1

It is possible to remount an HFS+/CoreStorage Logical Volume using diskutil mount diskXsY if keychain stores the password for that volume, but trying to remount an APFS Volume even though the password is in keychain gives:

Volume on diskXsY failed to mount
This is an encrypted and locked APFS Volume; use "diskutil apfs unlockVolume"

And diskutil apfs unlockVolume needs a password explicitly provided. Is it possible to remount an APFS volume from terminal without explicitly providing a password?

1 Answer 1

1
+50

A passphrase or cryptographic key is required to unlock an encrypted volume. This can not be avoided.

It is possible to avoid requiring user interaction to provide the security credentials.

The diskutil manual suggests that the interactive passphrase can be passed via stdin or by using a recovery keychain:

unlockVolume | unlock volumeDevice [-user disk | -user cryptoUserUUID | -recoverykeychain file] [-passphrase passphrase] | [-stdinpassphrase] [-nomount | -mountpoint mountpoint] [-systemreadwrite] [-verify] [-plist]

Unlock and mount an encrypted and locked APFS Volume or verify a passphrase.

If you do not supply the -user option, then all cryptographic users on that APFS Volume are searched for a match; if you supply -user disk then the Disk UUID (which equals the APFS Volume UUID) user is assumed; if you supply -user with a UUID then that specific user is assumed; if you instead supply -recoverykeychain then the Institutional Recovery user (see below) is assumed.

You will be prompted interactively for a passphrase unless you specify a passphrase parameter with -passphrase or pipe your passphrase into stdin and use -stdinpassphrase.

As an alternative to a passphrase, you can specify -recoverykeychain with a full path to a keychain file if an Institutional Recovery Key has been previously set up on the APFS Volume. The keychain must be unlocked; see security(1) and fdesetup(8) for more information.

See Get Password from Keychain in Shell Scripts, with the example script:

pw_name="CLI Test"
pw_account="armin"

if ! cli_password=$(security find-generic-password -w -s "$pw_name" -a "$pw_account"); then
  echo "could not get password, error $?"
  exit 1
fi

echo "the password is $cli_password"

See also:

3
  • I understand that passphrase or cryptographic key is required, but I don't understand why is it handled automatically (through agent) for HFS+, but not for APFS volume
    – tig
    May 5 at 12:54
  • 1
    This inconsistent behaviour is something Apple needs to fix. Let Apple know that this affects you; every report is helpful. Unfortunately a fix is unlikely to ship soon, so a scripted work-around is probably the best approach. May 5 at 13:46
  • 1
    So let then github.com/toy/apfs-mounter be
    – tig
    yesterday

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .