Non writeable mountpoint

[holri]

Hello,

just want to share a short script that I wrote to ensure that my unmounted mount point is not writeable.
Without that it was easy to write sensitive data unencrypted to the filesystem by mistake.
My use case for gocryptfs is to work temporary on sensitive data.
Improvements are welcome.

$ cat mount-cryptfs
#!/bin/bash

# The plain mount point of a gocryptfs filesystem should be write protected
# when the directory is not mounted.
# Because otherwise it is easy to permanently write unencrypted confidential files to the filesystem by mistake.
# This script makes it practically safer to use gocrycptfs by making the mount point writeable before mount,
# and making the mount point non writeable after it is no longer mounted.

CIPHERDIR=$1
MOUNTPOINT="$2"
IDLE="${3:-10m}"

chmod +w "$MOUNTPOINT"
gocryptfs -i "$IDLE" "$CIPHERDIR" "$MOUNTPOINT"
(while grep "$MOUNTPOINT" /proc/self/mounts 1> /dev/null; do sleep 1 ; done; chmod -w "$MOUNTPOINT")&

related issues:
#526
#647

[rfjakob]

Good idea! I wonder if gocryptfs should do this by itself. What do you think?

[holri]

Personally I am a fan of the Unix Philosophy of doing one thing and do it well. I do not think it is necessarily the scope of an encryption program to ensure mount points are only readable.

Here is an improved version:

#!/bin/bash

# The plain mount point of a gocryptfs filesystem should be write protected
# when the directory is not mounted.
# Because otherwise it is easy to permantly write unencrypted confidental files to the filesystem by mistake.
# This script makes it practically safer to use gocrycptfs by making the mount point writeable before mount,
# and making the mount point non writeable after it is no longer mounted.

#set -x
CIPHERDIR=$(readlink -e "$1")
MOUNTPOINT=$(readlink -e "$2")
IDLE="${3:-10m}"

function is-mounted  {
    grep -E "$MOUNTPOINT(type)? fuse\.gocryptfs" /proc/self/mounts 1> /dev/null
}

if is-mounted; then
    >&2 echo "$MOUNTPOINT is already mounted"
    exit 100
fi

chmod +w "$MOUNTPOINT"
chmod +w "$CIPHERDIR"
gocryptfs -q -i "$IDLE" "$CIPHERDIR" "$MOUNTPOINT"
EXIT=$?
(while is-mounted; do sleep 1 ; done; chmod -w "$MOUNTPOINT";chmod -w "$CIPHERDIR";)&
exit $EXIT