pam_mount issuing errors when unmounting e.g. a encrypted volume during logoff

This document (7024289) is provided subject to the disclaimer at the end of this document.

Environment

SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Desktop 12

Situation

System is setup to mount a encrypted volume during user logon using pam_mount:

Volume setup is described in https://documentation.suse.com/sles/15-SP1/html/SLES-all/cha-security-cryptofs.html

Resp. the manual way:

- Create user 'user1'

- Setup a loop device to be used as encrypted volume
- cryptsetup luksFormat --type luks2 /dev/loop0 (type doesn't matter if luks1 or luks2)
- Create file /etc/pam_mount_keys/user1.key with a password contained
- cryptsetup luksAddKey /dev/loop0 /etc/pam_mount_keys/user1.key
- cryptsetup luksOpen /dev/loop0 enc_loop
- mkfs.ext4 -L USER1 /dev/mapper/enc_loop
- cryptsetup luksClose enc_loop

To make use of pam_mount, install the package from the SLES repositories and

- Add the following in /etc/security/pam_mount.conf.xml

<volume user="user1" path="/dev/loop0" mountpoint="~"
fstype="crypt" fskeycipher="none"
fskeypath="/etc/pam_mount_keys/user1.key" />
- Add pam_mount.so as optional in /etc/pam.d/common-session and /etc/pam.d/common-auth
- Login with user user1 and check if the volume is mounted.

When logging off user1 the encrypted volume stays opened and the home directory still is mounted.
In syslog pam_mount logs:

> Oct 01 16:00:00 host1 systemd[12345]: (pam_mount.c:538): *** PAM_MOUNT WAS INVOKED WITH INSUFFICIENT PRIVILEGES. (euid=1000)
> Oct 01 16:00:00 host1 systemd[12345]: (pam_mount.c:539): *** THIS IS A BUG OF THE CALLER. CONSULT YOUR DISTRO.
> Oct 01 16:00:00 host1 systemd[12345]: (pam_mount.c:540): *** Also see bugs.txt in the pam_mount source tarball/website documentation.

Resolution


A simple work-around is to add the following line just before the "pam_mount.so" in /etc/pam.d/common-session:

session [success=1 default=ignore] pam_succeed_if.so service = systemd-user

Example common-session for a working setup:

session optional        pam_systemd.so
session required        pam_limits.so
session required        pam_unix.so     try_first_pass 
session optional        pam_umask.so
session optional        pam_env.so
session [success=1 default=ignore] pam_succeed_if.so service = systemd-user
session optional        pam_mount.so

Cause

There are actually two problems: the (PAM-) session closing process "(sd-pam)"
1) is killed prematurely and
2) does not have the proper privileges to clean up what was set up during session opening.

So it's not caused by pam_mount alone but systemd has its stake, too, 
see https://github.com/systemd/systemd/issues/14029.

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.