mount.ecryptfs takes up enormous amounts of memory when mounting

Hi Paul-

Thanks for the report.

What are your mount options?

:-Dustin

I (or a cronjob, actually) mount it as follows:

mount -t ecryptfs -o key=passphrase,ecryptfs_cipher=aes,ecryptfs_key_bytes=16,passthrough=no,ecryptfs_passthrough=no,passwd=●●●●●●●●●●●● /media/back/.auto /media/back/auto

Hi, I was able to reproduce this.

the point is you are using mount in cron and your mount command does not contain all values. That's the reason why mount.ecryptfs starts asking questions. Cron gives wrong input so mount.ecryptfs repeats it's questions in a loop (and consumes memory).

If you want to mount ecryptfs dir for example in cron, you should add verbosity=0 which tells mount.ecryptfs not to ask any question and just use default values.

Please try it with:
mount -t ecryptfs -o key=passphrase,ecryptfs_cipher=aes,ecryptfs_key_bytes=16,passthrough=no,ecryptfs_passthrough=no,passwd=●●●●●●●●●●●●,verbosity=0 /media/back/.auto /media/back/auto

Hi Michal - Thanks for looking into this. If we aren't receiving valid answers to the interactive prompts, why do we keep allocating more and more memory? It sounds to me like we may have a memory leak in the decision graph code. Do you agree?

I added verbosity=0 to the mount options and it now works flawlessly, without allocating any extra memory, so at least there is a known workaround.

Hi Tyler,

honestly, I'm pretty sure there are a *lots* of memory leaks in ecryptfs-utils. I have this on my todo list.

I've fixed the part for asking questions for now.

Paul, I know, ecryptfs mount should not end in infinite loop, but don't take this as workaround. The verbosity=0 is needed here. Infinite loop is fixed, but without verbosity=0 mount helper will ask you (or cron) for missing values. If you (cron) enter invalid values it'll ask again (5 times at most - this is new). After that it'll fail with 'invalid value' error.

Hi Tyler,

I've found that in this case it's not memory consuming problem, but ecryptfs-utils ignored EOF so it was still reading and waiting for '\n' (read function re-allocates big enough buffer),

Michal

> I've found that in this case it's not memory consuming problem...
should be:
I've found that in this case it's not memory *leak* problem...

Merging fix from Michal. Should be in the 76 release.

:-Dustin

This bug was fixed in the package ecryptfs-utils - 76-0ubuntu1

---------------
ecryptfs-utils (76-0ubuntu1) karmic; urgency=low

  [ Dustin Kirkland ]
  * src/utils/ecryptfs-setup-swap: switch from vol_id to blkid,
    LP: #376486
  * debian/ecryptfs-utils.postinst, src/utils/ecryptfs-setup-private:
    don't echo mount passphrase if running in bootstrap mode; prune
    potential leakages from install log, LP: #383650
  * SECURITY UPDATE: mount passphrase recorded in install log (LP: #383650).
    - debian/ecryptfs-utils.postinst: prune private information from
      installer log
    - src/utils/ecryptfs-setup-private: don't echo passphrase if running in
      bootstrap mode
    - CVE-2009-1296
  * src/utils/ecryptfs-setup-private: make some of the lanuage more readable,
    (thanks, anrxc)
  * README, configure.ac, debian/control, debian/rules,
    doc/sourceforge_webpage/README, src/libecryptfs-swig/libecryptfs.py,
    src/libecryptfs-swig/libecryptfs_wrap.c,
    src/libecryptfs/key_management.c, src/libecryptfs/libecryptfs.pc.in,
    src/libecryptfs/main.c, src/pam_ecryptfs/Makefile.am,
    src/utils/manager.c, src/utils/mount.ecryptfs.c: move build from gcrypt
    to nss (this change has been pending for some time)
  * src/utils/ecryptfs-dot-private: dropped, was too hacky
  * ecryptfs-mount-private.1, ecryptfs-setup-private.1: align the
    documentation and implementation of the wrapping-independent feature,
    LP: #383746
  * src/utils/ecryptfs-umount-private: use keyctl list @u, since keyctl show
    stopped working, LP: #400484, #395082
  * src/utils/mount.ecryptfs_private.c: fix counter file locking; solves
    a longstanding bug about "random" umount caused by cronjobs, LP: #358573

  [ Michal Hlavinka (edits by Dustin Kirkland) ]
  * doc/manpage/ecryptfs-mount-private.1,
    doc/manpage/ecryptfs-rewrite-file.1,
    doc/manpage/ecryptfs-setup-private.1, doc/manpage/ecryptfs.7,
    doc/manpage/mount.ecryptfs_private.1,
    doc/manpage/umount.ecryptfs_private.1: documentation updated to note
    possible ecryptfs group membership requirements; Fix ecrypfs.7 man
    page and key_mod_openssl's error message; fix typo
  * src/libecryptfs/decision_graph.c: put a finite limit (5 tries) on
    interactive input; fix memory leaks when asking questions
  * src/libecryptfs/module_mgr.c: Don't error out with EINVAL when
    verbosity=0 and some options are missing.
  * src/utils/umount.ecryptfs.c: no error for missing key when removing it
  * src/libecryptfs-swig/libecryptfs.i: fix compile werror, cast char*
  * src/utils/ecryptfs_add_passphrase.c: fix/test/use return codes;
    return nonzero for --fnek when not supported but used
  * src/include/ecryptfs.h, src/key_mod/ecryptfs_key_mod_openssl.c,
    src/libecryptfs/module_mgr.c: refuse mounting with too small rsa
    key (key_mod_openssl)
  * src/utils/ecryptfs_insert_wrapped_passphrase_into_keyring.c: fix return
    codes
  * src/utils/ecryptfs-rewrite-file: polish output
  * src/libecryptfs/key_management.c: inform about full keyring; insert fnek
    sig into keyring if fnek support check fails; don't fail if key already
    exists in keyring
  * src/utils/ecryptfs-setup-private: if th...