mount.crypt(8)

✨ NAME ✨

okay so bestie, say hi to mount.crypt — she mounts a dm-crypt encrypted volume for you 💖 (this one lives in the pam_mount manual, section 8, iykyk)

🎀 SYNTAX 🎀

literally just:

mount.crypt [-nrv] [-o options] device directory

device, then directory. that's the whole vibe. no cap. 🦋

💅 OPTIONS 💅

• -o options — pass extra mount options through here. mount.crypt is gonna swipe out the options that are hers, then hand the leftovers straight to the underlying mount program. all the possible ones are down below, keep scrolling bestie 👇
• -n — do NOT update /etc/mtab. and like, be aware of the consequence: once you do this you can't unmount the volume by naming the container anymore — you have to pass the mountpoint to umount.crypt instead. it's giving commitment issues fr fr 💀
• -r — sets up the loop device (if it's needed) and the crypto device in read-only mode. and yeah, the mount itself is necessarily read-only too, that's just how it goes. heads up though: doing a remount with `mount /mnt -o remount,rw` will NOT make the mount read-write. you'd have to disassociate the crypto and loop devices first. no shortcuts, periodt 😭
• -v — turn on debugging and be a bit more verbose. she's yapping, and honestly? we love that for her 🌸

🌈 MOUNT OPTIONS 🌈

• header — a detached (aka separated) metadata file where the LUKS header is stored. it correlates with the `cryptsetup --header` option. if you omit it, the detached LUKS header feature just isn't used. simple as that 💜
• allow_discard — enables discard passthrough support. ok important: this does not cause the filesystem to be mounted with discard enabled — it just allows fstrim to be run manually. she's granting permission, not doing the thing 🫶
• no_read_workqueue — bypass the internal workqueue and process read requests synchronously. efficient queen 👑
• no_write_workqueue — bypass the internal workqueue and process write requests synchronously. matching set, iconic ✨
• cipher — the cryptsetup cipher used for the encrypted volume. this one is mandatory for PLAIN (non-LUKS) volumes, so don't skip it. also fun fact: pmt-ehd(8) defaults to creating volumes with "aes-cbc-essiv:sha256" as a cipher 🎀
• crypto_name — pick the name for the crypto device (optional). rn this option is only usable with dm-crypt systems 💫
• fsck — run fsck on the container before mounting it. self-care check-up before the big event 💖
• fsk_cipher — the OpenSSL cipher used for the filesystem key. there's a special keyword, "none", that bypasses decryption and passes the file contents directly to libcryptsetup. sneaky but valid 🧚
• fsk_hash — the OpenSSL hash used for producing key and IV. 🔐
• fstype — the exact type of filesystem inside the encrypted container. the default is to just let the kernel autodetect. trust the process 🌸
• hash — the cryptsetup hash used for the encrypted volume. this defaults to no hashing, because pam_mount assumes EHD volumes with strong and simple fskey generation. periodt 💅
• keyfile — the path to the key file. this option is mandatory for "normal" crypto volumes and should not be used for LUKS volumes. read that twice bestie 🙈
• remount — causes the filesystem to be remounted with new options. now listen, this one's got lore: mount.crypt cannot switch the underlying loop device (if it applies) or the crypto device between read-only and read-write once it's been created. only the actual filesystem mount can be changed, and even then, with limits. if the loop device is read-only, the crypto device will be read-only, and changing the mount to read-write is impossible. similarly, going from rw to ro will only mark the mount read-only, but not the crypto or loop device — which makes it impossible to set the filesystem the crypto container is located on to read-only. yeah. it's a whole thing. plan accordingly 😭
• ro — same as the -r option. twins 👯
• verbose — same as the -v option. also twins 💜

🕰️ OBSOLETE MOUNT OPTIONS 🕰️

this section is provided for reference, so like, historical archive vibes 🏛️

• loop — this option used to set up a loop device, back when cryptsetup(8) expected a block device. it's ignored now, because mount.crypt can figure this out on her own. she's grown 💅✨

and that's the whole page bestie!! this one came from the pam_mount crew, dated 2011-12-15 — yes she's an elder but she still ate, and honestly? iconic behavior. go mount something encrypted, love u, bye 🫶💖🌈