Topic: Hyperbola setup and user programs
From
"Bringing my .cwmrc to Hyperbola" thread:
As I understand it, you also decrypt disks or usb using the
terminal.What do you think about scripts to automate this process? Can you write
complex scripts?
I don't encrypt full disks as I don't see the usefulness to, putting a
password in BIOS is simpler if needed to protect the system itself at
boot, but even then you can't know that the disks haven't been removed
and executables changed unless you sign them or reinstall the whole
system. But a line in an init script that would decrypt some file using a password at
startup with aescrypt2 for example, and encrypt it at shutdown is a good way of
protecting privacy.
Regarding full usb encryption, use fscrypt:
https://wiki.archlinux.org/title/Fscrypt#ext4.
Compile and install fscryptctl:
https://github.com/google/fscryptctl/bl … README.md.
and follow the instructions
For auto_mounting, you can add a udev rule, for example (supposing you want to enter the password in dmenu):
(inspired by
https://stackoverflow.com/questions/451 … ell-script)
/lib/udev/rules.d/10-usb-decryption-automount.rules
// SPDX-License-Identifier: BSD-3-Clause
ACTION=="add", KERNEL=="sdb[0-9]", SUBSYSTEM=="block", RUN+="auto-mount"
ACTION=="remove", KERNEL=="sdb[0-9]", SUBSYSTEM=="block", RUN+="auto-mount"
/usr/bin/auto-mount
// SPDX-License-Identifier: BSD-3-Clause
#!/bin/sh
Name=$(basename $0)
Logger="/usr/bin/logger -p local3.info -t $Name "
Message="$* $DEVNAME $ACTION $ID_FS_LABEL"
$Logger <<< $Message
usb_add ()
{ Message="automounting $DEVNAME $ID_FS_LABEL"
$Logger <<< $Message
/sbin/mount $DEVNAME /mnt && $Logger <<< "mounted" ||
$Logger <<< "failed"
dmenu < /dev/null | fscryptctl add_key /mnt
}
pico_remove ()
{ Message="umounting $DEVNAME $ID_FS_LABEL"
$Logger <<< $Message
/sbin/umount -f /mnt && $Logger <<< "umounted" || $LOGGER "failed"
}
usb_$ACTION
then: udevadm control --reload-rules && udevadm trigger