Re: sudo udisksctl

[David Wright <deblis@lionunicorn.co.uk>]

On Sun 18 Feb 2024 at 10:23:52 (+0700), Max Nikulin wrote:
> I have decided to ask the following in a separate thread.
> 
> On 17/02/2024 02:59, David Wright wrote
> (Re: f3tools vs Silicon Power 4T drive):
> >   lulu ()   {     sudo udisksctl unlock --block-device
> > /dev/disk/by-partlabel/Lulu01 && mount /media/lulu01
> >   }
> 
> I am evaluating if udisks2 D-Bus API allows to create a tool as
> convenient as pmount(1) that is smart enough to unlock a device before
> mounting it (optionally with specified name of mountpoint)
> 
>     pmount /dev/sda1 mybackup
> 
> I have puzzled by your function however. I believed that udisks was
> created to allow *regular* users to mount drives. If you are using
> sudo why do not you use "cryptsetup open" directly? Otherwise
> udisksctl can ask password if policy does not allow disk operations
> for the current user.
> 
> P.S. Unfortunately mount name is hardcoded in udisksd. It is either
> label or UUID, it can not be specified when a partition is mounted.

Because policykit allows me to unlock partitions only if they're
local. I rely on being able to unlock partitions remotely. For
example, if I wakeonlan the PC in the basement, I need to be able
to unlock its /home before I can login as myself.

As a demonstration:

  $ hostname
  bhost
  $ udisksctl unlock --block-device /dev/disk/by-partlabel/Nokia01
  Passphrase: 
  Unlocked /dev/sdc1 as /dev/dm-2.
  $ udisksctl lock --block-device /dev/disk/by-partlabel/Nokia01
  Locked /dev/sdc1.
  $ 

is fine, but ssh to a laptop and back to this machine:

  $ ssh ahost
  Linux ahost 5.10.0-27-amd64 #1 SMP Debian 5.10.205-2 (2023-12-31) x86_64
  [ … ]
  You have new mail.
  Last login: Sun Feb 18 04:18:39 2024 from 192.168.1.14
  $ ssh bhost
  Linux bhost 5.10.0-28-amd64 #1 SMP Debian 5.10.209-2 (2024-01-31) x86_64
  [ … ]
  You have new mail.
  Last login: Sun Feb 18 04:18:44 2024 from 192.168.1.16
  $ udisksctl unlock --block-device /dev/disk/by-partlabel/Nokia01
  Passphrase: 
  ==== AUTHENTICATING FOR org.freedesktop.udisks2.encrypted-unlock ===
  Authentication is required to unlock the encrypted device Multiple Card  Reader (/dev/sdc1)
  Authenticating as: root
  Password: 
  [ pressed ^C ]

That's what I'm avoiding with sudo.

Cheers,
David.