Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 564894 - sys-fs/ecryptfs-utils: mount.ecryptfs_private doesn't work unless suid flag is set
Summary: sys-fs/ecryptfs-utils: mount.ecryptfs_private doesn't work unless suid flag i...
Status: CONFIRMED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: No maintainer - Look at https://wiki.gentoo.org/wiki/Project:Proxy_Maintainers if you want to take care of it
URL: https://bugs.launchpad.net/ecryptfs/+...
Whiteboard:
Keywords: NeedPatch
Depends on:
Blocks:
 
Reported: 2015-11-04 22:07 UTC by Nick Kossifidis
Modified: 2020-08-17 02:15 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Nick Kossifidis 2015-11-04 22:07:30 UTC
mount.ecryptfs_private needs elevated privileges to mount() the user's encrypted "private" folder (e.g. the one that was set up by ecryptfs-setup-private). There are two ways to do that:

a) Have mount.ecryptfs_private marked with the suid bit and owned by root so that it always runs as root (that introduces a security risk and portage will print a warning about it)

b) Use file system capabilities and mark mount.ecryptfs_private with cap_dac_read_search,cap_setgid,cap_setuid,cap_sys_admin+ep and not require the suid bit set (sys_admin to mount(), setuid/setgid because it sets its uid/gid to 0 internally and dac_read_search because normally the private directory -the mountpoint- is only accessible by the user -not by root, at least not without dac_read_search-).

Currently only the first option is available when enabling the suid USE flag, without it mount.ecryptfs_private won't work and the user won't know until he/she tries to use it. It would be much better to print a warning message to alert the user that by not using the suid flag he/she won't be able to use mount.ecryptfs_private. Also it would be much better if the ebuild supported the filecaps USE flag and made the second option available to the users.
Comment 1 Adrien D 2019-12-31 10:53:24 UTC
Hi,
Same problem and same fix : add setuid on mount.ecryptfs_private.
Comment 2 Larry the Git Cow gentoo-dev 2020-08-02 22:51:45 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=7d45f1c02b7588cfc8882c44ac0663c040a511dc

commit 7d45f1c02b7588cfc8882c44ac0663c040a511dc
Author:     Aaron Bauman <bman@gentoo.org>
AuthorDate: 2020-08-02 22:49:23 +0000
Commit:     Aaron Bauman <bman@gentoo.org>
CommitDate: 2020-08-02 22:51:26 +0000

    package.mask: last-rite sys-fs/ecryptfs-utils
    
    Bug: https://bugs.gentoo.org/735486
    Bug: https://bugs.gentoo.org/564894
    Bug: https://bugs.gentoo.org/704356
    Bug: https://bugs.gentoo.org/715938
    Bug: https://bugs.gentoo.org/697778
    Bug: https://bugs.gentoo.org/715508
    Signed-off-by: Aaron Bauman <bman@gentoo.org>

 profiles/package.mask | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)
Comment 3 Sam James archtester gentoo-dev Security 2020-08-17 02:13:01 UTC
Upstream seems dead unfortunately. I've fixed all of the bugs I can though.

Also added an upstream bug reference here.