Preventing Volume Unlock Prompt

Question

I have an encrypted APFS volume that I do not wish to be unlocked automatically, however, every time a user logs in on my system they are prompted to enter a passphrase for the volume, every single time.

What I want to know is, is there a way to prevent macOS from trying to unlock specific APFS volumes when a user logs in, or even better, to only do-so if a password is found in that user's keychain (so I can have it auto-mount for some users but be ignored for others)?

I've already tried adding the volume to /etc/fstab with the noauto option, but while all other settings are respected when the volume is mounted, this one is ignored, presumably because unlocking of APFS volumes occurs before the volume is mounted.

Answer 1

It's possible prevent the unlock prompt by changing the role of the encrypted volume!

1. Get the device identifier (and the UUID which is required later) of the encrypted volume:

   diskutil ap list
   

2. Change the volume role:

   diskutil ap changeVolumeRole diskXsY D
   

   APFS can use flags to determine a special role of a volume: S=System volume/B=Preboot etc. A simple encrypted volume (no boot/system volume group) usually has no specific role. For unknown reason the D (=Data) role prevents the unlock prompt and the volume won't be mounted automatically.

To mount and unlock the volume for a user (here: the user currently logged in) create a launch agent:

3. Create a launch agent:

   nano ~/Library/LaunchAgents/usr.automount.plist
   

   and add the following content:

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
       <key>Disabled</key>
       <false/>
       <key>Label</key>
       <string>usr.automount</string>
       <key>ProgramArguments</key>
       <array>
           <string>/usr/sbin/diskutil</string>
           <string>ap</string>
           <string>unlock</string>
           <string><UUID_of_encrypted_APFS_volume></string>
           <string>-passphrase</string>
           <string><password></string>
       </array>
       <key>RunAtLoad</key>
       <true/>
   </dict>
   </plist>
   

   Example with the UUID 4E253DC9-5B87-49CB-96F3-DE4737C16464 and the password test:

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
       <key>Disabled</key>
       <false/>
       <key>Label</key>
       <string>usr.automount</string>
       <key>ProgramArguments</key>
       <array>
           <string>/usr/sbin/diskutil</string>
           <string>ap</string>
           <string>unlock</string>
           <string>4E253DC9-5B87-49CB-96F3-DE4737C16464</string>
           <string>-passphrase</string>
           <string>test</string>
       </array>
       <key>RunAtLoad</key>
       <true/>
   </dict>
   </plist>
   

   Save the file in nano

4. Load the launch agent:

   launchctl load ~/Library/LaunchAgents/usr.automount.plist 
   

---

This won't unload and lock the encrypted volume if you log out as user1 (unlock enabled) and log in as user2 (unlock disabled) without reboot!

---

Checking your other questions, I realized that you might have specific mount points for encrypted volumes (e.g. mounted to user folders/subfolders). The simple approach in the launch agent won't work then.

Answer 2

If it asks for multiple passwords when a user logs in, probably you did not enable that user in FileVault.

You can do that from the System Preferences:

• On the Mac computer, open System Preferences > Security & Privacy.
• Click the FileVault tab, and if necessary, unlock the padlock.
• Click the Enable Users button and an account list pops up.
• Click Enable Users to add and enter the password of that user.

or from the command line:

• on the Mac computer, open the Terminal application.
• Run the following command: sudo fdesetup add -usertoadd user1 and if prompted, enter the sudo password.
• When prompted, enter the primary FileVault-authorized user name — this is the user who you specified to manage FileVault 2 (in Assign an Active Directory user who is authorized to manage an encrypted disk).
• When prompted, enter the password for the primary FileVault-authorized user.
• When prompted, enter the password for the new user who you specified on the command line (user1 in this example).

Regarding your other question, to prevent Volume unlock Prompt, I think you can combine some things since on MacOS there is not a native utility to do what you asked (like libpam-mount for deb systems). More specifically:

1. You can disable an APFS volume to automount. You can follow the second answer to this question.
2. You can write a script to mount a volume, instead of typing the command line command every time you need it. You can read more about this here.
3. You can launch the script at startup. You could use launchd. You can check some approaches in this thread.
4. Obviously, you'd want to launch the script on a user basis. Here, you can read the official documentation for it. Additionally, in the thread linked at point 3 there are some mentions about launching a start-up script on a user basis.

I hope it is useful now in some sort of way, and sorry for misinterpreting the question.