Assign labels to an encfs mount point

Asked by madumlao

Is it possible to assign labels to the encfs mount point so that they have a different name than the directory name?

For instance, I have several hard disks that all have a .crypt-raw / crypt pair of folders for the encrypted stash and mountpoint. In the menu list, they will all appear as ".crypt" making it confusing which one I'm mounting.

Can we instead have a label on each filesystem so that I can see something like:
Private files
Top secret work
confidential passwords

in the menu instead of
.crypt
.crypt
.crypt

Question information

Language:
English Edit question
Status:
Expired
For:
Gnome Encfs Manager Edit question
Assignee:
No assignee Edit question
Last query:
Last reply:
Revision history for this message
Moritz Molch (mmolch) said :
#1

Thank you for your question.
What you probably want to do is to rename the mount points to fit your descriptions because that basename is shown in GEnfsM's menu, by nautilus and several other file managers.

Revision history for this message
madumlao (madumlao) said :
#2

That is a workaround, but that is not what I want to do.

Consider a situation where you have multiple external hard disks, each with a volume label, but each having their own encrypted directory. For instance you have the following named disks:

Popeye
Olive
Brutus

What you are suggesting is that each share will have a unique name which would help the user identify the disk. Thus
/media/username/Popeye/Popeye_secret_pictures
/media/username/Olive/Olive_confidential_government_Secrets
/media/username/Brutus/brutus_documents

Effectively, you are simply repeating yourself in the filenames. Furthermore, there is slight security risk as well. If the disk were not unmounted properly and opened elsewhere (not unlikely! imagine if the disk were grabbed when nobody was looking) the directory name would suggest the contents of the encrypted stash. An attacker would know to spend more effort cracking the Olive disk because of the filename suggestion.

Finally, there'a also a matter of taste. Not everyone would like this scheme because it is inconsistent with how people use their external disks. In many disks, it is reasonable to have similar directory structures, for instance
pictures
videos
documents
etc.

It is semantically meaningful for the subdirectories to have "generic" names in the case of the above. Thus it is also semantically meaningful for the "encrypted" directory to have a generic name. For example:
Popeye/private
Olive/private
Brutus/private

Under this scheme it is meaningful to the user that the contents are encrypted, there is no security risk (outside of the encfs stash itself being cracked) if the disk is grabbed. The user can immediately tell from the file explorer or full path which disk is which, but they cannot tell from a dropdown menu if the dropdown only features the last part of the directory name.

Isn't it reasonable for a "description" tag to be added in gencfsm?

Revision history for this message
Moritz Molch (mmolch) said :
#3

The mountpoint is by default deleted when the stash is not mounted and you can simply name the mount points "Popeye/Popeye private" etc. GEncfsM once had labels but that was discarded in favor of using nautilus' way of showing mounted filesystems. I generally don't recommend to make mountpoints on external devices when using GEncfsM and having all mountpoints in one folder instead because GEncfsM tries to mimic GVFS' and udisks' behaviour in that regard.
In short: Labels won't come back and maybe GEncfsM just isn't the right tool for you if you want to have that kind of setup.

Revision history for this message
madumlao (madumlao) said :
#4

Regarding mountpoint name security:
Deleting the mountpoint cannot be relied on as an approach if someone will grab the usb disk when you're not looking, because the mountpoint won't be unmounted cleanly. This isn't a weakness of gencfsm, this is a weakness of using meaningful names in an encfs mountpoint at all, and may not be good advice to give anyone that uses externally mounted encfs.

Regarding gvfs behavior:
If you're trying to go with gvfs behavior, I still don't think relying on the folder name is correct. In gvfs, the mountpoint is independent of the filesystem label (as most filesystems actually do have labels) although by default gvfs will use the filesystem label as the basis of the mountpoint. Nautilus will show the filesystem label, if present, if not, the uuid and size, not the mountpoint. As best as I can recall, similarly labeled filesystems in gvfs will be shown using the label in nautilus, not the mountpoint, which will be affixed with a number if there are duplicate labels. So there, nautilus behavior uses labels, not mountpoints.

The only thing is that encfs doesn't have a filesystem label like ext3 does, and it isn't actually appropriate for the filesystem label (if there is one) to be unencrypted.

On changing the name:
If the user already has scripts and tools relying on the full path, then changing the name of the path would break possibly dozens of programs, symlinks, etc. That's a rather steep price to pay for the convenience of a readable menu item.

How about a compromise? If you show 2 levels of path instead of one (Popeye/private, Olive/private, etc), or otherwise vary the level of path shown based on whether there are duplicates in the menu, then you get to keep label-less behavior while making the system an order of magnitude more convenient for users with many encrypted stashes.

Revision history for this message
madumlao (madumlao) said :
#5

You can test the nautilus behavior I'm talking about using the following:

1) Have a usb disk labelled foo
2) create the directory /media/$USER/foo (or wherever gvfs will normally create the mountpoint on hotplug)
3) plug in the usb disk
4) ls /media/$USER - you should see foo and foo1. foo is the empty directory you created. foo1 will be the mountpoint of the usb disk.
5) open nautilus and look at the list of mounted devices. The list should say foo (based on the usb disk).
6) click the usb disk and look at the location bar. The mountpoint will be /media/$USER/foo1.

This should show that nautilus / gvfs behavior relies on labels, not mountpoints. Labels are read from the mount device / source, rather than based on the directory name of the destination.

Revision history for this message
Moritz Molch (mmolch) said :
#6

I was referring to mount point management that is being mimicked because they are by default dynamically created / deleted.
And as for the name shown in nautilus: create a mount point in your home directory, mount a stash there and see how it shows up in nautilus. it willl be the basename....

And a I said before, if you don't like the behaviour then use a different tool. You could also use stash groups to organize the menu or fork GEncfsM and make it any way you like because

Revision history for this message
Moritz Molch (mmolch) said :
#7

... because it's free and open source after all :-)

Revision history for this message
madumlao (madumlao) said :
#8

> And as for the name shown in nautilus: create a mount point in your home directory, mount a stash there and see how it shows up in nautilus. it willl be the basename....

I'm having trouble duplicating your example, because as far as I know, encfs mountpoints do not show up as mountpoints in nautilus, because encfs does not have a gvfs backend. I might be mistaken.

All other backends that I can think of appear in the list of nautilus mountpoints with their _label_, not their mountpoint name. In the example I gave above with the USB disk, it can easily be demonstrated that gvfs will create a numbered mountpoint basename, but nautilus will show the filesystem label, NOT the basename. So I still think it is appropriate for a label attribute to exist, possibly to be stored in the gvfs metadata.

Revision history for this message
Moritz Molch (mmolch) said :
#9

They show up if the mountpoint is in the home, gvfs or media directory.

Revision history for this message
madumlao (madumlao) said :
#10

:)

It would seem the reason my encfs wasn't appearing in nautilus was that the mountpoint name started with a "."

Nevertheless the point still stands wrt to other gvfs filesystem behavior having labels. I don't understand why showing a more meaningful mountpoint name, or even just the full mointpoint in the indicator menu, is so antithetical to the software.

Revision history for this message
Launchpad Janitor (janitor) said :
#11

This question was expired because it remained in the 'Open' state without activity for the last 15 days.