mhogomchungu / zuluCrypt

zuluCrypt is a front end to cryptsetup and tcplay and it allows easy management of encrypted block devices
https://mhogomchungu.github.io/zuluCrypt
Other
496 stars 61 forks source link

Fix mount-prefix=home for `sudo zuluMount-cli` #165

Closed acochrane closed 2 years ago

acochrane commented 3 years ago

This enables a sudo call to mount the encrypted volume within the calling user's home directory.

EXAMPLE user1@hostname$ sudo zuluMount-cli -m -d Documents/file_container -z mount_dir -e mount-prefix=home will result in the encrypted volume being mounted at /home/user1/mount_dir.

I was unable to accomplish this without running as sudo, and with the sudo wrapper, the uid is set to 0.

mhogomchungu commented 3 years ago

Did you try to use -K $UID option?

It is explained here[1] as the first explanation on item number one and it is also in man page[2]

[1 https://github.com/mhogomchungu/zuluCrypt/wiki/zuluCryt-cli-howto] [2] https://github.com/mhogomchungu/zuluCrypt/blob/d1509759b8dc6e74d3700a5899fccf5c679df4a7/zuluCrypt-cli.1#L109-L111

acochrane commented 3 years ago

I did not find that in any of my searches, seems like a good flag to advertise in the options message for zuluMount-cli. Also, a link to the wiki in the readme would be helpful.

mhogomchungu commented 3 years ago

If i understand your changes, they unconditionally override uid variable in only two code paths if it see a "SUDO_UID" env variable, what about the rest of code paths that use this uid? This change will give inconsistent behavior.

What happens if a user gains root privileges using pkexec? Again, inconsistent behavior.

My recommendations are:-

  1. Support both sudo and pkexec
  2. Do not override user provided -K option.
  3. Make your changes here[1] and they will show up everywhere in both zuluCrypt-cli and zuluMount-cli.
  4. Your changes should be in the else branch

[1] https://github.com/mhogomchungu/zuluCrypt/blob/d1509759b8dc6e74d3700a5899fccf5c679df4a7/zuluCrypt-cli/bin/security.c#L86

mhogomchungu commented 2 years ago

Rejecting this one because i just committed a better solution and its here[1]

[1] https://github.com/mhogomchungu/zuluCrypt/commit/3309233f240ca7316f5ad38b849372a0369994db