From aadc01383b16efac43a048fa5fe693ccffc67111 Mon Sep 17 00:00:00 2001 From: Kyle Isom Date: Tue, 24 Mar 2026 09:36:40 -0700 Subject: [PATCH] Fix privileged mount for unlocked-but-not-mounted devices When a device was unlocked via arca's cryptsetup path (FIDO2/TPM2) but not yet mounted, the mount command tried the udisks2 path which failed with "Not authorized". Now detects arca-managed mappings by checking /dev/mapper/arca-* and uses privileged mount automatically. Co-Authored-By: Claude Opus 4.6 (1M context) --- cmd/mount.go | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) diff --git a/cmd/mount.go b/cmd/mount.go index 59a6dc0..f026670 100644 --- a/cmd/mount.go +++ b/cmd/mount.go @@ -3,11 +3,13 @@ package cmd import ( "fmt" "os" + "strings" "git.wntrmute.dev/kyle/arca/internal/config" "git.wntrmute.dev/kyle/arca/internal/cryptsetup" "git.wntrmute.dev/kyle/arca/internal/udisks" "git.wntrmute.dev/kyle/arca/internal/unlock" + "git.wntrmute.dev/kyle/arca/internal/verbose" "github.com/spf13/cobra" "golang.org/x/term" ) @@ -57,7 +59,18 @@ func runMount(cmd *cobra.Command, args []string) error { fmt.Println(existing) return nil } - // Unlocked but not mounted — just mount it. + // Unlocked but not mounted — mount it. If the mapper name + // indicates arca opened it via cryptsetup (privileged path), + // use privileged mount since udisks2 won't authorize it. + if isPrivilegedMapping(dev) { + verbose.Printf("detected arca-managed mapping, using privileged mount") + mnt, err := cryptsetup.Mount(cleartext.DevicePath, mp) + if err != nil { + return fmt.Errorf("mounting: %w", err) + } + fmt.Println(mnt) + return nil + } return doMount(client, cleartext, mp) } @@ -105,6 +118,14 @@ func doMount(client *udisks.Client, cleartext *udisks.BlockDevice, mp string) er return nil } +// isPrivilegedMapping checks if a LUKS device was opened via arca's +// cryptsetup path by checking if the expected mapper name exists. +func isPrivilegedMapping(dev *udisks.BlockDevice) bool { + expected := cryptsetup.MapperName(dev.DevicePath) + _, err := os.Stat("/dev/mapper/" + expected) + return err == nil && strings.HasPrefix(expected, "arca-") +} + func readPassphrase() (string, error) { fmt.Fprint(os.Stderr, "Passphrase: ") pass, err := term.ReadPassword(int(os.Stdin.Fd()))