Encrypted directories without the ecryptfs magic

mkdir ~/private
chmod 700 ~/private

Manual mounts and sudoers

# Cmnd alias specification
Cmnd_Alias MOUNTPRIVATE = /bin/mount /path/to/private /path/to/private -t \
ecryptfs -o key\=passphrase\,ecryptfs_cipher\=aes\,ecryptfs_key_bytes\=24\,\
ecryptfs_passthrough\=no\,ecryptfs_enable_filename_crypto\=yes\,\
no_sig_cache\=yes

Cmnd_Alias UMOUNTPRIVATE = /bin/umount /path/to/private

# Your username goes here, obviously
aphyr ALL=(ALL) NOPASSWD:MOUNTPRIVATE, UMOUNTPRIVATE

A simple alias setup

alias mount_private="sudo mount ~/private ~/private -t \
ecryptfs -o key=passphrase,ecryptfs_cipher=aes,ecryptfs_key_bytes=24,\
ecryptfs_passthrough=no,ecryptfs_enable_filename_crypto=yes,\
no_sig_cache=yes"
alias umount_private="sudo umount ~/private"

  • Run mount_private and pick a passphrase.
  • umount_private tears the directory down.

The default ecryptfs-private behavior relies on automatic login mounts and opaque system hooks to hide ciphertext. A hand-rolled mount command sidesteps that entirely, and can be wired into autostart scripts or screen-lock triggers as needed.

Open questions remain: pointing ecryptfs at a sig cache other than root's homedir, or permitting unprivileged mounts without resorting to suid. No answers yet, only workarounds.