mount.ecryptfs_private(1)

✨ mount.ecryptfs_private ✨

okay bestie, so this is a page from the ecryptfs-utils manual set, section 1 — aka the "commands you actually run" section 💅

---

🎀 NAME 🎀

mount.ecryptfs_private — the eCryptfs private mount helper, your lil' ride-or-die for mounting your secret folder 🔐

---

🌸 SYNOPSIS 🌸

mount.ecryptfs_private [ALIAS]

GIRL. LISTEN. This program does not dynamically load the relevant keys. Because of that, it is recommended that you use ecryptfs-mount-private(1) instead! no cap, that's straight from the source 😭

---

💖 DESCRIPTION 💖

mount.ecryptfs_private is a mount helper utility for non-root users to cryptographically mount a private directory — ~/Private by default. yes, you, a mere mortal, no sudo required, we love to see it 🫶

This program optionally takes one argument, ALIAS. If ALIAS is omitted, it just defaults to using "Private" with:

• $HOME/.Private as the SOURCE
• $HOME/Private as the DESTINATION
• $HOME/.ecryptfs/Private.sig for the key signatures

If ALIAS is specified, then it goes looking for an fstab(5)-style configuration in:

• $HOME/.ecryptfs/ALIAS.conf

and for the key signature(s) in:

• $HOME/.ecryptfs/ALIAS.sig

---

The mounting will proceed if, and only if:

• the required passphrase is in the kernel keyring, and
• the current user owns both the SOURCE and DESTINATION mount points
• the DESTINATION is not already mounted

(three little vibe checks and if any one of them fails, it's a no from the mount 🚫)

---

So what does this program actually do? It will:

• mount SOURCE onto DESTINATION
• as an ecryptfs filesystem
• using the AES cipher
• with a key length of 16 bytes
• using the passphrase whose signature lives in ~/.ecryptfs/Private.sig

The only setuid operation in this whole program is the call to mount(8) or umount(8). that's it, that's the whole privilege moment 👑

---

Quick lore drop: the ecryptfs-setup-private(1) utility is what creates the ~/.Private and ~/Private directories, generates a mount passphrase, wraps that passphrase, and writes the ~/.ecryptfs/Private.sig. so it's giving setup bestie, and this program is giving mounting bestie 🤝

Also, your system administrator can add the pam_ecryptfs.so module to the PAM stack, which will automatically use the login passphrase to unwrap the mount passphrase, add the passphrase to the user's kernel keyring, and automatically perform the mount. See pam_ecryptfs(8) for the whole tea ☕✨

---

🦋 FILES 🦋

• ~/.Private — underlying directory containing encrypted data
• ~/Private — mountpoint containing decrypted data (when mounted)
• ~/.ecryptfs/Private.sig — file containing signature of mountpoint passphrase
• ~/.ecryptfs/wrapped-passphrase — mount passphrase, encrypted with the login passphrase

---

🌈 SEE ALSO 🌈

ecryptfs(7), ecryptfs-rewrap-passphrase(1), ecryptfs-setup-private(1), keyctl(1), mount(8), umount.ecryptfs_private(1), pam_ecryptfs(8), fstab(5)

/usr/share/doc/ecryptfs-utils/ecryptfs-faq.html

http://ecryptfs.org/

---

👑 AUTHOR 👑

This manpage and the mount.ecryptfs_private utility was written by Dustin Kirkland <kirkland@ubuntu.com> for Ubuntu systems (but may be used by others). Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation.

On Debian and Ubuntu systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.

---

mwah 💋 that's the whole page — ecryptfs-utils, dated 2008-07-21, and it's mount.ecryptfs_private(1) forever and ever. go mount something cute, bestie 🎀✨