[ Content | Sidebar ]

Unlocking Encrypted Home Partition on Login

September 22nd, 2019

I recently did a new Debian install on my laptop after upgrading the NVMe and this time round I set up LUKS disk encryption for my /home partition. I want this to be as hassle-free as possible, which means having the partition automatically unlocked and mounted when I log in, rather than having to type a separate password on boot.

It’s not as straightforward as you might think, I guess because everyone’s setup and requirements are a little different. So I’ll write my notes here in case it’s useful to someone else. I’m doing this on Debian, but I cribbed a lot of it from the excellent Arch wiki.

When first setting up the encrypted partition make sure that the disk password is the same as your login password. This will be important later.

The file /etc/crypttab is read early in boot by systemd (see its crypttab map page). Systemd then calls cryptsetup on each entry in this file to unlock the partition. This is where the boot time password prompt that we want to get rid of comes from. Simply add noauto to options list at the end and systemd will skip it:

nvme0n1p3_crypt UUID=XXXX-XXXX none luks,discard,noauto

Also edit /etc/fstab to comment out or remove the entry for /home: we’ll be using pam_mount to do this directly.

sudo apt install libpam-mount

This is a PAM plugin that can mount arbitrary filesystems whenever a user logs in and unmount them when they log out. We can also use it to unlock and encrypted partition using the user’s password before mounting. This is why the login password and the disk password must be the same. Open /etc/security/pam_mount.conf.xml and add these lines to it:

<volume user="nick" fstype="crypt" path="/dev/nvme0n1p3"                        
        mountpoint="nvme0n1p3_crypt" />                                         
 
<volume user="nick" fstype="auto" path="/dev/mapper/nvme0n1p3_crypt"            
        mountpoint="/home" options="defaults,relatime,discard" />                       
 
<cryptmount>cryptsetup open --allow-discards %(VOLUME) %(MNTPT)</cryptmount>    
<cryptumount>cryptsetup close %(MNTPT)</cryptumount>

We need to add two <volume> entries. The first with fstype="crypt" unlocks the physical LUKS partition (/dev/nvme0n1p3) and creates a new volume that we can mount as a normal filesystem (/dev/mapper/nvme0n1p3_crypt). Obviously change the user name and physical device path to match your system.

The <cryptmount> and <cryptumount> entries tell pam_mount how to open and close the encrypted partition when fstype="crypt". Note that I’ve added the --allow-discard option here which enables the SSD TRIM command to reduce wear on the disk, but has some security implications which you might want to read up on.

Reboot and check everything works. If you have problems try adding:

<debug enable="1" />

to pam_mount.conf.xml and log in on a text console. This will print some diagnostic messages.

Nanpu Bridge

August 14th, 2019

Time was this blog had a bit of an obsession with bridges. I think it might have started with Naburn railway bridge. Anyway that source of content seems to have dried up of late so here’s a very large bridge a short subway trip from home.

This is the Nanpu bridge in Shanghai. The 57th longest cable-stayed bridge in the world. Hull’s got a longer one 😏.

You can take a ferry across the river and underneath the bridge which is quite fun, and there’s a walking path along both banks.

Long Time No Suzhou

August 11th, 2019

I went back to Suzhou for a weekend recently and visited a few new places, mostly around Mudu (木渎) to the west of the city.

Taiping mountain scenic area

Net master garden

I’ve been to Suzhou so many times but this was the first time I made it to Taihu, one of China’s largest inland lakes.

Taihu lake

And finally I visited Mudu old town. But sadly I got there too late to go in any of the attractions.

Mudu old street

Linus Torvalds

July 13th, 2019

I finally saw Linus Torvalds live! I think, however, reading his online rants is considerably more interesting than watching a staged conversation. 🙃

Making Emacs GUD Usable

June 9th, 2019

Emacs provides a wrapper for various debuggers including GDB called the Grand Unified Debugger (GUD). I’ve tried it in the past but always run into lots of minor annoyances with the UI so I just use command line GDB instead. But recently I’ve being trying to adopt a more “Emacs native” workflow, including using EShell instead of a separate terminal window for Bash, Magit instead of command line git, ERC for IRC, etc. So let’s see if we can fix these GUD problems…

Basic configuration

(setq gdb-many-windows t
      gdb-use-separate-io-buffer t)

The default mode of GUD just creates a single window with the the normal GDB terminal. This doesn’t seem to offer much over running GDB directly. The “many windows” mode splits the screen into six separate windows showing the current source file, locals/registers, output, etc.

Source file opens in the wrong window

By default if you jump to a source file from e.g. the stack trace window it will open on top of the command input window (labeled “2” below) rather than the source file window “1”.

This seems to be “normal” behaviour, and there are loads of threads on Stack Overflow complaining about it but with no conclusive solution. E.g. see here or here.

The problem here is that GUD makes all the popup windows “dedicated” except for the command window. When you jump to a file it opens in the first non-dedicated window, which sort-of makes sense. The function that sets up the windows is called gdb-setup-windows so we can use Emacs’ “advice” system to hook this function and run some extra code afterwards to make the command window dedicated:

(advice-add 'gdb-setup-windows :after
            (lambda () (set-window-dedicated-p (selected-window) t)))

This works because gdb-setup-windows always leaves the command window selected when it finishes.

Quitting messes up the window configuration

How do you quit anyway? I think the correct way is just to run quit in the command window. But no matter how you quit GUD always messes up whatever window configuration you had before you opened it.

We can fix that by saving the window layout when we run M-x gdb by storing the layout into a register in gud-mode-hook. The gud-sentinal function runs when some event occurs on the inferior gdb process. We can hook that to restore the window state when the process exits.

(defconst gud-window-register 123456)
 
(defun gud-quit ()
  (interactive)
  (gud-basic-call "quit"))
 
(add-hook 'gud-mode-hook
          (lambda ()
            (gud-tooltip-mode)
            (window-configuration-to-register gud-window-register)
            (local-set-key (kbd "C-q") 'gud-quit)))
 
(advice-add 'gud-sentinel :after
            (lambda (proc msg)
              (when (memq (process-status proc) '(signal exit))
                (jump-to-register gud-window-register)
                (bury-buffer))))

I’ve bound C-q to gud-quit which send the quit command to GDB to save typing.

Zhouzhuang

May 14th, 2019

I went to Zhouzhuang ancient town a few weeks for a day trip. It takes just an hour or so by bus from Shanghai, and because of that it’s extremely crowded on the weekend and also very commercialised. There’s also not many indoor attractions and museums to visit, just a lot of shops. The town is just 10km from Tongli which I thought was much more picturesque and authentic so you might as well just go there, although I haven’t been back since it got connected to the Suzhou metro. I want to go back to Anhui for a weekend sometime, as I really enjoyed visiting the old towns there a few years ago.

Big Wheel

May 2nd, 2019

On a clear day I can see in the distance a very tall tower-like thing from my apartment. On closer inspection it’s a giant Ferris wheel! It’s about 45 minutes walk away, near Shanghai south railway station. As it’s 108 metres tall and Shanghai is totally flat, from the top you ought to be able to see everything, but unfortunately the day I went was a bit hazy / polluted.

Bottom of the wheel…

At the top! I can see my apartment from here!

The wheel is attached to a fairground

It was almost sunset the first time round. Here’s a bonus night photo!

Guilin Park

April 14th, 2019

There’s a really nice garden a few metro stops away from where I live (the station is also called “Guilin Park”). It only costs 1元 to go in! It’s not as impressive as some of the gardens I visited in Suzhou but it’s quite pleasant for a few hours on a Sunday afternoon. Especially with the cherry blossoms in spring…

Pandas

February 28th, 2019

I forgot to post anything from my work trip to Chengdu last year. A bit late, but I saw pandas for the first time ever!

Panda, eating some leaves

In a sort of semi-wild panda sanctuary. The best bit was when one of them climbed up a tree, looked around, and then climbed/fell down again. Otherwise they lived up to their reputation and didn’t do very much.

Panda, in a tree

Two pandas, playing?

Qibao Old Town

December 28th, 2018

Here’s another of these traditional water towns. It would be quite unremarkable if it wasn’t in the Shanghai suburbs, which makes it very easy to get to (it’s actually just a few km from where I live). But this also means it’s full of tourists and very over commercialised. It’s definitely worth an hour or two walking around though. Getting there is really easy: just take subway line 9 to “Qibao” and the follow the signs to the old town.