Bug ID | 1087749 |
---|---|
Summary | pam_mount with LUKS encrypted /home partition unwarily umounts /home at logout |
Classification | openSUSE |
Product | openSUSE Distribution |
Version | Leap 42.3 |
Hardware | i686 |
OS | openSUSE 42.3 |
Status | NEW |
Severity | Normal |
Priority | P5 - None |
Component | Basesystem |
Assignee | bnc-team-screening@forge.provo.novell.com |
Reporter | ChG@posteo.de |
QA Contact | qa-bugs@suse.de |
Found By | --- |
Blocker | --- |
LUKS-encrypted /home partition gets un-mounted at logout of any user, even when there are still other users logged in, effectively kicking them out. The /home partition (common to all users) as a whole is encrypted - for collaboration reasons, we don't use individual /home/<user> containers separately encrypted. Details: The /home partition is a LUKS device on /dev/sda4, with passwords of several users in the LUKS device's key slots. Concurrent login of several users works, but logging out any one of them kicks all others out, due to /home being forcibly umount'ed. This is unacceptable for a workstation used by several users - even root is affected when its login shell happens to have 'cd'ed into any of the /home subbdirectories. Furthermore, it renders the "Switch User" function of the (KDE) login screen useless: user A logs in, leaves the desktop and his screen locks up, user B "switches user" to himself, does its work and logs out again - user A is kicked off the system, loosing all unsaved work. How the volume was created and users were added: # cryptsetup --verify-passphrase --use-random --header-backup-file=/root/home.LUKS luksFormat /dev/sda4 # cryptsetup --verify-password luksAddKey /dev/sda4 In /etc/security/pam_mount.conf.xml, the following options are set: <logout wait="2000" hup="no" term="yes" kill="yes" /> Changing this does not help, as pam_mount uses the "ofl" tool from the "hxtools" package to TERMinate or KILL processes still using /home/user. According to "man ofl", it can NOT differentiate between processes of different users, effectively killing ALL processes still having anything open in /home.