mount encrypted sparseimage as home directory before login

Question

There are several ways (loginhook, launchdaemon etc.) to automount a sparsebundle before logging in, but there's none without writing down the password in plaintext for automount an encrypted sparsebundle.

Reading out the password from the keychain requires to unlock it before, therefore it's not possible to automate the process without user action.

#!/usr/bin/env bash -e
# SOURCE: http://risponderetag.wpdev8.com/p/35966.html

SPARSEBUNDLE_PATH="/Users/Shared/username.sparsebundle"
SPARSEBUNDLE_MOUNT_PATH="/Users/username/"
KEYCHAIN_PATH="/Users/username/Library/Keychains/login.keychain"

# Check existing states
if [ -e "$SPARSEBUNDLE_MOUNT_PATH" ]; then
    echo "Already mounted."
    exit 0    
fi

# The mount command uses security find-generic-password
# to get the password from the keychain store
MOUNT_PASSWORD=$(security find-generic-password -w -D "disk image password" -l username.sparsebundle $KEYCHAIN_PATH)
printf $MOUNT_PASSWORD | hdiutil attach -stdinpass -mountpoint "$SPARSEBUNDLE_MOUNT_PATH" "$SPARSEBUNDLE_PATH" 

For further informations see:

Can I mount an encrypted image BEFORE Finder loads? http://techanic.net/2012/10/14/programmatically_mounting_encrypted_disk_images_in_os_x.html

Question (EDIT):

Are there other ways to pass a keychain password without using plaintext or user interaction?

Answer 1

So depending on the actual use case you are working with I may have an answer for your dilemma. If the location you are mounting to exists prior to actually mounting your disk, logging in before mounting the disk will create a default user filesystem with its very own login keychain. You can log in to a different account, mount the disk and save the password to the keychain, copy the password to the system keychain, and (after unmounting the disk) transfer the password to the unmounted user account login keychain. That item will exist prior to mounting so the disk can be automatically mounted on login. So you should be able to use that password with launch agents. Go into the password options and allow all applications to use it so you are not prompted for anything after it is in its final location.

If you cannot get launch agents to work, you can always write a short applescript app to refresh your finder to have the proper desktop to display and put it in the login items of the unmounted account so that it executes after the drive is mounted

delay 5
do shell script "killall Finder"

Put that into the /Users/Shared folder or something so it can be accessed before mounting and the mounting process does not interfere.

So that "kind of" does not require user interaction at least beyond the process of logging on. I hope that helps!