我正在进行 Debian 测试。我用 dm-crypt (luks) 加密了我的 /home。按照各种教程，我设置了 pam_mount 以在登录时打开它。但是，当我尝试使用 gdm 登录时，它失败了。登录屏幕消失并不久后重新出现。在 /var/log/auth.log 我有：
Jul 11 00:18:20 yojik gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session opened for user Debian-gdm by vic(uid=0)
Jul 11 00:18:20 yojik gdm-launch-environment]: (pam_mount.c:173): conv->conv(...): Conversation error
Jul 11 00:18:20 yojik gdm-launch-environment]: (pam_mount.c:477): warning: could not obtain password interactively either
Jul 11 00:18:20 yojik gdm-launch-environment]: (mount.c:72): Messages from underlying mount program:
Jul 11 00:18:20 yojik gdm-launch-environment]: (mount.c:76): NOTE: mount.crypt does not support utab (systems with no mtab or read-only mtab) yet. This means that you will temporarily need to call umount.crypt(8) rather than umount(8) to get crypto volumes unmounted.
Jul 11 00:18:21 yojik gdm-launch-environment]: (mount.c:76): crypt_activate_by_passphrase: Operation not permitted
Jul 11 00:18:21 yojik gdm-launch-environment]: (pam_mount.c:522): mount of /dev/disk/by-uuid/d79121a7-5fbd-4484-81d2-6cbdf1b95b5e failed
如果我切换到虚拟终端 (ctrl-alt-f1) 并登录，/home 卷将按预期安装。然后我可以返回 gdm 并正常登录。
所以问题实际上出在 gdm 和 pam_mount 的交互上。我尝试按照各种教程和线程调整 /etc/pam.d/gdm3...但没有成功。大多数信息都相当旧，唯一真正更新的信息（Arch linux wiki）似乎有不同的 gdm 实现，因为文件和选项具有完全不同的名称。
目前我的文件如下所示：
vic@yojik:~$ cat /etc/pam.d/gdm3
#%PAM-1.0
auth requisite pam_nologin.so
auth required pam_succeed_if.so user != root quiet_success
@include common-auth
auth optional pam_gnome_keyring.so
auth optional pam_mount.so
@include common-account
# SELinux needs to be the first session rule. This ensures that any
# lingering context has been cleared. Without this it is possible
# that a module could execute code in the wrong domain.
session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close
session optional pam_mount.so
session required pam_loginuid.so
# SELinux needs to intervene at login time to ensure that the process
# starts in the proper default security context. Only sessions which are
# intended to run in the user's context should be run after this.
session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open
session required pam_limits.so
session required pam_env.so readenv=1
session required pam_env.so readenv=1 envfile=/etc/default/locale
@include common-session
session optional pam_gnome_keyring.so auto_start
@include common-password
问题是：我应该如何修改文件才能使用 gdm 挂载卷？
编辑：这也是/etc/pam.d/common-auth（减去顶部的信息，说要运行pam-auth-update来管理文件，我也这样做了）
# here are the per-package modules (the "Primary" block)
auth [success=1 default=ignore] pam_unix.so nullok_secure
# here's the fallback if no module succeeds
auth requisite pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
auth required pam_permit.so
# and here are more per-package modules (the "Additional" block)
auth optional pam_mount.so
auth optional pam_cap.so
# end of pam-auth-update config
答案1
问题实际上出在/etc/security/pam_mount.conf.xml.在一些教程之后我插入了该行
<volume user="*" mountpoint="/home" path="/dev/disk/by-uuid/d79121a7-5fbd-4484-81d2-6cbdf1b95b5e" fstype="crypt" options="fsck" />
我的理解是，这user="*"是一个类似正则表达式的符号，代表“任何用户”。结果发现没有这样的语法。因此 pam_mount 尝试为用户 * 安装卷，当然失败了。这反映在日志中的行中crypt_activate_by_passphrase: Operation not permitted。
通过将 * 替换为我的用户名来解决。如果需要，man pam_mount.conf还可以提供更细粒度控制的更多选项。
因此，如果您遇到问题，pam_mount请先operation not permitted检查一下！