-
Notifications
You must be signed in to change notification settings - Fork 300
Non writeable mountpoint #957
holri
started this conversation in
Show and tell
Hello,
just want to share a short script that I wrote to ensure that my unmounted mount point is not writeable.
Without that it was easy to write sensitive data unencrypted to the filesystem by mistake.
My use case for gocryptfs is to work temporary on sensitive data.
Improvements are welcome.
$ cat mount-cryptfs
#!/bin/bash
# The plain mount point of a gocryptfs filesystem should be write protected
# when the directory is not mounted.
# Because otherwise it is easy to permanently write unencrypted confidential files to the filesystem by mistake.
# This script makes it practically safer to use gocrycptfs by making the mount point writeable before mount,
# and making the mount point non writeable after it is no longer mounted.
CIPHERDIR=1ドル
MOUNTPOINT="2ドル"
IDLE="${3:-10m}"
chmod +w "$MOUNTPOINT"
gocryptfs -i "$IDLE" "$CIPHERDIR" "$MOUNTPOINT"
(while grep "$MOUNTPOINT" /proc/self/mounts 1> /dev/null; do sleep 1 ; done; chmod -w "$MOUNTPOINT")&
All reactions
-
👍 1
Replies: 1 comment 1 reply
Good idea! I wonder if gocryptfs should do this by itself. What do you think?
All reactions
1 reply
Personally I am a fan of the Unix Philosophy of doing one thing and do it well. I do not think it is necessarily the scope of an encryption program to ensure mount points are only readable.
Here is an improved version:
#!/bin/bash
# The plain mount point of a gocryptfs filesystem should be write protected
# when the directory is not mounted.
# Because otherwise it is easy to permantly write unencrypted confidental files to the filesystem by mistake.
# This script makes it practically safer to use gocrycptfs by making the mount point writeable before mount,
# and making the mount point non writeable after it is no longer mounted.
#set -x
CIPHERDIR=$(readlink -e "1ドル")
MOUNTPOINT=$(readlink -e "2ドル")
IDLE="${3:-10m}"
function is-mounted {
grep -E "$MOUNTPOINT(type)? fuse\.gocryptfs" /proc/self/mounts 1> /dev/null
}
if is-mounted; then
>&2 echo "$MOUNTPOINT is already mounted"
exit 100
fi
chmod +w "$MOUNTPOINT"
chmod +w "$CIPHERDIR"
gocryptfs -q -i "$IDLE" "$CIPHERDIR" "$MOUNTPOINT"
EXIT=$?
(while is-mounted; do sleep 1 ; done; chmod -w "$MOUNTPOINT";chmod -w "$CIPHERDIR";)&
exit $EXIT
All reactions
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment