How To Set Filesystem Passphrase from a Secrets Management Tool

The config directory (default /etc/objectivefs.env) has been set up (see config).

The config directory is owned by the user executing the mount command (e.g. root).

The config directory is not writable by group or others.

The OBJECTIVEFS_PASSPHRASE file in the config directory is not readable or writable by group or others.

Create a file called /etc/objectivefs.env/OBJECTIVEFS_PASSPHRASE with the content:

#!<full path to your program>

When you run the mount command, ObjectiveFS will supply the filesystem name to the program (e.g. s3://filesystem_name) and expects to receive the filesystem passphrase on stdout. Leading and trailing whitespace will be removed. Example:

#!/usr/sbin/fetch_from_aws_ssm

Verify the program reference by step 1 is:

a. owned by the user executing the mount command (e.g. root), and
b. not readable or writable by group or others.

The secrets management program can use the first argument (provided by ObjectiveFS) to look up the correct passphrase for the filesystem. This allows you to use the same program for multiple filesystems.

If you get a permission error while mounting your filesystem, you can use the -v option for more details.

$ sudo mount.objectivefs -v myfs /ofs
WARN: bad permissions on '/etc/objectivefs.env/OBJECTIVEFS_PASSPHRASE'; other can read
mount.objectivefs: passphrase file has bad permissions, can not execute passphrase program