This file is indexed.

/usr/bin/ecryptfs-setup-private is in ecryptfs-utils 111-0ubuntu1.

This file is owned by root:root, with mode 0o755.

The actual contents of the file can be viewed below.

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
#!/bin/sh
# This script sets up an ecryptfs mount in a user's ~/Private
#
# Originally ecryptfs-setup-pam-wrapped.sh by Michael Halcrow, IBM
#
# Ported for use on Ubuntu by Dustin Kirkland <kirkland@ubuntu.com>
# Copyright (C) 2008 Canonical Ltd.
# Copyright (C) 2007-2008 International Business Machines
PRIVATE_DIR="Private"
WRAPPING_PASS="LOGIN"
ECRYPTFS_DIR="/home/.ecryptfs"
PW_ATTEMPTS=3
TEXTDOMAIN="ecryptfs-utils"
MESSAGE="$(gettext 'Enter your login passphrase')"
CIPHER="aes"
KEYBYTES="16"
FNEK=

# Zero out user-defined GREP_OPTIONS, such as --line-number
GREP_OPTIONS=

usage() {
	echo "
Usage:

$0 [-f|--force] [-w|--wrapping] [--nopwcheck] [-n|--no-fnek]
  [-u|--username USER] [-l|--loginpass LOGINPASS]
  [-m|--mountpass MOUNTPASS]

 -f, --force      Force overwriting of an existing setup
 -w, --wrapping   Use an independent wrapping passphrase,
                  different from the login passphrase
 -n, --no-fnek    Do not encrypt filenames; If this flag is
                  omitted, and the kernel supports filename
                  encryption, then filenames will be encrypted
 -u, --username   Username for encrypted private mountpoint,
                  defaults to yourself
 -l, --loginpass  Login/Wrapping passphrase for USER,
                  used to wrap MOUNTPASS
 --nopwcheck      Do not check the validity of the specified
                  login password (useful for LDAP user accounts)
 --noautomount    Setup this user such that the encrypted private
                  directory is not automatically mounted on login
 --noautoumount   Setup this user such that the encrypted private
                  directory is not automatically unmounted at
                  logout
 -m, --mountpass  Passphrase for mounting the ecryptfs directory,
                  defaults to randomly generated $KEYBYTES bytes
 -b, --bootstrap  Bootstrap a new user's entire home directory
                  Generates a random mount passphrase, which
		  will be wrapped when the new login passphrase
		  is set. SHOULD ONLY BE CALLED FROM 'adduser'.
 --undo           Provide instructions on how to undo an
                  encrypted private setup

   Be sure to properly escape your parameters according to your
   shell's special character nuances, and also surround the
   parameters by double quotes, if necessary.
"
	exit 1
}

undo_msg() {
	echo "
In the event that you want to remove your eCryptfs Private Directory setup,
you will need to very carefully perform the following actions manually:

 1. Obtain your Private directory mountpoint
   $ PRIVATE=\`cat ~/.ecryptfs/Private.mnt 2>/dev/null || echo \$HOME/$PRIVATE_DIR\`
 2. Ensure that you have moved all relevant data out of your \$PRIVATE directory
 3. Unmount your encrypted private directory
   $ ecryptfs-umount-private
 4. Make your Private directory writable again
   $ chmod 700 \$PRIVATE
 5. Remove \$PRIVATE, ~/.Private, ~/.ecryptfs
    Note: THIS IS VERY PERMANENT, BE VERY CAREFUL
   $ rm -rf \$PRIVATE ~/.Private ~/.ecryptfs
 6. Uninstall the utilities (this is specific to your Linux distribution)
   $ sudo apt-get remove ecryptfs-utils libecryptfs0
"
}

error() {
	echo "$(gettext 'ERROR: ')" "$@" 1>&2
	exit 1
}

error_testing() {
	rm -f "$1" >/dev/null
	shift
	/sbin/umount.ecryptfs_private >/dev/null
	error "$@"
	exit 1
}

random_passphrase () {
	bytes=$1
	# Pull $1 of random data from /dev/random,
	# and convert to a string of hex digits
	od -x -N $bytes --width=$bytes /dev/random | head -n 1 | sed "s/^0000000//" | sed "s/\s*//g"
}

filename_encryption_available() {
	version=$(cat /sys/fs/ecryptfs/version 2>/dev/null)
	[ -z "$version" ] && error "$(gettext 'Cannot get ecryptfs version, ecryptfs kernel module not loaded?')"
	[ $(($version & 0x100)) -eq 0 ] && return 1
	return 0
}

filename_encryption_available && FNEK="--fnek"

if [ ! -z "$SUDO_USER" ]; then
	USER="$SUDO_USER"
fi

while [ ! -z "$1" ]; do
	case "$1" in
		-u|--username)
                        USER="$2"
			shift 2
		;;
		-l|--loginpass)
			LOGINPASS="$2"
			shift 2
		;;
		-m|--mountpass)
			MOUNTPASS="$2"
			shift 2
		;;
		-w|--wrapping)
			WRAPPING_PASS="INDEPENDENT"
			MESSAGE="$(gettext 'Enter your wrapping passphrase')"
			shift 1
		;;
		-f|--force)
			FORCE=1
			shift 1
		;;
		--nopwcheck)
			NOPWCHECK=1
			shift 1
		;;
		--noautomount)
			NOAUTOMOUNT=1
			shift 1
		;;
		--noautoumount)
			NOAUTOUMOUNT=1
			shift 1
		;;
		--undo)
			undo_msg
			exit 0
		;;
		-b|--bootstrap)
			[ `whoami` = "root" ] || error "$(gettext 'You must be root to bootstrap encrypt a home directory')"
			BOOTSTRAP=1
			MOUNTPASS=`random_passphrase $KEYBYTES`
			RANDOM_MOUNTPASS=1
			shift 1
		;;
		-n|--no-fnek)
			FNEK=
			shift 1
		;;
		*)
			usage
		;;
	esac
done

# Prompt for the USER name, if not on the command line and not in the env
if [ -z "$USER" ]; then
	while [ true ]; do
		echo -n "$(gettext 'Enter the username: ')"
		USER=`head -n1`
		echo
		if [ -z "$USER" ]; then
			echo "$(gettext 'ERROR: ')" "$(gettext 'You must provide a username')"
			continue
		else
			# Verify that the user exists
			if ! id "$USER" >/dev/null; then
				echo "$(gettext 'ERROR: ')" "$(gettext 'User does not exist')" " [$USER]"
				continue
			fi
			break
		fi
	done
else
	# Verify that the user exists
	id "$USER" >/dev/null || error "$(gettext 'User does not exist')" "[$USER]"
fi

# Obtain USER's primary group
GROUP=$(id -g $USER)

# Check if the ecryptfs group exists, and user is member of ecryptfs group
if grep -qs "^ecryptfs:" /etc/group; then
	if ! id "$USER" | grep -qs "\(ecryptfs\)"; then
	       error "$(gettext 'User needs to be a member of ecryptfs group')"
	fi
fi

# Obtain the user's home directory
HOME=`getent passwd "$USER" | awk -F: '{print $6}'`
if [ ! -d "$HOME" ]; then
	error "$(gettext 'User home directory does not exist')" "[$HOME]"
fi

if [ "$BOOTSTRAP" = "1" ]; then
	# If we want to encrypt the entire homedir, we need the .ecryptfs
	# config dir elsewhere, but linked into the homedir
	mkdir -p -m 700 $ECRYPTFS_DIR/$USER/.ecryptfs 
	ln -sf $ECRYPTFS_DIR/$USER/.ecryptfs $HOME/.ecryptfs
	ln -sf $ECRYPTFS_DIR/$USER/.$PRIVATE_DIR $HOME/.$PRIVATE_DIR
	MOUNTPOINT="$HOME"
	CRYPTDIR="$ECRYPTFS_DIR/$USER/.$PRIVATE_DIR"
else
	mkdir -p -m 700 $HOME/.ecryptfs
	MOUNTPOINT="$HOME/$PRIVATE_DIR"
	CRYPTDIR="$HOME/.$PRIVATE_DIR"
fi

# Check for previously setup private directory
if [ -s "$HOME/.ecryptfs/wrapped-passphrase" -a "$FORCE" != "1" ]; then
	error "$(gettext 'wrapped-passphrase file already exists, use --force to overwrite.')"
fi
if [ -s "$HOME/.ecryptfs/$PRIVATE_DIR.sig" -a "$FORCE" != "1" ]; then
	error "$PRIVATE_DIR.sig" "$(gettext 'file already exists, use --force to overwrite.')"
fi

# Check for active mounts
grep -qs "$MOUNTPOINT " /proc/mounts && error "[$MOUNTPOINT]" "$(gettext 'is already mounted')"
grep -qs "$CRYPTDIR " /proc/mounts && error "[$CRYPTDIR]" "$(gettext 'is already mounted')"

# Check that the mount point and encrypted directory are empty (skip symlinks).
# Perhaps one day we could provide a migration mode (using rsync or something),
# but this would be VERY hard to do safely.
count=`ls -Al "$MOUNTPOINT" 2>/dev/null | egrep -c "^[drwx-]{10}"`
if [ "$count" != "0" ]; then
	error "$MOUNTPOINT" "$(gettext 'must be empty before proceeding')"
fi
count=`ls -Al "$CRYPTDIR" 2>/dev/null | egrep -c "^[dlrwx-]{10}"`
if [ "$count" != "0" ]; then
	error "$CRYPTDIR" "$(gettext 'must be empty before proceeding')"
fi

stty_orig=`stty -g`
# Prompt for the LOGINPASS, if not on the command line and not in the env
if [ -z "$LOGINPASS" ] && ( [ "$BOOTSTRAP" != "1" ] || [ "$ECRYPTFS_MIGRATE" = "1" ] ); then
	tries=0
	while [ $tries -lt $PW_ATTEMPTS ]; do
		stty -echo
		echo -n "$MESSAGE [$USER]: "
		LOGINPASS=`head -n1`
		stty $stty_orig
		echo
		if [ $WRAPPING_PASS != "LOGIN" -o ! -x /sbin/unix_chkpwd ]; then
			# If we can't check the accuracy of the user's entered
			# passphrase, force them to type it twice (matching)
			stty -echo
			echo -n "$MESSAGE [$USER] (again): "
			LOGINPASS2=`head -n1`
			stty $stty_orig
			echo
			if [ "$LOGINPASS" != "$LOGINPASS2" ]; then
				echo "$(gettext 'ERROR: ')" "$(gettext 'Wrapping passphrases must match')"
			else
				break
			fi
			tries=$(($tries + 1))
			continue
		fi
		if [ -z "$LOGINPASS" ]; then
			echo "$(gettext 'ERROR: ')" "$(gettext 'You must provide a login passphrase')"
			tries=$(($tries + 1))
		else
			if [ "$NOPWCHECK" = "1" ]; then
				echo "$(gettext 'INFO:')" "$(gettext 'Skipping password verification')"
				break
			else
				if printf "%s\0" "$LOGINPASS" | /sbin/unix_chkpwd "$USER" nullok; then
					break
				else
					echo "$(gettext 'ERROR: ')" "$(gettext 'Your login passphrase is incorrect')"
					tries=$(($tries + 1))
				fi
			fi
		fi
	done
	if [ $tries -ge $PW_ATTEMPTS ]; then
		error "$(gettext 'Too many incorrect password attempts, exiting')"
	fi
fi

# Prompt for the MOUNTPASS, if not on the command line and not in the env
if [ -z "$MOUNTPASS" ]; then
	tries=0
	while [ $tries -lt $PW_ATTEMPTS ]; do
		stty -echo
		echo -n "$(gettext 'Enter your mount passphrase [leave blank to generate one]: ')"
		MOUNTPASS=`head -n1`
		stty $stty_orig
		echo
		if [ -z "$MOUNTPASS" ]; then
			MOUNTPASS=`random_passphrase $KEYBYTES`
			RANDOM_MOUNTPASS=1
			break
		else
			stty -echo
			echo -n "$(gettext 'Enter your mount passphrase (again): ')"
			MOUNTPASS2=`head -n1`
			stty $stty_orig
			echo
			if [ "$MOUNTPASS" != "$MOUNTPASS2" ]; then
				echo "$(gettext 'ERROR: ')" "$(gettext 'Mount passphrases do not match')"
				tries=$(($tries + 1))
			else
				break
			fi
		fi
	done
	if [ $tries -ge $PW_ATTEMPTS ]; then
		error "$(gettext 'Too many incorrect passphrase attempts, exiting')"
	fi
fi

echo
echo "************************************************************************"
echo "$(gettext 'YOU SHOULD RECORD YOUR MOUNT PASSPHRASE AND STORE IT IN A SAFE LOCATION.')"
echo "  ecryptfs-unwrap-passphrase ~/.ecryptfs/wrapped-passphrase"
echo "$(gettext 'THIS WILL BE REQUIRED IF YOU NEED TO RECOVER YOUR DATA AT A LATER TIME.')"
echo "************************************************************************"
echo

###############################################################################

# Setup private directory in home
mkdir -m 700 -p "$CRYPTDIR" || error "$(gettext 'Could not create crypt directory')" "[$CRYPTDIR]"
mkdir -m 700 -p "$MOUNTPOINT" || error "$(gettext 'Could not create mount directory')" "[$MOUNTPOINT]"
ln -sf /usr/share/ecryptfs-utils/ecryptfs-mount-private.txt "$MOUNTPOINT"/README.txt
ln -sf /usr/share/ecryptfs-utils/ecryptfs-mount-private.desktop "$MOUNTPOINT"/Access-Your-Private-Data.desktop
chmod 500 "$MOUNTPOINT"

# Setup ~/.ecryptfs directory
if [ "$NOAUTOMOUNT" = "1" ]; then
	echo "$(gettext 'INFO:')" "$HOME/$PRIVATE_DIR" "$(gettext 'will not be mounted on login')"
else
	touch $HOME/.ecryptfs/auto-mount || error "$(gettext 'Could not setup ecryptfs auto-mount')"
fi
if [ "$NOAUTOUMOUNT" = "1" ]; then
	echo "$(gettext 'INFO:')" "$HOME/$PRIVATE_DIR" "$(gettext 'will not be unmounted on logout')"
else
	touch $HOME/.ecryptfs/auto-umount || error "$(gettext 'Could not setup ecryptfs auto-umount')"
fi

if [ "$WRAPPING_PASS" = "LOGIN" ]; then
	rm -f $HOME/.ecryptfs/wrapping-independent || error "$(gettext 'Could not remove ecryptfs wrapping-independent')"
else
	touch $HOME/.ecryptfs/wrapping-independent || error "$(gettext 'Could not setup ecryptfs wrapping-independent')"
fi


# Backup any existing wrapped-passphrase or sig files; we DO NOT destroy this
timestamp=`date +%Y%m%d%H%M%S`
for i in "$HOME/.ecryptfs/wrapped-passphrase" "$HOME/.ecryptfs/$PRIVATE_DIR.sig"; do
	if [ -s "$i" ]; then
		mv -f "$i" "$i.$timestamp" || error "(gettext 'Could not backup existing data')" "[$i]"
	fi
done

# Setup wrapped-passphrase file
u=`umask`
umask 377
if [ -z "$LOGINPASS" ] && [ "$BOOTSTRAP" = "1" ]; then
	# This will be wrapped by pam_ecryptfs's chauthtok as soon as the user
	# chooses a password.  Until that happens (hopefully soon), standard
	# file permissions (600) are all that's protecting it.  Write it to
	# ramdisk, to keep it from leaking to the hard-drive.
	temp=`mktemp /dev/shm/.ecryptfs-XXXXXX`
	printf "%s" "$MOUNTPASS" > "$temp"
	mv -f -T "$temp" "/dev/shm/.ecryptfs-$USER" || error "Could not create passphrase file"
else
	printf "%s\n%s" "$MOUNTPASS" "$LOGINPASS" | ecryptfs-wrap-passphrase "$HOME/.ecryptfs/wrapped-passphrase" - || error "$(gettext 'Could not wrap passphrase')"
fi
umask $u

# Add the passphrase to current keyring
# On subsequent logins, this should be handled by "pam_ecryptfs.so unwrap"
response=`printf "%s" "$MOUNTPASS" | ecryptfs-add-passphrase $FNEK -`
if [ $? -ne 0 ]; then
	error "$(gettext 'Could not add passphrase to the current keyring')"
fi
sig=`echo "$response" | grep "Inserted auth tok" | sed "s/^.*\[//" | sed "s/\].*$//"`
if ! echo "$sig" | egrep -qs "^[0-9a-fA-F]{$KEYBYTES,$KEYBYTES}$"; then
	error "$(gettext 'Could not obtain the key signature')"
fi
temp=`mktemp`
echo "$sig" > "$temp" || error "$(gettext 'Could not create signature file')" "[$HOME/.ecryptfs/$PRIVATE_DIR.sig]"
mv "$temp" "$HOME/.ecryptfs/$PRIVATE_DIR.sig"
which restorecon 2>/dev/null && restorecon "$HOME/.ecryptfs/$PRIVATE_DIR.sig" > /dev/null 2>&1
temp=`mktemp`
echo "$MOUNTPOINT" > "$temp" || error "$(gettext 'Could not create mountpoint file')" "[$HOME/.ecryptfs/$PRIVATE_DIR.mnt]"
mv "$temp" "$HOME/.ecryptfs/$PRIVATE_DIR.mnt"
which restorecon 2>/dev/null && restorecon "$HOME/.ecryptfs/$PRIVATE_DIR.mnt" > /dev/null 2>&1

echo
echo "$(gettext 'Done configuring.')"
echo

# Link the user and session keyrings
keyctl link @u @s
# Skip the tests if we're in bootstrap mode, but exit with the encrypted
# homedir mounted
if [ "$BOOTSTRAP" = "1" ]; then
	# Force the mount here, since the root user has the key loaded,
	# and the calling 'adduser' is about to copy over /etc/skel
	# NOTE: it is the responsibility of 'adduser' to unmount!
	# And ensure that $USER owns the files/dirs we've created as root
	chown $USER:$GROUP "$CRYPTDIR" /dev/shm/.ecryptfs-$USER
	chown -R $USER:$GROUP $ECRYPTFS_DIR/$USER
	chown -R $USER:$GROUP $MOUNTPOINT
	if [ "$FNEK" = "--fnek" ]; then
		fnek_sig=`tail -n 1 "$HOME/.ecryptfs/$PRIVATE_DIR.sig"`
		sig=`head -n 1 "$HOME/.ecryptfs/$PRIVATE_DIR.sig"`
		sig_opt="ecryptfs_sig=$sig,ecryptfs_fnek_sig=$fnek_sig"
	else
		sig_opt="ecryptfs_sig=$sig"
	fi
	# Do the mount, and provide some helpful symlinks
	mount -i -t ecryptfs -o "rw,$sig_opt,ecryptfs_cipher=$CIPHER,ecryptfs_key_bytes=$KEYBYTES" "$CRYPTDIR" "$MOUNTPOINT" || error "Could not mount"
	ln -sf $ECRYPTFS_DIR/$USER/.ecryptfs $MOUNTPOINT/.ecryptfs
	ln -sf $ECRYPTFS_DIR/$USER/.$PRIVATE_DIR $MOUNTPOINT/.$PRIVATE_DIR
	chown -R $USER:$GROUP $ECRYPTFS_DIR/$USER
	chown -R $USER:$GROUP $MOUNTPOINT
	exit 0
fi

# Now let's perform some basic mount/write/umount/read sanity testing...
echo "$(gettext 'Testing mount/write/umount/read...')"
printf "%s" "$MOUNTPASS" | ecryptfs-add-passphrase $FNEK -
/sbin/mount.ecryptfs_private || error "$(gettext 'Could not mount private ecryptfs directory')"
temp=`mktemp "$MOUNTPOINT/ecryptfs.test.XXXXXX"` || error_testing "$temp" "$(gettext 'Could not create empty file')"
random_data=`head -c 16000 /dev/urandom | od -x` || error_testing "$temp" "$(gettext 'Could not generate random data')"
echo "$random_data" > "$temp" || error_testing "$temp" "$(gettext 'Could not write encrypted file')"
md5sum1=`md5sum "$temp"` || error_testing "$temp" "$(gettext 'Could not read encrypted file')"
/sbin/umount.ecryptfs_private || error_testing "$temp" "$(gettext 'Could not unmount private ecryptfs directory')"
printf "%s" "$MOUNTPASS" | ecryptfs-add-passphrase $FNEK -
/sbin/mount.ecryptfs_private || error_testing "$temp" "$(gettext 'Could not mount private ecryptfs directory (2)')"
md5sum2=`md5sum "$temp"` || error_testing "$temp" "$(gettext 'Could not read encrypted file (2)')"
rm -f "$temp"
# Use ecryptfs-umount-private on the final run, to clear the used keys
# out of the keyring
ecryptfs-umount-private || error_testing "$temp" "$(gettext 'Could not unmount private ecryptfs directory (2)')"
if [ "$md5sum1" != "$md5sum2" ]; then
	error "$(gettext 'Testing failed.')"
else
	echo "$(gettext 'Testing succeeded.')"
fi

echo
echo "$(gettext 'Logout, and log back in to begin using your encrypted directory.')"
echo

exit 0