How to check if a LUKS device is unlocked, without sudo permissions?

Question

Is there any way to check if a LUKS device is unlocked, without having sudo permissions?

I'm aware of two questions, but all the answers require sudo.

It seems that I've found an indirect way (processing the CleartextDevice value of udisksctl info's output), but even assuming it's a stable solution, it's a hack at best.

Gnome-disks, for example, doesn't require sudo permissions, but it still decodes the locked/unlocked status of LUKS devices.

score 2 · Accepted Answer · answered Mar 18 '22 at 07:20

Gnome-disks, for example, doesn't require sudo permissions, but it still decodes the locked/unlocked status of LUKS devices.

GNOME Disks uses UDisks to get the information. There's nothing hacky about it, the CleartextDevice property will be always either / if the device is locked or a valid object path in form of /org/freedesktop/UDisks2/block_devices/dm_2d<num>, where dm_2d<num> translates to dm-<num>, the device mapper cleartext device name (- is encoded as _2d on DBus). If you don't want to parse udisksctl output, you can use busctl to get only the CleartextDevice property. It can also format the output in JSON for simpler parsing.

Locked LUKS device:

$ busctl get-property org.freedesktop.UDisks2 /org/freedesktop/UDisks2/block_devices/sda1 org.freedesktop.UDisks2.Encrypted CleartextDevice -j
{
        "type" : "o",
        "data" : "/"
}

Unlocked LUKS device:

$ busctl get-property org.freedesktop.UDisks2 /org/freedesktop/UDisks2/block_devices/nvme0n1p3 org.freedesktop.UDisks2.Encrypted CleartextDevice -j
{
        "type" : "o",
        "data" : "/org/freedesktop/UDisks2/block_devices/dm_2d0"
}

UDisks DBus API is guaranteed to be stable, the object path for the device will be always /org/freedesktop/UDisks2/block_devices/<name>.

But you can always simply check whether the LUKS device has a child. The cleartext device will always be a child of the LUKS device so you can check either from lsblk or from sysfs.

Locked LUKS device:

$ ls /sys/block/sda/sda1/holders/

Unlocked LUKS device:

$ ls /sys/block/nvme0n1/nvme0n1p3/holders
dm-0

score 0 · Answer 2 · answered Mar 18 '22 at 08:10

I'm probably not understanding the question but just look in /dev/mapper/ to see if a mapping exists. It won't be there unless it's decrypted/unlocked.

To show active drive mapping drives:

for file in $(readlink /dev/mapper/*); do echo $(ls -1 "/sys/block/${file##[./]}/slaves"); done

How to check if a LUKS device is unlocked, without sudo permissions?

2 Answers2