ecryptfs-devel team mailing list archive

["Li, Yan I" <yan.i.li@xxxxxxxxx>]

On Tue, Jan 05, 2010 at 11:46:16PM +0800, Dustin Kirkland wrote:
> All of the instructions and commands should be clearly described here:
>  * http://blog.dustinkirkland.com/2009/06/migrating-to-encrypted-home-directory.html

Got it, thank you.

> I think I would prefer it written in POSIX shell script, as all of the
> operations are ultimately shell operations.  However, you could
> alternatively write it in Python or C.  Those would be my preferences,
> in that order (Shell, Python, C).

Great, I'm also following the style from other shell scripts in the
project (thought I still can't figure out how to tell Emacs to use TAB
for shell script indention :).

> Now, for safety's sake, I strongly insist that the user should *not*
> be logged into the system while this migration happens.  

Sure. I'm running an lsof check at the beginning.

>                                                        So let's call
> the tool, /usr/sbin/ecryptfs-encrypt-home, for instance.  On an
> installed system, it should only be run by the root user, targeted at
> another user's home directory, and the root user will need to know (or
> reset) the non-root-user's password, and would need to ensure that the
> target user is not logged in.  It should also be usable from a LiveCD
> distribution, such as the Ubuntu Desktop LiveCD.  This would be the
> safest, and recommended way of doing this, in my opinion.
> 
> As for the reboot approach, I'm not too sure how that would work.  If
> that's the approach you'd really like to take, give me a little more
> detail on how that would shake out.

I want to support encrypting an user's home _in place_, initiated from
a non-root user, and I've deviced that reboot method. That will be
most user-friendly, won't it? Basically when you run this tool as a
normal user, it just writes a tag file ~/.ENCRYPT_THIS_HOME inside
your home. And on next reboot, the script is run (by an rc scipt) and
scans every home for this file and encrypts home that has this file in
it. It's quite simple actually. It's nearly done. I'll post my draft
script in a few days.

Of course, running as root and encrypting any user's home can also
easily be supported.

> If you'd like to discuss this further, I would be happy to help guide
> you.  We can continue this either in email, or in IRC on #ecryptfs at
> irc.oftc.net.

Thank you!

-- 
Best regards,
Li, Yan

Moblin Team, Opensource Technology Center, SSG, Intel
Office tel.: +86-10-82171695 (inet: 8-758-1695)
OpenPGP key: 5C6C31EF
IRC: yanli on network irc.freenode.net

Attachment: signature.asc
Description: Digital signature