I'm attempting to roll out eCryptFS support for users on our RHEL infrastructure. One large snag has come up.
Given a user with no root access and (preferably) without the use of
sudo, how would one go about allowing that user to mount an arbitrary ecryptfs directory under their home folder?
The reason for not making an
fstab entry is that, with thousands of users, individual mount points defined in
fstab would turn it into a huge unmaintainable mess. Also, we would prefer arbitrary directories.
We definitely don't want to enable a profile-wide encryption scheme, and do not want these directories to be automatically mounted upon login.
Currently, the solution involves providing sudo access to a specific script to perform the locational logic and get the credentials for mounting. This is not a particularly good solution. Setting the SUID bit on a script is completely out of the question.