
Notifications
You must be signed in to change notification settings - Fork 98
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Feature Request: Enable some way for pam_fscrypt to not lock policies on logout #357
Comments
Hi, I didn't see this and replied on #281 where the option was removed. My use case is a partially headless machine with the occasional VM and where long-running processes are often executed under screen or tmux: when I logout from the SSH session now everything gets locked. If there is a way to prevent locking when screen/tmux are running that would be good enough for me without needing an option to disable it globally, but I couldn't find anything that worked. |
On the master branch, |
I just tested 0.3.3 with this patch added and it works as expected, thank you very much! |
My use case is the following:
Normally, I have a a directory (say
/mnt/foo/bar
) that is unlocked whenever I login, and is protected by my login passphrase. It usespam_fscrypt
to automatically unlock directorybar
, and everything works fine. This directory's contents are also read by system services running on the machine.However, things get weird if I manually unlock the directory. This sometimes is necessary to fix system bugs (unrelated to fscrypt) or when accessing the computer over SSH (where I don't provide a passphrase on login). Even if I manually unlock the directory with a different, non-login protector, the directory is locked on logout.
This is different from the behavior of a directory only protected with a non-login protector, where it will not be locked on logout.
I see some potential ways to make this more user-friendly:
pam_fscrypt
to just disable directory locking on logout.@ebiggers what are your thoughts here?
The text was updated successfully, but these errors were encountered: