Re: [gentoo-user] [OT encfs] When encfs gets hungup

[Albert Hopkins]

On Friday, July 8 at 11:55 (-0500), Harry Putnam said:

[..]
> Somehow I managed to really hurt the installation ... here is what I
> remember having done:
>
> Some how I got mixed up when running as root, and attempted to mount a
> users encfs directory.  (Its a single user machine so it my users
> directory)
>
> That should just fail with some kind of permission error since no one,
> even root, can mess with someone elses' encfs directory.
>
This is not entirely the case.  No one can enter an encfs mount
(destination) but the person that mounted it (by default), but anyone
can *mount* the encfs "source" (and thus become the owner of the mount).
All other Unix permissions are retained.

> But once I'd done that I could no longer even `ls' the subject
> directory.  Not as user, not as root.  A simple `ls' would totally
> hang the terminal.
>
> Of course I tried to umount but really it never actually mounted.
>
It probably *did* mount, but...

> I started getting this error: `Transport endpoint is not connected'
>
Usually that means the background process that actually handles the
enc/dec has died or is otherwise not responding.

> I could see roots attempt to mount the darn thing in ps wwaux output
> and killed that pid.
>
That's probably why you got the above error.  But technically if you
just kill the process, the kernel still thinks it's mounted.

> Eventually (after posting several days ago on encfs list.  I resorted
> to umounting /home (after full backup of course) and reformatted it.
>
That's seems a bit extreme...

> I was then able to deleted encfs_raw and encfs_mnt.
>
Did you try simply rebooting or manually unmounting?  That's probably
all that was needed.

> But here is the real kicker.  Even after all that, and in fact another
> full round of mostly the same stuff, including another reformat.  So
> two reformats and two reboots.  Even with that, I still cannot create a
> new enc_raw and enc_mount of the same name as the old one.
>
What do you mean by "cannot"?  Do you get an error?  Does dmesg tell you
anything?

> I would like to, because I have several scripts that depend on that
> name.  Not a huge deal... but what could still be causing trouble?
>
This is indicative possibly of another issue, that is being masked.  Try
reading dmesg or strace the encfs process in foreground mode.

> I can create any number of encfs directories with different names.
> Just not the original.
>
Again, seems indicative of another issue.  Perhaps the host fs is
currupt or something similar.

> What happens if I try is that after creation (using old name) I can
> move files to the new (with old name) directory.
>
> But if I once umount it like: fusermount -u /my/oldencfs, then when I
> try next to mount it, it hangs terminally.  Takes over the terminal
> and kills all further progress (in that terminal).  This happens at
> the point where I answer the passwd prompt with the appropriate
> passwd.
>
> (No .. no chance I'm entering it wrong... its been in daily use for
> yrs).
>
> I'm kind of stumped at what else to try.  I've used encfs -v (verbose)
> mode and -f (foreground) mode but after entering the passwd... it
> all just goes south... nothing more can happen.
>
> Maybe encfs keeps data somewhere that I can delete and make this go
> away?  But a `qlist encfs', listing all that got installed doesn't show
> anything like that.
>
If you totally remove the source and target directories, there is no
other information stored, which allows you to (e.g) encfs directory on a
vfat-formated USB stick and move it mount it on a different machine.
All that encfs knows about an encrypted directory is in *one* file on
the source directory (.encfs6.xml).  Once that file is gone, there is no
such thing as an encfs.

Having said that:
One of encfs's Achilles heel is its dependency on the boost C++ library
which is *very* sensitive wrt to API/ABI changes and the like.  It also
depends on OpenSSL which also shares this notoriety (although, in my
experience, less so).  So there is a possibility that an update to any
of those packages may have broken encfs and you need to rebuild the
package.