Bugzilla – Bug 1087749
pam_mount with LUKS encrypted /home partition unwarily umounts /home at logout
Last modified: 2018-05-04 11:52:31 UTC
LUKS-encrypted /home partition gets un-mounted at logout of any user, even when there are still other users logged in, effectively kicking them out. The /home partition (common to all users) as a whole is encrypted - for collaboration reasons, we don't use individual /home/<user> containers separately encrypted. Details: The /home partition is a LUKS device on /dev/sda4, with passwords of several users in the LUKS device's key slots. Concurrent login of several users works, but logging out any one of them kicks all others out, due to /home being forcibly umount'ed. This is unacceptable for a workstation used by several users - even root is affected when its login shell happens to have 'cd'ed into any of the /home subbdirectories. Furthermore, it renders the "Switch User" function of the (KDE) login screen useless: user A logs in, leaves the desktop and his screen locks up, user B "switches user" to himself, does its work and logs out again - user A is kicked off the system, loosing all unsaved work. How the volume was created and users were added: # cryptsetup --verify-passphrase --use-random --header-backup-file=/root/home.LUKS luksFormat /dev/sda4 # cryptsetup --verify-password luksAddKey /dev/sda4 In /etc/security/pam_mount.conf.xml, the following options are set: <logout wait="2000" hup="no" term="yes" kill="yes" /> Changing this does not help, as pam_mount uses the "ofl" tool from the "hxtools" package to TERMinate or KILL processes still using /home/user. According to "man ofl", it can NOT differentiate between processes of different users, effectively killing ALL processes still having anything open in /home.
I'm just an openSUSE user. But it seems to me that this is your mistake. As I read the description of pam_mount, it is supposed to mount an encrypted directory during login, and unmount at logout. From your description, it seems to be doing exactly what it is supposed to do. If you have an encrypted "/home" partition, then the normal practice would be to mount that during boot. The encryption key would be supplied while booting. And the directory would remain mounted until the computer is shutdown or rebooted. You apparently have several people whose login password can unlock that encrypted partition. So any of those could boot the computer and use their login key during boot, for mounting "/home".
I wouldn't call it a "mistake", but a "strange setup". For one: it works as designed and this is a security feature: whenever a person logs out who has mounted an encrypted partition, this partition will be unmounted as to protect that person's data. As you write "Changing this [/etc/security/pam_mount.conf.xml file] the does not help ...": have you tried setting ALL THREE "hup", "term", AND "kill" to "no"? It prevents pam_mount from sending the corresponding signal using ofl and thus the umount would fail UNLESS no-one happens to have an open file in the file system. Otherwise I see no way to solve this problem.
Closing as INVALID as it works as designed.