Merge lp:~ecryptfs/ecryptfs/ecryptfs-utils into lp:~mhlavink/ecryptfs/20090424

[david]

[david (davidelizondo2006)]

diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
index 2f0945d..056fed6 100644 (file)
--- a/fs/ecryptfs/inode.c
+++ b/fs/ecryptfs/inode.c
@@ -476,6 +476,7 @@ static int ecryptfs_unlink(struct inode *dir, struct dentry *dentry)
        struct inode *lower_dir_inode = ecryptfs_inode_to_lower(dir);
        struct dentry *lower_dir_dentry;

+ dget(lower_dentry);
        lower_dir_dentry = lock_parent(lower_dentry);
        rc = vfs_unlink(lower_dir_inode, lower_dentry);
        if (rc) {
@@ -489,6 +490,7 @@ static int ecryptfs_unlink(struct inode *dir, struct dentry *dentry)
        d_drop(dentry);
 out_unlock:
        unlock_dir(lower_dir_dentry);
+ dput(lower_dentry);
        return rc;
 }

  test ......

http://git.kernel.org/?p=linux/kernel/git/next/linux-next.git;a=blob;f=fs/ecryptfs/inode.c;h=2f0945d632970511ba189a0ef8595e918c10b693;hb=96a7b9c2f5df899f302ade45cf17ad753fe130fd

[david (davidelizondo2006)]

> diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
> index 2f0945d..056fed6 100644 (file)
> --- a/fs/ecryptfs/inode.c
> +++ b/fs/ecryptfs/inode.c
> @@ -476,6 +476,7 @@ static int ecryptfs_unlink(struct inode *dir, struct
> dentry *dentry)
> struct inode *lower_dir_inode = ecryptfs_inode_to_lower(dir);
> struct dentry *lower_dir_dentry;
>
> + dget(lower_dentry);
> lower_dir_dentry = lock_parent(lower_dentry);
> rc = vfs_unlink(lower_dir_inode, lower_dentry);
> if (rc) {
> @@ -489,6 +490,7 @@ static int ecryptfs_unlink(struct inode *dir, struct
> dentry *dentry)
> d_drop(dentry);
> out_unlock:
> unlock_dir(lower_dir_dentry);
> + dput(lower_dentry);
> return rc;
> }
>
> test ......
>
> http://git.kernel.org/?p=linux/kernel/git/next/linux-next.git;a=blob;f=fs/ecry
> ptfs/inode.c;h=2f0945d632970511ba189a0ef8595e918c10b693;hb=96a7b9c2f5df899f302
> ade45cf17ad753fe130fd

Merge branch 'for-linus' of git://git./linux/kernel/git/ecryptfs/ecryptfs-2.6

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ecryptfs/ecryptfs-2.6:
  eCryptfs: Prevent lower dentry from going negative during unlink
  eCryptfs: Propagate vfs_read and vfs_write return codes
  eCryptfs: Validate global auth tok keys
  eCryptfs: Filename encryption only supports password auth tokens
  eCryptfs: Check for O_RDONLY lower inodes when opening lower files
  eCryptfs: Handle unrecognized tag 3 cipher codes
  ecryptfs: improved dependency checking and reporting
  eCryptfs: Fix lockdep-reported AB-BA mutex issue
  ecryptfs: Remove unneeded locking that triggers lockdep false positives

[david (davidelizondo2006)]

> > diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
> > index 2f0945d..056fed6 100644 (file)
> > --- a/fs/ecryptfs/inode.c
> > +++ b/fs/ecryptfs/inode.c
> > @@ -476,6 +476,7 @@ static int ecryptfs_unlink(struct inode *dir, struct
> > dentry *dentry)
> > struct inode *lower_dir_inode = ecryptfs_inode_to_lower(dir);
> > struct dentry *lower_dir_dentry;
> >
> > + dget(lower_dentry);
> > lower_dir_dentry = lock_parent(lower_dentry);
> > rc = vfs_unlink(lower_dir_inode, lower_dentry);
> > if (rc) {
> > @@ -489,6 +490,7 @@ static int ecryptfs_unlink(struct inode *dir, struct
> > dentry *dentry)
> > d_drop(dentry);
> > out_unlock:
> > unlock_dir(lower_dir_dentry);
> > + dput(lower_dentry);
> > return rc;
> > }
> >
> > test ......
> >
> > http://git.kernel.org/?p=linux/kernel/git/next/linux-
> next.git;a=blob;f=fs/ecry
> >
> ptfs/inode.c;h=2f0945d632970511ba189a0ef8595e918c10b693;hb=96a7b9c2f5df899f302
> > ade45cf17ad753fe130fd
>
>
> Merge branch 'for-linus' of git://git./linux/kernel/git/ecryptfs/ecryptfs-2.6
>
> * 'for-linus' of
> git://git.kernel.org/pub/scm/linux/kernel/git/ecryptfs/ecryptfs-2.6:
> eCryptfs: Prevent lower dentry from going negative during unlink
> eCryptfs: Propagate vfs_read and vfs_write return codes
> eCryptfs: Validate global auth tok keys
> eCryptfs: Filename encryption only supports password auth tokens
> eCryptfs: Check for O_RDONLY lower inodes when opening lower files
> eCryptfs: Handle unrecognized tag 3 cipher codes
> ecryptfs: improved dependency checking and reporting
> eCryptfs: Fix lockdep-reported AB-BA mutex issue
> ecryptfs: Remove unneeded locking that triggers lockdep false positives

1 config ECRYPT_FS
2 tristate "eCrypt filesystem layer support (EXPERIMENTAL)"
3 depends on EXPERIMENTAL && KEYS && NET
4 select CRYPTO_ECB
5 select CRYPTO_CBC
6 help
7 Encrypted filesystem that operates on the VFS layer. See
8 <file:Documentation/filesystems/ecryptfs.txt> to learn more about
9 eCryptfs. Userspace components are required and can be
10 obtained from <http://ecryptfs.sf.net>.
11
12 To compile this file system support as a module, choose M here: the
13 module will be called ecryptfs.

#######################################################################################
/**
2 * eCryptfs: Linux filesystem encryption layer
3 *
4 * Copyright (C) 1997-2004 Erez Zadok
5 * Copyright (C) 2001-2004 Stony Brook University
6 * Copyright (C) 2004-2007 International Business Machines Corp.
7 * Author(s): Michael A. Halcrow <email address hidden>
8 * Michael C. Thompson <email address hidden>
9 *
10 * This program is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU General Public License as
12 * published by the Free Software Foundation; either version 2 of the
13 * License, or (at your option) any later version.
14 *
15 * This program is distributed in the hope that it will be useful, but
16 * WITHOUT ANY WARRANTY; without even the implied warranty of
17...

[david (davidelizondo2006)]

> > > diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
> > > index 2f0945d..056fed6 100644 (file)
> > > --- a/fs/ecryptfs/inode.c
> > > +++ b/fs/ecryptfs/inode.c
> > > @@ -476,6 +476,7 @@ static int ecryptfs_unlink(struct inode *dir, struct
> > > dentry *dentry)
> > > struct inode *lower_dir_inode = ecryptfs_inode_to_lower(dir);
> > > struct dentry *lower_dir_dentry;
> > >
> > > + dget(lower_dentry);
> > > lower_dir_dentry = lock_parent(lower_dentry);
> > > rc = vfs_unlink(lower_dir_inode, lower_dentry);
> > > if (rc) {
> > > @@ -489,6 +490,7 @@ static int ecryptfs_unlink(struct inode *dir, struct
> > > dentry *dentry)
> > > d_drop(dentry);
> > > out_unlock:
> > > unlock_dir(lower_dir_dentry);
> > > + dput(lower_dentry);
> > > return rc;
> > > }
> > >
> > > test ......
> > >
> > > http://git.kernel.org/?p=linux/kernel/git/next/linux-
> > next.git;a=blob;f=fs/ecry
> > >
> >
> ptfs/inode.c;h=2f0945d632970511ba189a0ef8595e918c10b693;hb=96a7b9c2f5df899f302
> > > ade45cf17ad753fe130fd
> >
> >
> > Merge branch 'for-linus' of
> git://git./linux/kernel/git/ecryptfs/ecryptfs-2.6
> >
> > * 'for-linus' of
> > git://git.kernel.org/pub/scm/linux/kernel/git/ecryptfs/ecryptfs-2.6:
> > eCryptfs: Prevent lower dentry from going negative during unlink
> > eCryptfs: Propagate vfs_read and vfs_write return codes
> > eCryptfs: Validate global auth tok keys
> > eCryptfs: Filename encryption only supports password auth tokens
> > eCryptfs: Check for O_RDONLY lower inodes when opening lower files
> > eCryptfs: Handle unrecognized tag 3 cipher codes
> > ecryptfs: improved dependency checking and reporting
> > eCryptfs: Fix lockdep-reported AB-BA mutex issue
> > ecryptfs: Remove unneeded locking that triggers lockdep false positives
>
>
> 1 config ECRYPT_FS
> 2 tristate "eCrypt filesystem layer support (EXPERIMENTAL)"
> 3 depends on EXPERIMENTAL && KEYS && NET
> 4 select CRYPTO_ECB
> 5 select CRYPTO_CBC
> 6 help
> 7 Encrypted filesystem that operates on the VFS layer. See
> 8 <file:Documentation/filesystems/ecryptfs.txt> to learn more about
> 9 eCryptfs. Userspace components are required and can be
> 10 obtained from <http://ecryptfs.sf.net>.
> 11
> 12 To compile this file system support as a module, choose M here:
> the
> 13 module will be called ecryptfs.
>
> ##############################################################################
> #########
> /**
> 2 * eCryptfs: Linux filesystem encryption layer
> 3 *
> 4 * Copyright (C) 1997-2004 Erez Zadok
> 5 * Copyright (C) 2001-2004 Stony Brook University
> 6 * Copyright (C) 2004-2007 International Business Machines Corp.
> 7 * Author(s): Michael A. Halcrow <email address hidden>
> 8 * Michael C. Thompson <email address hidden>
> 9 *
> 10 * This program is free software; you can redistribute it and/or
> 11 * modify it under the terms of the GNU General Public License as
> 12 * published by the Free Software Foundation; either version 2 of the
> 13 * License, or (at your option) any later ve...

[lp:~ecryptfs/ecryptfs/ecryptfs-utils]

462. By Dustin Kirkland  on 2009-10-14

open 82 for development

Signed-off-by: Dustin Kirkland <email address hidden>

463. By Dustin Kirkland  on 2009-10-14

src/utils/ecryptfs-setup-private: fix bug where setup-private
incorrectly assumed that the home/private dir ownerships should
be owned by USER:USER; instead, default to USER:GROUP, where
GROUP is the USER's primary group by default, LP: #445301

464. By Dustin Kirkland  on 2009-10-20

src/utils/ecryptfs-setup-private: fix typo, s/getext/gettext, LP: #456565

465. By Dustin Kirkland  on 2009-10-21

* src/utils/ecryptfs-setup-private, debian/control: LP: #456565
  - fix typo, s/getext/gettext
  - depend on gettext-base

466. By Dustin Kirkland  on 2009-11-02

src/utils/ecryptfs-setup-private: fix printing of error strings,
which was broken by the gettext integration, LP: #471725

467. By Dustin Kirkland  on 2009-11-02

  which was broken by the gettext integration, LP: #471725;
  in doing so, use $() in place of ``, use '' for gettext arguments,
  and wrap gettext in "", like this: foo="$(gettext 'blah blah')"

468. By Dustin Kirkland  on 2009-11-10

* debian/control: one package per line, helps tremendously when looking
  at diffs
* debian/copyright: Add new fields
* debian/ecryptfs-utils.postinst: minor set -e change

469. By Dustin Kirkland  on 2009-11-10

releasing version 82

470. By Dustin Kirkland  on 2009-11-10

add release instructions

Signed-off-by: Dustin Kirkland <email address hidden>

471. By Dustin Kirkland <kirkland@x200> on 2010-02-06

* libecryptfs/key_management.c, utils/mount.ecryptfs_private.c:
  - use the session keyring, rather than the user keyring, such that
    keys are automatically cleared on logout

472. By Dustin Kirkland <kirkland@x200> on 2010-02-07

src/pam_ecryptfs/pam_ecryptfs.c, src/utils/Makefile.am,
src/utils/ecryptfs-migrate-home: add a script and pam hooks to
support automatic migration to encrypted home directory

473. By Dustin Kirkland <kirkland@x200> on 2010-02-16

add uid arg to wrap_passphrase_if_necessary

474. By Dustin Kirkland <kirkland@x200> on 2010-02-16

revert -r471, not quite ready for this yet

475. By Dustin Kirkland <kirkland@x200> on 2010-02-16

move wrap_passphrase_if_necessary() definition up before first use

476. By Dustin Kirkland <kirkland@x200> on 2010-02-17

* src/utils/ecryptfs-migrate-home: clean up for merge
  - use $() rather than ``
  - drop set -u
  - use = and !=, and quote vars, rather than testing with -ne, -eq,
    for better shell portability
  - improve usage statement and error text

477. By Dustin Kirkland <kirkland@x200> on 2010-02-17

  - check if already encrypted
  - handle migration of multiple users on boot

478. By Dustin Kirkland <kirkland@x200> on 2010-02-17

fix all whitespace, use tabs for indents

479. By Dustin Kirkland <kirkland@x200> on 2010-02-17

use quotes around variables, rather than ${} (stylistic preference)

480. By Dustin Kirkland <kirkland@x200> on 2010-02-17

  - major simplification for immediate release
    + remove boot and user modes; only support administrator mode for
      security reasons and to avoid race conditions
    + other modes can be re-added, if necessary, and if security
      concerns can be addressed

481. By Dustin Kirkland <kirkland@x200> on 2010-02-17

src/utils/Makefile.am: install to /usr/sbin, since this is an
administrative utility

482. By Dustin Kirkland <kirkland@x200> on 2010-02-17

ensure running as root

483. By Dustin Kirkland <kirkland@x200> on 2010-02-17

revert sbin change, as it installed to /sbin instead of /usr/sbin

484. By Dustin Kirkland <kirkland@x200> on 2010-02-17

drop verbose option, always print useful info messages

485. By Dustin Kirkland <kirkland@x200> on 2010-02-17

call the user $USER_NAME rather than $USER_ID since id implies
number, and here we're deailing with names

486. By Dustin Kirkland <kirkland@x200> on 2010-02-17

no decimals on awk calculation

487. By Dustin Kirkland <kirkland@x200> on 2010-02-17

mktemp on the target user, not root

488. By Dustin Kirkland <kirkland@x200> on 2010-02-17

drop VERBOSE option, always print useful info messages

489. By Dustin Kirkland <kirkland@x200> on 2010-02-17

check that there is enough disk space available to do the migration

490. By Dustin Kirkland <kirkland@x200> on 2010-02-17

ensure the user's homedir group is correct

491. By Dustin Kirkland <kirkland@x200> on 2010-02-17

add critical instructions, user *must* login after the migration and
before the reboot, as their wrapped passphrase will be cleared on
reboot (possible we should use an init script to move these to
/var/tmp on reboot)

492. By Dustin Kirkland <kirkland@x200> on 2010-02-17

ensure permissions are set correctly

493. By Dustin Kirkland <kirkland@x200> on 2010-02-17

fix versioning

494. By Dustin Kirkland <kirkland@x200> on 2010-02-17

debian/ecryptfs-utils.upstart, debian/rules: try to protect migrating
users who don't login before the next reboot

495. By Dustin Kirkland <kirkland@x200> on 2010-02-17

* ecryptfs-utils.ecryptfs-utils-restore.upstart,
  ecryptfs-utils.ecryptfs-utils-save.upstart, rules:
  - try to protect migrating users who don't login before the next reboot

496. By Dustin Kirkland <kirkland@x200> on 2010-02-17

improve text at the end of the migration

497. By Dustin Kirkland <kirkland@x200> on 2010-02-17

src/desktop/ecryptfs-record-passphrase: improve text

[Dustin Kirkland  (kirkland)]

Is this branch still active at all?

review: Needs Information

=== modified file 'README'
--- README	2009-02-03 08:50:36 +0000
+++ README	2010-02-17 20:48:18 +0000
@@ -43,11 +43,6 @@
      1.0 or higher)
    - Finding its way into some distros
    - Obtainable from <http://people.redhat.com/~dhowells/keyutils> 
-  - libgcrypt
-    - Part of most distros; install the development package
-    - If you need to build from source, you probably will want these:
-     - <ftp://ftp.gnupg.org/gcrypt/libgpg-error>
-     - <ftp://ftp.gnupg.org/gcrypt/libgcrypt>
 
 
 KERNEL BUILD OPTIONS

=== modified file 'configure.ac'
--- configure.ac	2009-04-21 23:25:42 +0000
+++ configure.ac	2010-02-17 20:48:18 +0000
@@ -10,7 +10,7 @@
 
 
 AC_PREREQ(2.59)
-AC_INIT([ecryptfs-utils],[74])
+AC_INIT([ecryptfs-utils],[82])
 AC_CANONICAL_HOST
 AC_CANONICAL_TARGET
 AM_INIT_AUTOMAKE([${PACKAGE_NAME}], [${PACKAGE_VERSION}])
@@ -187,14 +187,6 @@
 AC_HEADER_STDC
 AC_CHECK_LIB([dl], [dlopen])
 
-# Verify gcrypt
-AC_MSG_CHECKING([for libgcrypt])
-AM_PATH_LIBGCRYPT(,,[AC_MSG_ERROR([eCryptfs userspace tools require libgcrypt
-You might find the package at:
-http://directory.fsf.org/security/libgcrypt.html
-])]
-)
-
 # Verify keyutils version 1.0 or higher
 if test -z "${KEYUTILS_LIBS}"; then
 	AC_ARG_VAR([KEYUTILS_CFLAGS], [C compiler flags for keyutils])
@@ -327,7 +319,7 @@
 		AC_CHECK_LIB(
 			[pam_misc],
 			[pam_misc_setenv],
-			[PAM_LIBS="${TSPI_LIBS} -lpam_misc"],
+			[PAM_LIBS="${PAM_LIBS} ${TSPI_LIBS} -lpam_misc"],
 			[AC_MSG_ERROR([Cannot find pam_misc])]
 		)
 	fi
@@ -353,13 +345,8 @@
 	rootsbindir="\$(sbindir)"
 fi
 
-if test "${enable_nss}" == "yes" ; then
-        CRYPTO_CFLAGS=${NSS_CFLAGS}
-	CRYPTO_LIBS=${NSS_LIBS}
-else
-        CRYPTO_CFLAGS=${LIBGCRYPT_CFLAGS}
-	CRYPTO_LIBS=${LIBGCRYPT_LIBS}
-fi
+CRYPTO_CFLAGS=${NSS_CFLAGS}
+CRYPTO_LIBS=${NSS_LIBS}
 
 AC_SUBST([pamdir])
 AC_SUBST([pamlibdir])

=== modified file 'debian/changelog'
--- debian/changelog	2009-04-21 23:24:32 +0000
+++ debian/changelog	2010-02-17 20:48:18 +0000
@@ -1,4 +1,314 @@
-ecryptfs-utils (74) unreleased; urgency=low
+ecryptfs-utils (83) UNRELEASED; urgency=low
+
+  [ Yan Li <[e-mail]> ]
+  * src/pam_ecryptfs/pam_ecryptfs.c, src/utils/Makefile.am,
+    src/utils/ecryptfs-migrate-home: add a script and pam hooks to
+    support automatic migration to encrypted home directory
+
+  [ Dustin Kirkland ]
+  * src/utils/ecryptfs-migrate-home: clean up for merge
+    - use $() rather than ``
+    - drop set -u
+    - use = and !=, and quote vars, rather than testing with -ne, -eq,
+      for better shell portability
+    - improve usage statement and error text
+    - check if already encrypted
+    - handle migration of multiple users on boot
+    - fix all whitespace, use tabs for indents
+    - use quotes around variables, rather than ${} (stylistic preference)
+    - major simplification for immediate release
+      + remove boot and user modes; only support administrator mode for
+        security reasons and to avoid race conditions
+      + other modes can be re-added, if necessary, and if security
+        concerns can be addressed
+    - ensure running as root
+    - drop VERBOSE option, always print useful info messages
+    - call the user $USER_NAME rather than $USER_ID since id implies
+      number, and here we're deailing with names
+    - no decimals on awk calculation
+    - mktemp on the target user, not root
+    - check that there is enough disk space available to do the migration
+    - ensure the user's homedir group is correct
+    - add critical instructions, user *must* login after the migration and
+      before the reboot, as their wrapped passphrase will be cleared on
+      reboot (possible we should use an init script to move these to
+      /var/tmp on reboot)
+    - ensure permissions are set correctly
+    - improve text at the end of the migration
+  * ecryptfs-utils.ecryptfs-utils-restore.upstart,
+    ecryptfs-utils.ecryptfs-utils-save.upstart, rules:
+    - try to protect migrating users who don't login before the next reboot
+  * src/desktop/ecryptfs-record-passphrase: improve text
+
+ -- Dustin Kirkland <[e-mail]>  Sat, 06 Feb 2010 17:48:57 -0600
+
+ecryptfs-utils (82) released; urgency=low
+
+  * src/utils/ecryptfs-setup-private: fix bug where setup-private
+    incorrectly assumed that the home/private dir ownerships should
+    be owned by USER:USER; instead, default to USER:GROUP, where
+    GROUP is the USER's primary group by default, LP: #445301
+  * src/utils/ecryptfs-setup-private, debian/control: LP: #456565
+    - fix typo, s/getext/gettext
+    - depend on gettext-base
+  * src/utils/ecryptfs-setup-private: fix printing of error strings,
+    which was broken by the gettext integration, LP: #471725;
+    in doing so, use $() in place of ``, use '' for gettext arguments,
+    and wrap gettext in "", like this: foo="$(gettext 'blah blah')"
+  * debian/control: one package per line, helps tremendously when looking
+    at diffs
+  * debian/copyright: Add new fields
+  * debian/ecryptfs-utils.postinst: minor set -e change
+
+
+ -- Dustin Kirkland <[e-mail]>  Tue, 10 Nov 2009 11:31:25 -0600
+
+ecryptfs-utils (81) released; urgency=low
+
+  [ Michael Terry ]
+  * src/utils/ecryptfs-setup=swap: clean up some error message reporting,
+    LP: #430891, #430890
+
+  [ Dustin Kirkland ]
+  * doc/manpage/ecryptfs.7: note the 64-char passphrase limit, LP: #386504
+  * src/utils/ecryptfs-setup-private: minor documentation change
+
+ -- Dustin Kirkland <[e-mail]>  Fri, 18 Sep 2009 18:46:07 -0500
+
+ecryptfs-utils (80) released; urgency=low
+
+  [ Evan Dandrea ]
+  * src/utils/ecryptfs-setup-swap: allow for setting up encrpyted swap,
+    without activating it immediately, necessary for livecd installations
+
+ -- Dustin Kirkland <[e-mail]>  Wed, 19 Aug 2009 11:31:03 -0500
+
+ecryptfs-utils (79) released; urgency=low
+
+  [ Dustin Kirkland ]
+  * debian/control: updated bzr and browser urls, bumped standards version
+  * src/pam_ecryptfs/pam_ecryptfs.c: silence useless, oft-shown info
+    message
+  * src/utils/ecryptfs-mount-private, src/utils/ecryptfs-rewrite-file,
+    src/utils/ecryptfs-setup-private, src/utils/ecryptfs-setup-swap,
+    src/utils/ecryptfs-umount-private: use gettext for all string printing,
+    such that we can internationalize ecryptfs
+  * po/POTFILES.sh, po/ecryptfs-utils.pot, po/fr.po, rules: add po to the
+    build system; for now, in the debian/ directory; this should be put in
+    the upstream source tree eventually (but I need some help with the
+    automake/autoconf integration)
+  * ecryptfs-setup-swap: exit(0) if there's no swaps to encrypt, ensures
+    that this script succeeds if there is no swap space that needs to be
+    secured, or if the existing swap space is already secured
+  * doc/manpage/ecryptfs-setup-swap.1, doc/manpage/ecryptfs-stat.1,
+    doc/manpage/umount.ecryptfs.8, doc/manpage/Makefile.am: added manpagess
+  * doc/manpage/ecryptfs.7: fix lintian warning
+  * debian/lintian/ecryptfs-utils: added a lintian overrides file
+  * debian/lintian/ecryptfs-utils, debian/ecryptfs-utils.install: add and
+    install some proper lintian overrides
+  * src/libecryptfs/module_mgr.c: fix typo, LP: #408437
+
+  [ Evan Dandrea ]
+  * ecryptfs-setup-swap: support more than one encrypted swap device
+
+  [ Dorin Scutarașu ]
+  * src/libecryptfs/key_management.c: fix null pointer deref, LP: #409565
+
+ -- Dustin Kirkland <[e-mail]>  Mon, 17 Aug 2009 11:58:35 -0500
+
+ecryptfs-utils (78) released; urgency=low
+
+  [ James Westby ]
+  * src/libecryptfs/main.c flockfile the filehandle after checking that
+    we were able to successfully open it (LP: #403011)
+  * debian/libecryptfs0.shlibs: bump shlibs dep to 77 since we added new
+    symbols there
+
+ -- Dustin Kirkland <[e-mail]>  Wed, 22 Jul 2009 11:28:20 -0500
+
+ecryptfs-utils (77) released; urgency=low
+
+  [ Dustin Kirkland ]
+  * src/libecryptfs/key_management.c, src/pam_ecryptfs/pam_ecryptfs.c:
+    revert the zombie code removal from pam_ecryptfs as it seems this
+    bit is still needed; fix the source of the problem introduced in
+    commit r407; check for non-zero return codes; this problem would
+    manifest itself as a) unable to unlock screensaver, b) unable to
+    switch users, c) unable to mount home folder on initial login;
+    LP: #402222, #402029
+  * src/utils/ecryptfs-umount-private: use for loop to loop over key
+    ids on removal
+  * src/utils/mount.ecryptfs_private.c: return non-zero on unmount failure
+    due to open sessions; handle this in ecryptfs-umount-private too; make
+    the flock() blocking; use /dev/shm for counter; add an iterator to the
+    counter file to prevent users from DoS'ing one another from accessing
+    their encrypted directories, LP: #402745
+  * debian/ecryptfs-utils.postinst: move /tmp counters to /dev/shm
+  * configure.ac: link against pam, silence shlib warning
+  * src/include/ecryptfs.h, src/libecryptfs/main.c,
+    src/pam_ecryptfs/pam_ecryptfs.c, src/utils/Makefile.am,
+    src/utils/mount.ecryptfs_private.c: move two functions from
+    mount.ecryptfs_private to libecryptfs, namely is_mounted() and
+    fetch_private_mnt(); use these in both pam_ecryptfs and
+    mount.ecryptfs_private; also move PRIVATE to ECRYPTFS_PRIVATE in
+    the ecryptfs.h headers; this will allow us to short-circuit some of the
+    costly key-loading code on pam_auth if the private dir is already
+    mounted, speeding up some subsequent authentications significantly,
+    LP: #402748
+  * doc/ecryptfs-mount-private.txt: removed the "$" to make copy-n-paste
+    more user friendly
+  * src/utils/ecryptfs-setup-private: when encrypting home, put the
+    .ecryptfs and .Private data in /home/.ecryptfs rather than /var/lib,
+    as users are forgetting to backup /var/lib, and are often putting
+    /home on a separate partition; furthermore, this gives users a place
+    to access their encrypted data for backup, rather than hiding the
+    data below $HOME, LP: #371719
+
+  [ Tyler Hicks ]
+  * src/libecryptfs/cipher_list.c, src/libecryptfs/module_mgr.c:
+    add blowfish/56-bytes to the list of ciphers we officially support,
+    LP: #402790
+
+ -- Dustin Kirkland <[e-mail]>  Tue, 21 Jul 2009 23:57:33 -0500
+
+ecryptfs-utils (76) released; urgency=low
+
+  [ Dustin Kirkland ]
+  * src/utils/ecryptfs-setup-swap: switch from vol_id to blkid,
+    LP: #376486
+  * debian/ecryptfs-utils.postinst, src/utils/ecryptfs-setup-private:
+    don't echo mount passphrase if running in bootstrap mode; prune
+    potential leakages from install log, LP: #383650
+  * SECURITY UPDATE: mount passphrase recorded in install log (LP: #383650).
+    - debian/ecryptfs-utils.postinst: prune private information from
+      installer log
+    - src/utils/ecryptfs-setup-private: don't echo passphrase if running in
+      bootstrap mode
+    - CVE-2009-1296
+  * src/utils/ecryptfs-setup-private: make some of the lanuage more readable,
+    (thanks, anrxc)
+  * README, configure.ac, debian/control, debian/rules,
+    doc/sourceforge_webpage/README, src/libecryptfs-swig/libecryptfs.py,
+    src/libecryptfs-swig/libecryptfs_wrap.c,
+    src/libecryptfs/key_management.c, src/libecryptfs/libecryptfs.pc.in,
+    src/libecryptfs/main.c, src/pam_ecryptfs/Makefile.am,
+    src/utils/manager.c, src/utils/mount.ecryptfs.c: move build from gcrypt
+    to nss (this change has been pending for some time)
+  * src/utils/ecryptfs-dot-private: dropped, was too hacky
+  * ecryptfs-mount-private.1, ecryptfs-setup-private.1: align the
+    documentation and implementation of the wrapping-independent feature,
+    LP: #383746
+  * src/utils/ecryptfs-umount-private: use keyctl list @u, since keyctl show
+    stopped working, LP: #400484, #395082
+  * src/utils/mount.ecryptfs_private.c: fix counter file locking; solves
+    a longstanding bug about "random" umount caused by cronjobs, LP: #358573
+
+  [ Michal Hlavinka (edits by Dustin Kirkland) ]
+  * doc/manpage/ecryptfs-mount-private.1,
+    doc/manpage/ecryptfs-rewrite-file.1,
+    doc/manpage/ecryptfs-setup-private.1, doc/manpage/ecryptfs.7,
+    doc/manpage/mount.ecryptfs_private.1,
+    doc/manpage/umount.ecryptfs_private.1: documentation updated to note
+    possible ecryptfs group membership requirements; Fix ecrypfs.7 man
+    page and key_mod_openssl's error message; fix typo
+  * src/libecryptfs/decision_graph.c: put a finite limit (5 tries) on
+    interactive input; fix memory leaks when asking questions
+  * src/libecryptfs/module_mgr.c: Don't error out with EINVAL when
+    verbosity=0 and some options are missing.
+  * src/utils/umount.ecryptfs.c: no error for missing key when removing it
+  * src/libecryptfs-swig/libecryptfs.i: fix compile werror, cast char*
+  * src/utils/ecryptfs_add_passphrase.c: fix/test/use return codes;
+    return nonzero for --fnek when not supported but used
+  * src/include/ecryptfs.h, src/key_mod/ecryptfs_key_mod_openssl.c,
+    src/libecryptfs/module_mgr.c: refuse mounting with too small rsa
+    key (key_mod_openssl)
+  * src/utils/ecryptfs_insert_wrapped_passphrase_into_keyring.c: fix return
+    codes
+  * src/utils/ecryptfs-rewrite-file: polish output
+  * src/libecryptfs/key_management.c: inform about full keyring; insert fnek
+    sig into keyring if fnek support check fails; don't fail if key already
+    exists in keyring
+  * src/utils/ecryptfs-setup-private: if the ecryptfs group exists, restrict
+    ecryptfs-setup-private to members of this group
+  * src/pam_ecryptfs/pam_ecryptfs.c: dynamically load ecryptfs module by
+    checking ecryptfs version
+  * src/libecryptfs/decision_graph.c, src/utils/io.c,
+    src/utils/mount.ecryptfs.c: fix EOF handling, LP: #371587
+  * src/desktop/Makefile.am: make desktop files trusted, LP: #371426
+
+  [ Dustin Kirkland and Daniel Baumann ]
+  * debian/control, debian/copyright, debian/ecryptfs-utils.dirs,
+    debian/ecryptfs-utils.install, debian/ecryptfs-utils.postinst,
+    debian/rules, ecryptfs-utils.pam-auth-update: sync Ubuntu's
+    packaging with Debian; drop dpatch, drop libssl build dep, clean
+    up extraneous debhelper bits, match cflags; remaining diff is only
+    ecryptfs-utils.prerm
+
+  [ Arfrever Frehtes Taifersar Arahesis ]
+  * key_mod/ecryptfs_key_mod_gpg.c,
+    key_mod/ecryptfs_key_mod_pkcs11_helper.c,
+    libecryptfs/key_management.c, utils/ecryptfs_unwrap_passphrase.c:
+    Fix warnings, initialize a few variables, drop unused ones
+
+  [ David Hicks ]
+  * src/lib/key_management.c: fix stray semicolon that prevents .ecryptfsrc
+    files from working properly, LP: #372709
+
+  [ Michael Rooney ]
+  * src/python/ecryptfsapi.py: added python api
+
+ -- Dustin Kirkland <[e-mail]>  Mon, 20 Jul 2009 12:12:30 -0500
+
+ecryptfs-utils (75) released; urgency=low
+
+  [ Dustin Kirkland ]
+  * debian/rules: drop hackery that moves stuff /usr/share/ecryptfs-utils
+  * src/utils/mount.ecryptfs_private.c: update inline documentation
+  * debian/changelog, src/libecryptfs/cmd_ln_parser.c,
+    src/libecryptfs/key_management.c, src/pam_ecryptfs/pam_ecryptfs.c,
+    src/utils/ecryptfs_add_passphrase.c,
+    src/utils/ecryptfs_insert_wrapped_passphrase_into_keyring.c,
+    src/utils/ecryptfs_rewrap_passphrase.c,
+    src/utils/ecryptfs_unwrap_passphrase.c,
+    src/utils/ecryptfs_wrap_passphrase.c: silence some useless logging,
+    LP: #313330
+  * include/ecryptfs.h, libecryptfs/key_management.c,
+    utils/ecryptfs_insert_wrapped_passphrase_into_keyring.c,
+    utils/ecryptfs_unwrap_passphrase.c: if the file to unwrap is
+    unspecified, try to use the default ~/.ecryptfs/wrapped-passphrase
+    before bailing out, LP: #359997
+  * src/utils/ecryptfs-setup-private: unix_chkpwd is not always present
+    (eg, gentoo), LP: #332341
+
+  [ Tyler Hicks ]
+  * doc/manpage/ecryptfs.7: ecryptfs_encrypted_view option desription
+    was wrong LP: #328761
+
+  [ Michal Hlavinka ]
+  * decision_graph.c: fix uninitialized return code
+  * mount.ecryptfs.c: don't pass verbosity option to kernel
+
+  [ anrxc & Dustin Kirkland ]
+  * doc/Makefile.am, src/desktop/Makefile.am: fix automake installation from
+    /usr/share to /usr/share/ecryptfs-utils
+
+  [ Daniel Baumann & Dustin Kirkland ]
+  * debian/rules, debian/control: sync differences between Debian & Ubuntu's
+    packaging
+
+  [ Arfrever Frehtes Taifersar Arahesis ]
+  * src/key_mod/ecryptfs_key_mod_gpg.c,
+    src/key_mod/ecryptfs_key_mod_pkcs11_helper.c: fix implicit declations
+
+  [ Frédéric Guihéry ]
+  * key_mod/ecryptfs_key_mod_tspi.c, utils/ecryptfs_generate_tpm_key.c:
+    the SRK password should be set to 20 bytes of NULL (wellknown
+    password), in order for different tools to request key protection
+    with the Storage Root Key
+
+ -- Dustin Kirkland <[e-mail]>  Fri, 01 May 2009 15:07:38 -0500
+
+ecryptfs-utils (74) released; urgency=low
 
   [ Michal Hlavinka ]
   * Changes for RH/Fedora release

=== modified file 'debian/control'
--- debian/control	2009-02-18 21:30:21 +0000
+++ debian/control	2010-02-17 20:48:18 +0000
@@ -1,19 +1,47 @@
 Source: ecryptfs-utils
 Section: misc
 Priority: optional
-Maintainer: Ubuntu Core Developers <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
 XSBC-Original-Maintainer: Daniel Baumann <[e-mail]>
-Build-Depends: debhelper (>= 7), dpatch, autotools-dev, autoconf, automake, libtool, libgcrypt11-dev, libgpg-error-dev, libgpgme11-dev, libkeyutils-dev, libopencryptoki-dev [alpha amd64 arm armel hppa ia64 i386 m68k mips mipsel powerpc sparc], libpam0g-dev, libpkcs11-helper1-dev, libssl-dev, libtspi-dev [alpha amd64 arm armel hppa ia64 i386 m68k mips mipsel powerpc sparc], pkg-config, python-dev, swig
-Standards-Version: 3.8.0
+Build-Depends:
+ debhelper (>= 7),
+ autotools-dev,
+ autoconf,
+ automake,
+ libtool,
+ libgcrypt11-dev,
+ libgpg-error-dev,
+ libgpgme11-dev,
+ libkeyutils-dev,
+ libnss3-dev,
+ libopencryptoki-dev [alpha amd64 arm armel hppa ia64 i386 m68k mips mipsel powerpc sparc],
+ libpam0g-dev,
+ libpkcs11-helper1-dev,
+ libtspi-dev [alpha amd64 arm armel hppa ia64 i386 m68k mips mipsel powerpc sparc],
+ pkg-config,
+ python-dev,
+ swig
+Standards-Version: 3.8.3
 Homepage: https://launchpad.net/ecryptfs
-Vcs-Browser: http://git.debian.net/?p=debian/ecryptfs-utils.git
-Vcs-Git: git://git.debian.net/git/debian/ecryptfs-utils.git
+Vcs-Bzr: https://code.launchpad.net/~ecryptfs/ecryptfs/ecryptfs-utils
+Vcs-Browser: http://bazaar.launchpad.net/~ecryptfs/ecryptfs/ecryptfs-utils/files
 
 Package: ecryptfs-utils
 Section: misc
 Architecture: any
-Depends: ${shlibs:Depends}, ${misc:Depends}, libpam-runtime (>= 1.0.1-2ubuntu1), keyutils, libnss3-1d
-Suggests: opencryptoki, cryptsetup
+Depends:
+ ${misc:Depends},
+ ${shlibs:Depends},
+ keyutils,
+ libnss3-1d,
+ libpam-runtime (>= 1.0.1-6),
+ gettext-base
+Recommends:
+ lsof,
+ rsync
+Suggests:
+ cryptsetup,
+ opencryptoki
 Description: ecryptfs cryptographic filesystem (utilities)
  eCryptfs is a POSIX-compliant enterprise-class stacked cryptographic filesystem
  for Linux.
@@ -33,7 +61,9 @@
 Package: libecryptfs0
 Section: libs
 Architecture: any
-Depends: ${shlibs:Depends}, ${misc:Depends}
+Depends:
+ ${misc:Depends},
+ ${shlibs:Depends}
 Description: ecryptfs cryptographic filesystem (library)
  eCryptfs is a POSIX-compliant enterprise-class stacked cryptographic filesystem
  for Linux.
@@ -43,7 +73,17 @@
 Package: libecryptfs-dev
 Section: libdevel
 Architecture: any
-Depends: libecryptfs0 (= ${binary:Version}), libgcrypt11-dev, libgpg-error-dev, libgpgme11-dev, libkeyutils-dev, libopencryptoki-dev [alpha amd64 arm armel hppa ia64 i386 m68k mips mipsel powerpc sparc], libpam0g-dev, libpkcs11-helper1-dev, libtspi-dev [alpha amd64 arm armel hppa ia64 i386 m68k mips mipsel powerpc sparc]
+Depends:
+ ${misc:Depends},
+ libecryptfs0 (= ${binary:Version}),
+ libgcrypt11-dev,
+ libgpg-error-dev,
+ libgpgme11-dev,
+ libkeyutils-dev,
+ libopencryptoki-dev [alpha amd64 arm armel hppa ia64 i386 m68k mips mipsel powerpc sparc],
+ libpam0g-dev,
+ libpkcs11-helper1-dev,
+ libtspi-dev [alpha amd64 arm armel hppa ia64 i386 m68k mips mipsel powerpc sparc]
 Description: ecryptfs cryptographic filesystem (development)
  eCryptfs is a POSIX-compliant enterprise-class stacked cryptographic filesystem
  for Linux.

=== modified file 'debian/copyright'
--- debian/copyright	2009-02-13 15:57:24 +0000
+++ debian/copyright	2010-02-17 20:48:18 +0000
@@ -1,11 +1,16 @@
 Authors:
  Phillip Hellewell <[e-mail]>
- Michael A. Halcrow <[e-mail]>
- Dustin Kirkland <[e-mail]>
-Download: https://launchpad.net/ecryptfs/trunk
+ Michael A. Halcrow <[e-mail]>
+ Dustin Kirkland <[e-mail]>
+ Tyler Hicks <[e-mail]>
+
+Upstream-Contact: Dustin Kirkland <[e-mail]>
+Upstream-Homepage: https://launchpad.net/ecryptfs
 
 Files: *
-Copyright: 2004-2008 International Business Machines Corp.
+Copyright:
+ (C) 2004-2009 International Business Machines Corp.
+ (C) 2008-2009 Canonical, Ltd.
 License: GPL-2+
  This program is free software; you can redistribute it and/or
  modify it under the terms of the GNU General Public License
@@ -46,7 +51,7 @@
  can be found in /usr/share/common-licenses/GPL-2 file.
 
 Files: debian/*
-Copyright: (C) 2007-2008 Daniel Baumann <[e-mail]>
+Copyright: (C) 2007-2009 Daniel Baumann <[e-mail]>
 License: GPL-2+
  This program is free software; you can redistribute it and/or
  modify it under the terms of the GNU General Public License

=== removed file 'debian/ecryptfs-utils.dirs'
--- debian/ecryptfs-utils.dirs	2009-03-24 21:15:49 +0000
+++ debian/ecryptfs-utils.dirs	1970-01-01 00:00:00 +0000
@@ -1,2 +0,0 @@
-usr/share/pam-configs
-usr/share/ecryptfs-utils

=== added file 'debian/ecryptfs-utils.ecryptfs-utils-restore.upstart'
--- debian/ecryptfs-utils.ecryptfs-utils-restore.upstart	1970-01-01 00:00:00 +0000
+++ debian/ecryptfs-utils.ecryptfs-utils-restore.upstart	2010-02-17 20:48:18 +0000
@@ -0,0 +1,26 @@
+# eCryptfs restore
+description "eCryptfs"
+author "Dustin Kirkland <[e-mail]>"
+
+start on runlevel [2345]
+task
+
+# This task is necessary in support of ecryptfs-migrate-home.
+#
+# The administrator is strongly advised that the migrated user must
+# log in before reboot in order for the migration to take effect, as
+# the data in /dev/shm will be lost.
+#
+# The code below moves the /dev/shm data to /var/tmp to persist across
+# boots and prevent users from locking themselves out of their system,
+# however, it's slightly less secure, as these files should not be written
+# to disk, if possible.
+
+script
+	for i in /var/tmp/.ecryptfs-*; do
+		u=$(echo "$i" | sed "s:^/var/tmp/.ecryptfs-::")
+		if [ "$(stat -c %U $i)" = "$u" ]; then
+			mv -n "$i" /dev/shm
+		fi
+	done
+end script

=== added file 'debian/ecryptfs-utils.ecryptfs-utils-save.upstart'
--- debian/ecryptfs-utils.ecryptfs-utils-save.upstart	1970-01-01 00:00:00 +0000
+++ debian/ecryptfs-utils.ecryptfs-utils-save.upstart	2010-02-17 20:48:18 +0000
@@ -0,0 +1,26 @@
+# eCryptfs save
+description "eCryptfs"
+author "Dustin Kirkland <[e-mail]>"
+
+start on runlevel [!2345]
+task
+
+# This task is necessary in support of ecryptfs-migrate-home.
+#
+# The administrator is strongly advised that the migrated user must
+# log in before reboot in order for the migration to take effect, as
+# the data in /dev/shm will be lost.
+#
+# The code below moves the /dev/shm data to /var/tmp to persist across
+# boots and prevent users from locking themselves out of their system,
+# however, it's slightly less secure, as these files should not be written
+# to disk, if possible.
+
+script
+	for i in /dev/shm/.ecryptfs-*; do
+		u=$(echo "$i" | sed "s:^/dev/shm/.ecryptfs-::")
+		if [ "$(stat -c %U $i)" = "$u" ]; then
+			mv -n "$i" /var/tmp
+		fi
+	done
+end script

=== modified file 'debian/ecryptfs-utils.install'
--- debian/ecryptfs-utils.install	2009-02-13 15:57:24 +0000
+++ debian/ecryptfs-utils.install	2010-02-17 20:48:18 +0000
@@ -3,5 +3,6 @@
 /usr/bin
 /usr/lib/ecryptfs
 /usr/share/doc
+/usr/share/ecryptfs-utils
 /usr/share/man
-/usr/share/pam-configs/ecryptfs-utils
+../../debian/lintian/ecryptfs-utils usr/share/lintian/overrides

=== modified file 'debian/ecryptfs-utils.postinst'
--- debian/ecryptfs-utils.postinst	2009-02-13 15:57:24 +0000
+++ debian/ecryptfs-utils.postinst	2010-02-17 20:48:18 +0000
@@ -1,44 +1,20 @@
-#!/bin/sh -e
-
-auth=0c1295085dca124e6ba5a3cea7993c22
-account=9f04221fe44762047894adeb96ffd069
-session=2e9a42f2a3b6573891ff9e6bf0c31c9e
-password=4cf59ec48caad2a06ea2e183d8bc007a
-
-force=
-if dpkg --compare-versions "$2" lt-nl 53-1ubuntu6; then
-        # If we're upgrading from an older ecryptfs-utils,
-        # and the pam configuration precisely matches that
-        # which was written by auth-client-config, we can
-        # safely force the pam-auth-update.
-        force=--force
-        for type in auth account session password
-        do
-            sum="$(md5sum /etc/pam.d/common-$type 2>/dev/null | awk '{ print $1 }')"
-            [ "$sum" = "$(eval echo \$$type)" ] || force=
-        done
-fi
-pam-auth-update --package $force
-
-#DEBHELPER#
-
-exit 0
 #!/bin/sh
 
 set -e
 
 case "${1}" in
 	configure)
-		# Basically, if a user chooses to encrypt their entire home
-		# directory, we're going to need someplace to put their
-		# ~/.ecryptfs directory that's available prior to mounting their
-		# home directory. Classic chicken/egg bootstrapping.
-
-		if [ ! -d /var/lib/ecryptfs ]
-		then
-			mkdir -p /var/lib/ecryptfs
-			chmod 1777 /var/lib/ecryptfs
-		fi
+		[ -e /var/log/installer/syslog ] && sed -i '/user-setup: YOU SHOULD RECORD THIS/,+2 d' /var/log/installer/syslog
+		pam-auth-update --package
+		# Try to migrate encrypted Private counters from /tmp to /dev/shm, if sane
+		for i in $(ls /home); do
+			if [ -f "/tmp/ecryptfs-$i-Private" ] && [ ! -e "/dev/shm/ecryptfs-$i-Private" ]; then
+				o=$(stat -c %U "/tmp/ecryptfs-$i-Private")
+				if [ $i = $o ]; then
+					mv -f /tmp/ecryptfs-$i-Private /dev/shm
+				fi
+			fi
+		done
 		;;
 
 	abort-upgrade|abort-remove|abort-deconfigure)

=== modified file 'debian/libecryptfs0.shlibs'
--- debian/libecryptfs0.shlibs	2009-02-13 15:57:24 +0000
+++ debian/libecryptfs0.shlibs	2010-02-17 20:48:18 +0000
@@ -1,1 +1,1 @@
-libecryptfs 0 libecryptfs0 (>= 48)
+libecryptfs 0 libecryptfs0 (>= 77)

=== added directory 'debian/lintian'
=== renamed file 'debian/ecryptfs-utils.lintian-overides' => 'debian/lintian/ecryptfs-utils'
--- debian/ecryptfs-utils.lintian-overides	2009-02-13 15:57:24 +0000
+++ debian/lintian/ecryptfs-utils	2010-02-17 20:48:18 +0000
@@ -1,1 +1,14 @@
+# This setuid is required for encrypted-home and encrypted-private;
+# Other distros or sysadmins could perhaps make it 4750, and create
+# an ecryptfs group, adding permitted users to this group (though
+# we're not doing this in Ubuntu).
 ecryptfs-utils: setuid-binary sbin/mount.ecryptfs_private 4755 root/root
+
+# The *.desktop files need to be executable
+ecryptfs-utils: executable-not-elf-or-script ./usr/share/ecryptfs-utils/ecryptfs-mount-private.desktop
+ecryptfs-utils: executable-not-elf-or-script ./usr/share/ecryptfs-utils/ecryptfs-setup-private.desktop
+ecryptfs-utils: executable-not-elf-or-script ./usr/share/ecryptfs-utils/ecryptfs-record-passphrase
+
+# We're not creating these files, but rather moving them, and the utilities
+# that use them provide the necessary owernship checks
+ecryptfs-utils: possibly-insecure-handling-of-tmp-files-in-maintainer-script postinst:9

=== added directory 'debian/local'
=== renamed file 'debian/ecryptfs-utils.pam-auth-update' => 'debian/local/ecryptfs-utils.pam-auth-update'
--- debian/ecryptfs-utils.pam-auth-update	2009-02-13 15:57:24 +0000
+++ debian/local/ecryptfs-utils.pam-auth-update	2010-02-17 20:48:18 +0000
@@ -3,10 +3,10 @@
 Priority: 0
 Auth-Type: Additional
 Auth-Final:
-        optional	pam_ecryptfs.so unwrap
+	optional	pam_ecryptfs.so unwrap
 Session-Type: Additional
 Session-Final:
-        optional	pam_ecryptfs.so unwrap
+	optional	pam_ecryptfs.so unwrap
 Password-Type: Additional
 Password-Final:
-        optional	pam_ecryptfs.so
+	optional	pam_ecryptfs.so

=== added directory 'debian/po'
=== added file 'debian/po/POTFILES.sh'
--- debian/po/POTFILES.sh	1970-01-01 00:00:00 +0000
+++ debian/po/POTFILES.sh	2010-02-17 20:48:18 +0000
@@ -0,0 +1,5 @@
+src/utils/ecryptfs-mount-private
+src/utils/ecryptfs-rewrite-file
+src/utils/ecryptfs-setup-private
+src/utils/ecryptfs-setup-swap
+src/utils/ecryptfs-umount-private

=== added file 'debian/po/ecryptfs-utils.pot'
--- debian/po/ecryptfs-utils.pot	1970-01-01 00:00:00 +0000
+++ debian/po/ecryptfs-utils.pot	2010-02-17 20:48:18 +0000
@@ -0,0 +1,407 @@
+# SOME DESCRIPTIVE TITLE.
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
+#
+#, fuzzy
+msgid ""
+msgstr ""
+"Project-Id-Version: PACKAGE VERSION\n"
+"Report-Msgid-Bugs-To: \n"
+"POT-Creation-Date: 2009-07-23 18:15-0500\n"
+"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
+"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
+"Language-Team: LANGUAGE <[e-mail]>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=CHARSET\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#: src/utils/ecryptfs-mount-private:19
+msgid "Enter your login passphrase:"
+msgstr ""
+
+#: src/utils/ecryptfs-mount-private:24
+msgid "Enter your wrapping passphrase:"
+msgstr ""
+
+#: src/utils/ecryptfs-mount-private:49 src/utils/ecryptfs-mount-private:55
+#: src/utils/ecryptfs-mount-private:60 src/utils/ecryptfs-rewrite-file:24
+#: src/utils/ecryptfs-setup-private:84 src/utils/ecryptfs-setup-private:264
+#: src/utils/ecryptfs-setup-private:272 src/utils/ecryptfs-setup-private:282
+#: src/utils/ecryptfs-setup-private:313 src/utils/ecryptfs-setup-swap:25
+msgid "ERROR:"
+msgstr ""
+
+#: src/utils/ecryptfs-mount-private:49
+msgid "Your passphrase is incorrect"
+msgstr ""
+
+#: src/utils/ecryptfs-mount-private:55 src/utils/ecryptfs-setup-private:289
+msgid "Too many incorrect password attempts, exiting"
+msgstr ""
+
+#: src/utils/ecryptfs-mount-private:60
+msgid "Encrypted private directory is not setup properly"
+msgstr ""
+
+#: src/utils/ecryptfs-mount-private:65 src/utils/ecryptfs-mount-private:66
+#: src/utils/ecryptfs-rewrite-file:30 src/utils/ecryptfs-setup-private:276
+#: src/utils/ecryptfs-setup-private:344 src/utils/ecryptfs-setup-private:349
+#: src/utils/ecryptfs-setup-swap:30 src/utils/ecryptfs-umount-private:21
+#: src/utils/ecryptfs-umount-private:22
+msgid "INFO:"
+msgstr ""
+
+#: src/utils/ecryptfs-mount-private:65
+msgid "Your private directory has been mounted."
+msgstr ""
+
+#: src/utils/ecryptfs-mount-private:66 src/utils/ecryptfs-umount-private:22
+msgid "To see this change in your current shell:"
+msgstr ""
+
+#: src/utils/ecryptfs-rewrite-file:23
+msgid "[FAILED]"
+msgstr ""
+
+#: src/utils/ecryptfs-rewrite-file:30
+msgid "Rewriting"
+msgstr ""
+
+#: src/utils/ecryptfs-rewrite-file:32
+msgid "File does not exist"
+msgstr ""
+
+#: src/utils/ecryptfs-rewrite-file:36
+msgid "[EXCLUDED]"
+msgstr ""
+
+#: src/utils/ecryptfs-rewrite-file:43
+msgid "Could not create tempdir"
+msgstr ""
+
+#: src/utils/ecryptfs-rewrite-file:47 src/utils/ecryptfs-rewrite-file:52
+#: src/utils/ecryptfs-rewrite-file:66
+msgid "Could not rename"
+msgstr ""
+
+#: src/utils/ecryptfs-rewrite-file:57
+msgid "Could not create tempfile"
+msgstr ""
+
+#: src/utils/ecryptfs-rewrite-file:61
+msgid "Could not copy"
+msgstr ""
+
+#: src/utils/ecryptfs-rewrite-file:70
+msgid "[OK]"
+msgstr ""
+
+#: src/utils/ecryptfs-rewrite-file:73
+msgid "rewrites succeeded"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:14
+msgid "Enter your login passphrase"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:104
+msgid "Can't get ecryptfs version, ecryptfs kernel module not loaded?"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:131
+msgid "Enter your wrapping passphrase"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:155
+msgid "You must be root to bootstrap encrypt a home directory"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:178 src/utils/ecryptfs-setup-private:183
+msgid "ERROR: "
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:178
+msgid "You must provide a username"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:183 src/utils/ecryptfs-setup-private:191
+msgid "User does not exist"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:197
+msgid "User needs to be a member of ecryptfs group"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:204
+msgid "User home directory does not exist"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:223
+msgid "wrapped-passphrase file already exists, use --force to overwrite."
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:226
+msgid "file already exists, use --force to overwrite."
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:230 src/utils/ecryptfs-setup-private:231
+msgid "is already mounted"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:238 src/utils/ecryptfs-setup-private:242
+msgid "must be empty before proceeding"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:264
+msgid "Wrapping passphrases must match"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:272
+msgid "You must provide a login passphrase"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:276
+msgid "Skipping password verification"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:298
+msgid "Enter your mount passphrase [leave blank to generate one]: "
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:308
+msgid "Enter your mount passphrase (again): "
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:313
+msgid "Mount passphrases do not match"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:321
+msgid "Too many incorrect passphrase attempts, exiting"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:327
+msgid ""
+"YOU SHOULD RECORD YOUR MOUNT PASSPHRASE AND STORE IT IN A SAFE LOCATION."
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:329
+msgid "THIS WILL BE REQUIRED IF YOU NEED TO RECOVER YOUR DATA AT A LATER TIME."
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:336
+msgid "Could not create crypt directory"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:337
+msgid "Could not create mount directory"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:344
+msgid "will not be mounted on login"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:346
+msgid "Could not setup ecryptfs auto-mount"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:349
+msgid "will not be unmounted on logout"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:351
+msgid "Could not setup ecryptfs auto-umount"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:355
+msgid "Could not remove ecryptfs wrapping-independent"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:357
+msgid "Could not setup ecryptfs wrapping-independent"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:365
+msgid "Could not backup existing data"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:381
+msgid "Could not wrap passphrase"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:389
+msgid "Could not add passphrase to the current keyring"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:393
+msgid "Could not obtain the key signature"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:396
+msgid "Could not create signature file"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:399
+msgid "Could not create mountpoint file"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:403
+msgid "Done configuring."
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:433
+msgid "Testing mount/write/umount/read..."
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:434
+msgid "Could not mount private ecryptfs directory"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:435
+msgid "Could not create empty file"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:436
+msgid "Could not generate random data"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:437
+msgid "Could not write encrypted file"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:438
+msgid "Could not read encrypted file"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:439
+msgid "Could not unmount private ecryptfs directory"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:440
+msgid "Could not mount private ecryptfs directory (2)"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:441
+msgid "Could not read encrypted file (2)"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:445
+msgid "Could not unmount private ecryptfs directory (2)"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:447
+msgid "Testing failed."
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:449
+msgid "Testing succeeded."
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:453
+msgid "Logout, and log back in to begin using your encrypted directory."
+msgstr ""
+
+#: src/utils/ecryptfs-setup-swap:34
+msgid "WARNING:"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-swap:39
+msgid "Usage:"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-swap:60
+msgid "Please install"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-swap:63
+msgid "This program must be run with 'sudo', or as root"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-swap:70
+msgid "You do not currently have any swap space defined."
+msgstr ""
+
+#: src/utils/ecryptfs-setup-swap:72
+msgid "You can create a swap file by doing:"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-swap:77
+msgid "And then re-run"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-swap:81
+msgid "You have more than one swap space defined."
+msgstr ""
+
+#: src/utils/ecryptfs-setup-swap:82
+msgid "only supports setting up a single swap space"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-swap:89
+msgid "does not appear to be swap space"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-swap:94
+msgid "already appears to be encrypted."
+msgstr ""
+
+#: src/utils/ecryptfs-setup-swap:103
+msgid "already has an entry in /etc/crypttab."
+msgstr ""
+
+#: src/utils/ecryptfs-setup-swap:107
+msgid "already has an entry in /etc/fstab."
+msgstr ""
+
+#: src/utils/ecryptfs-setup-swap:113
+msgid "There appears to be a cryptswap entry in /etc/cryptab; aborting."
+msgstr ""
+
+#: src/utils/ecryptfs-setup-swap:118
+msgid "There appears to be a cryptswap entry in /etc/fstab; aborting."
+msgstr ""
+
+#: src/utils/ecryptfs-setup-swap:124
+msgid "Commented out your unencrypted swap from /etc/fstab"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-swap:126
+msgid "Your swap space isn't currently listed in /etc/fstab"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-swap:134
+msgid ""
+"An encrypted swap is required to help ensure that encrypted files are not "
+"leaked to disk in an unencrypted format."
+msgstr ""
+
+#: src/utils/ecryptfs-setup-swap:136
+msgid ""
+"HOWEVER, THE SWAP ENCRYPTION CONFIGURATION PRODUCED BY THIS PROGRAM WILL "
+"BREAK HIBERNATE/RESUME ON THIS SYSTEM!"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-swap:138
+msgid "NOTE: Your suspend/resume capabilities will not be affected."
+msgstr ""
+
+#: src/utils/ecryptfs-setup-swap:140
+msgid "Do you want to proceed with encrypting your swap?"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-swap:145
+msgid "Aborting."
+msgstr ""
+
+#: src/utils/ecryptfs-setup-swap:153
+msgid "Setting up swap:"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-swap:170
+msgid "Successfully setup encrypted swap!"
+msgstr ""
+
+#: src/utils/ecryptfs-umount-private:21
+msgid "Your private directory has been unmounted."
+msgstr ""

=== added file 'debian/po/fr.po'
--- debian/po/fr.po	1970-01-01 00:00:00 +0000
+++ debian/po/fr.po	2010-02-17 20:48:18 +0000
@@ -0,0 +1,389 @@
+#: src/utils/ecryptfs-mount-private:19
+msgid "Enter your login passphrase:"
+msgstr ""
+
+#: src/utils/ecryptfs-mount-private:24
+msgid "Enter your wrapping passphrase:"
+msgstr ""
+
+#: src/utils/ecryptfs-mount-private:49 src/utils/ecryptfs-mount-private:55
+#: src/utils/ecryptfs-mount-private:60 src/utils/ecryptfs-rewrite-file:24
+#: src/utils/ecryptfs-setup-private:84 src/utils/ecryptfs-setup-private:264
+#: src/utils/ecryptfs-setup-private:272 src/utils/ecryptfs-setup-private:282
+#: src/utils/ecryptfs-setup-private:313 src/utils/ecryptfs-setup-swap:25
+msgid "ERROR:"
+msgstr ""
+
+#: src/utils/ecryptfs-mount-private:49
+msgid "Your passphrase is incorrect"
+msgstr ""
+
+#: src/utils/ecryptfs-mount-private:55 src/utils/ecryptfs-setup-private:289
+msgid "Too many incorrect password attempts, exiting"
+msgstr ""
+
+#: src/utils/ecryptfs-mount-private:60
+msgid "Encrypted private directory is not setup properly"
+msgstr ""
+
+#: src/utils/ecryptfs-mount-private:65 src/utils/ecryptfs-mount-private:66
+#: src/utils/ecryptfs-rewrite-file:30 src/utils/ecryptfs-setup-private:276
+#: src/utils/ecryptfs-setup-private:344 src/utils/ecryptfs-setup-private:349
+#: src/utils/ecryptfs-setup-swap:30 src/utils/ecryptfs-umount-private:21
+#: src/utils/ecryptfs-umount-private:22
+msgid "INFO:"
+msgstr ""
+
+#: src/utils/ecryptfs-mount-private:65
+msgid "Your private directory has been mounted."
+msgstr ""
+
+#: src/utils/ecryptfs-mount-private:66 src/utils/ecryptfs-umount-private:22
+msgid "To see this change in your current shell:"
+msgstr ""
+
+#: src/utils/ecryptfs-rewrite-file:23
+msgid "[FAILED]"
+msgstr ""
+
+#: src/utils/ecryptfs-rewrite-file:30
+msgid "Rewriting"
+msgstr ""
+
+#: src/utils/ecryptfs-rewrite-file:32
+msgid "File does not exist"
+msgstr ""
+
+#: src/utils/ecryptfs-rewrite-file:36
+msgid "[EXCLUDED]"
+msgstr ""
+
+#: src/utils/ecryptfs-rewrite-file:43
+msgid "Could not create tempdir"
+msgstr ""
+
+#: src/utils/ecryptfs-rewrite-file:47 src/utils/ecryptfs-rewrite-file:52
+#: src/utils/ecryptfs-rewrite-file:66
+msgid "Could not rename"
+msgstr ""
+
+#: src/utils/ecryptfs-rewrite-file:57
+msgid "Could not create tempfile"
+msgstr ""
+
+#: src/utils/ecryptfs-rewrite-file:61
+msgid "Could not copy"
+msgstr ""
+
+#: src/utils/ecryptfs-rewrite-file:70
+msgid "[OK]"
+msgstr ""
+
+#: src/utils/ecryptfs-rewrite-file:73
+msgid "rewrites succeeded"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:14
+msgid "Enter your login passphrase"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:104
+msgid "Can't get ecryptfs version, ecryptfs kernel module not loaded?"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:131
+msgid "Enter your wrapping passphrase"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:155
+msgid "You must be root to bootstrap encrypt a home directory"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:178 src/utils/ecryptfs-setup-private:183
+msgid "ERROR: "
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:178
+msgid "You must provide a username"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:183 src/utils/ecryptfs-setup-private:191
+msgid "User does not exist"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:197
+msgid "User needs to be a member of ecryptfs group"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:204
+msgid "User home directory does not exist"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:223
+msgid "wrapped-passphrase file already exists, use --force to overwrite."
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:226
+msgid "file already exists, use --force to overwrite."
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:230 src/utils/ecryptfs-setup-private:231
+msgid "is already mounted"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:238 src/utils/ecryptfs-setup-private:242
+msgid "must be empty before proceeding"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:264
+msgid "Wrapping passphrases must match"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:272
+msgid "You must provide a login passphrase"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:276
+msgid "Skipping password verification"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:298
+msgid "Enter your mount passphrase [leave blank to generate one]: "
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:308
+msgid "Enter your mount passphrase (again): "
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:313
+msgid "Mount passphrases do not match"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:321
+msgid "Too many incorrect passphrase attempts, exiting"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:327
+msgid ""
+"YOU SHOULD RECORD YOUR MOUNT PASSPHRASE AND STORE IT IN A SAFE LOCATION."
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:329
+msgid "THIS WILL BE REQUIRED IF YOU NEED TO RECOVER YOUR DATA AT A LATER TIME."
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:336
+msgid "Could not create crypt directory"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:337
+msgid "Could not create mount directory"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:344
+msgid "will not be mounted on login"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:346
+msgid "Could not setup ecryptfs auto-mount"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:349
+msgid "will not be unmounted on logout"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:351
+msgid "Could not setup ecryptfs auto-umount"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:355
+msgid "Could not remove ecryptfs wrapping-independent"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:357
+msgid "Could not setup ecryptfs wrapping-independent"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:365
+msgid "Could not backup existing data"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:381
+msgid "Could not wrap passphrase"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:389
+msgid "Could not add passphrase to the current keyring"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:393
+msgid "Could not obtain the key signature"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:396
+msgid "Could not create signature file"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:399
+msgid "Could not create mountpoint file"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:403
+msgid "Done configuring."
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:433
+msgid "Testing mount/write/umount/read..."
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:434
+msgid "Could not mount private ecryptfs directory"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:435
+msgid "Could not create empty file"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:436
+msgid "Could not generate random data"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:437
+msgid "Could not write encrypted file"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:438
+msgid "Could not read encrypted file"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:439
+msgid "Could not unmount private ecryptfs directory"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:440
+msgid "Could not mount private ecryptfs directory (2)"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:441
+msgid "Could not read encrypted file (2)"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:445
+msgid "Could not unmount private ecryptfs directory (2)"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:447
+msgid "Testing failed."
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:449
+msgid "Testing succeeded."
+msgstr ""
+
+#: src/utils/ecryptfs-setup-private:453
+msgid "Logout, and log back in to begin using your encrypted directory."
+msgstr ""
+
+#: src/utils/ecryptfs-setup-swap:34
+msgid "WARNING:"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-swap:39
+msgid "Usage:"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-swap:60
+msgid "Please install"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-swap:63
+msgid "This program must be run with 'sudo', or as root"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-swap:70
+msgid "You do not currently have any swap space defined."
+msgstr ""
+
+#: src/utils/ecryptfs-setup-swap:72
+msgid "You can create a swap file by doing:"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-swap:77
+msgid "And then re-run"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-swap:81
+msgid "You have more than one swap space defined."
+msgstr ""
+
+#: src/utils/ecryptfs-setup-swap:82
+msgid "only supports setting up a single swap space"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-swap:89
+msgid "does not appear to be swap space"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-swap:94
+msgid "already appears to be encrypted."
+msgstr ""
+
+#: src/utils/ecryptfs-setup-swap:103
+msgid "already has an entry in /etc/crypttab."
+msgstr ""
+
+#: src/utils/ecryptfs-setup-swap:107
+msgid "already has an entry in /etc/fstab."
+msgstr ""
+
+#: src/utils/ecryptfs-setup-swap:113
+msgid "There appears to be a cryptswap entry in /etc/cryptab; aborting."
+msgstr ""
+
+#: src/utils/ecryptfs-setup-swap:118
+msgid "There appears to be a cryptswap entry in /etc/fstab; aborting."
+msgstr ""
+
+#: src/utils/ecryptfs-setup-swap:124
+msgid "Commented out your unencrypted swap from /etc/fstab"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-swap:126
+msgid "Your swap space isn't currently listed in /etc/fstab"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-swap:134
+msgid ""
+"An encrypted swap is required to help ensure that encrypted files are not "
+"leaked to disk in an unencrypted format."
+msgstr ""
+
+#: src/utils/ecryptfs-setup-swap:136
+msgid ""
+"HOWEVER, THE SWAP ENCRYPTION CONFIGURATION PRODUCED BY THIS PROGRAM WILL "
+"BREAK HIBERNATE/RESUME ON THIS SYSTEM!"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-swap:138
+msgid "NOTE: Your suspend/resume capabilities will not be affected."
+msgstr ""
+
+#: src/utils/ecryptfs-setup-swap:140
+msgid "Do you want to proceed with encrypting your swap?"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-swap:145
+msgid "Aborting."
+msgstr ""
+
+#: src/utils/ecryptfs-setup-swap:153
+msgid "Setting up swap:"
+msgstr ""
+
+#: src/utils/ecryptfs-setup-swap:170
+msgid "Successfully setup encrypted swap!"
+msgstr ""
+
+#: src/utils/ecryptfs-umount-private:21
+msgid "Your private directory has been unmounted."
+msgstr ""

=== modified file 'debian/rules'
--- debian/rules	2009-04-22 00:07:59 +0000
+++ debian/rules	2010-02-17 20:48:18 +0000
@@ -1,43 +1,63 @@
 #!/usr/bin/make -f
 
-include /usr/share/dpatch/dpatch.make
+PKG=ecryptfs-utils
+PO_DIR=debian/po
 
-DEB_BUILD_ARCH		?= $(shell dpkg-architecture -qDEB_BUILD_ARCH)
 DEB_HOST_GNU_TYPE	?= $(shell dpkg-architecture -qDEB_HOST_GNU_TYPE)
 DEB_BUILD_GNU_TYPE	?= $(shell dpkg-architecture -qDEB_BUILD_GNU_TYPE)
 
-CFLAGS = -Wall -g
-
-ifneq (,$(findstring noopt,$(DEB_BUILD_OPTIONS)))
-	CFLAGS += -O0
+ifneq ($(DEB_HOST_GNU_TYPE),$(DEB_BUILD_GNU_TYPE))
+	CROSS=CC=$(DEB_HOST_GNU_TYPE)-gcc
 else
-	CFLAGS += -O2
+	CROSS=
 endif
 
+DEB_BUILD_ARCH		?= $(shell dpkg-architecture -qDEB_BUILD_ARCH)
+
 ifneq ($(DEB_BUILD_ARCH),s390)
 	TPMFLAGS = --enable-opencryptoki
 endif
 
-clean: unpatch
+install-po: update-pot
+	for po in ${PO_DIR}/*.po ; do \
+		lang=$${po#po/}; lang=$${lang%.po}; \
+		mkdir -p ${PO_DIR}/locale/$${lang}/LC_MESSAGES/; \
+		msgfmt $${po} -o ${PO_DIR}/locale/$${lang}/LC_MESSAGES/${PKG}.mo ; \
+	done
+
+update-pot:
+	rm -f ${PO_DIR}/${PKG}.pot
+	xgettext -o ${PO_DIR}/${PKG}.pot -L Shell -f ${PO_DIR}/POTFILES.sh
+	for po in ${PO_DIR}/*.po ; do \
+		msgmerge $${po} ${PO_DIR}/${PKG}.pot -o $${po} ; \
+	done
+
+clean:
 	dh_testdir
 	dh_testroot
 	rm -f build-stamp
 	rm -f config.guess config.sub
+	for po in ${PO_DIR}/*.po ; do \
+		lang=$${po#po/}; lang=$${lang%.po}; \
+		rm -f ${PO_DIR}/locale/$${lang}/LC_MESSAGES/${PKG}.mo ; \
+	done
+
 
 	[ ! -f Makefile ] || $(MAKE) distclean
 
 	dh_clean
 
-config.status: configure patch
+config.status: configure
 	dh_testdir
 
+ifneq "$(wildcard /usr/share/misc/config.guess)" ""
+	cp -f /usr/share/misc/config.guess config.guess
+endif
 ifneq "$(wildcard /usr/share/misc/config.sub)" ""
 	cp -f /usr/share/misc/config.sub config.sub
 endif
-ifneq "$(wildcard /usr/share/misc/config.guess)" ""
-	cp -f /usr/share/misc/config.guess config.guess
-endif
-	CFLAGS="$(CFLAGS)" ./configure --host=$(DEB_HOST_GNU_TYPE) --build=$(DEB_BUILD_GNU_TYPE) --prefix=/usr --libdir=\$${prefix}/lib --mandir=\$${prefix}/share/man --enable-static --enable-gpg --disable-gui --enable-pam --disable-openssl --disable-pkcs11-helper --disable-tspi $(TPMFLAGS)
+
+	./configure $(CROSS) --prefix=/usr --libdir=\$${prefix}/lib --mandir=\$${prefix}/share/man --enable-static --enable-gpg --enable-nss --disable-gui --enable-pam --disable-openssl --disable-pkcs11-helper --disable-tspi $(TPMFLAGS) CFLAGS="$(CFLAGS)"
 
 build: build-stamp
 build-stamp: config.status
@@ -47,17 +67,14 @@
 
 	touch build-stamp
 
-install: build
+install: build install-po
 	dh_testdir
 	dh_testroot
 	dh_prep
-	dh_installdirs
 
 	$(MAKE) DESTDIR=$(CURDIR)/debian/tmp install
-	install -m 644 -D $(CURDIR)/debian/ecryptfs-utils.pam-auth-update $(CURDIR)/debian/tmp/usr/share/pam-configs/ecryptfs-utils
 
-	mv debian/tmp/usr/share/ecryptfs-* debian/ecryptfs-utils/usr/share/ecryptfs-utils
-	mv debian/tmp/usr/share/doc/ecryptfs-utils/ecryptfs-mount-private.txt debian/ecryptfs-utils/usr/share/ecryptfs-utils/ecryptfs-mount-private.txt
+	install -D -m 0644 debian/local/ecryptfs-utils.pam-auth-update debian/ecryptfs-utils/usr/share/pam-configs/ecryptfs-utils
 
 	chmod 4755 debian/tmp/sbin/mount.ecryptfs_private
 
@@ -65,12 +82,14 @@
 
 binary: binary-arch
 
-binary-arch: build install
+binary-arch: install
 	dh_testdir
 	dh_testroot
 	dh_installchangelogs ChangeLog
 	dh_installdocs
 	dh_install --fail-missing --sourcedir=debian/tmp
+	dh_installinit --noscripts --error-handler=true --name=ecryptfs-utils-save
+	dh_installinit --noscripts --error-handler=true --name=ecryptfs-utils-restore
 	dh_lintian
 	dh_link
 	dh_strip

=== modified file 'doc/Makefile.am'
--- doc/Makefile.am	2009-02-03 08:50:36 +0000
+++ doc/Makefile.am	2010-02-17 20:48:18 +0000
@@ -18,5 +18,4 @@
 dist_noinst_DATA += ecryptfs-pkcs11-helper-doc.txt
 endif
 
-dist_doc_DATA += ecryptfs-mount-private.txt
-dist_noinst_DATA += ecryptfs-mount-private.txt
+dist_pkgdata_DATA = ecryptfs-mount-private.txt

=== modified file 'doc/ecryptfs-mount-private.txt'
--- doc/ecryptfs-mount-private.txt	2009-02-03 08:50:36 +0000
+++ doc/ecryptfs-mount-private.txt	2010-02-17 20:48:18 +0000
@@ -6,4 +6,4 @@
 or
 
 From the command line, run:
- $ ecryptfs-mount-private
+ ecryptfs-mount-private

=== modified file 'doc/manpage/Makefile.am'
--- doc/manpage/Makefile.am	2009-03-20 19:29:14 +0000
+++ doc/manpage/Makefile.am	2010-02-17 20:48:18 +0000
@@ -21,10 +21,13 @@
 	ecryptfs-rewrap-passphrase.1 \
 	ecryptfs-rewrite-file.1 \
 	ecryptfs-setup-private.1 \
+	ecryptfs-setup-swap.1 \
+	ecryptfs-stat.1 \
 	ecryptfs-umount-private.1 \
 	ecryptfs-unwrap-passphrase.1 \
 	ecryptfs-wrap-passphrase.1 \
 	mount.ecryptfs.8 \
+	umount.ecryptfs.8 \
 	mount.ecryptfs_private.1 \
 	pam_ecryptfs.8 \
 	umount.ecryptfs_private.1

=== modified file 'doc/manpage/ecryptfs-mount-private.1'
--- doc/manpage/ecryptfs-mount-private.1	2009-02-03 08:50:36 +0000
+++ doc/manpage/ecryptfs-mount-private.1	2010-02-17 20:48:18 +0000
@@ -6,7 +6,7 @@
 \fBecryptfs-mount-private\fP
 
 .SH DESCRIPTION
-\fBecryptfs-mount-private\fP is a wrapper script for the \fBmount.ecryptfs_private\fP utility that will interactively prompt for the user's login password, if necessary.
+\fBecryptfs-mount-private\fP is a wrapper script for the \fBmount.ecryptfs_private\fP utility that will interactively prompt for the user's login password, if necessary. You need to be a member of \fBecryptfs\fB group to use this.
 
 .SH FILES
 \fI~/.Private\fP - underlying directory containing encrypted data
@@ -17,7 +17,7 @@
 
 \fI~/.ecryptfs/wrapped-passphrase\fP - file containing the wrapped passphrase
 
-\fI~/.ecryptfs/wrapped-independent\fP - this file exists if the wrapping passphrase is independent from login passphrase
+\fI~/.ecryptfs/wrapping-independent\fP - this file exists if the wrapping passphrase is independent from login passphrase
 
 .SH SEE ALSO
 .PD 0

=== modified file 'doc/manpage/ecryptfs-rewrite-file.1'
--- doc/manpage/ecryptfs-rewrite-file.1	2009-03-20 22:12:06 +0000
+++ doc/manpage/ecryptfs-rewrite-file.1	2010-02-17 20:48:18 +0000
@@ -6,7 +6,7 @@
 \fBecryptfs-rewrite-file [file1] [file2] [file3] ...\fP
 
 .SH DESCRIPTION
-This script takes one or more files/directories/symlinks as arguments, moves each of them to a temporary file, and the moves them back to the original name.  This causes the file to be rewritten (and reencrypted) in the lower filesystem.
+This script takes one or more files/directories/symlinks as arguments, moves each of them to a temporary file, and then moves them back to the original name.  This causes the file to be rewritten (and reencrypted) in the lower filesystem.
 
 This script may be combined with \fBfind\fP(1) and \fBxargs\fP(1) to rewrite an entire eCryptfs mountpoint, unmount, and sync:
 

=== modified file 'doc/manpage/ecryptfs-setup-private.1'
--- doc/manpage/ecryptfs-setup-private.1	2009-03-18 22:00:04 +0000
+++ doc/manpage/ecryptfs-setup-private.1	2010-02-17 20:48:18 +0000
@@ -43,7 +43,7 @@
 
 
 .SH DESCRIPTION
-\fBecryptfs-setup-private\fP is a program that sets up a private cryptographic mountpoint for a non-root user.
+\fBecryptfs-setup-private\fP is a program that sets up a private cryptographic mountpoint for a non-root user, who is a member of \fBecryptfs\fP group.
 
 Be sure to properly escape your parameters according to your shell's special character nuances, and also surround the parameters by double quotes, if necessary. Any of the parameters may be:
 
@@ -78,7 +78,7 @@
 
 \fI~/.ecryptfs/wrapped-passphrase\fP - file containing the mount passphrase, wrapped with the login passphrase
 
-\fI~/.ecryptfs/wrapped-independent\fP - this file exists if the wrapping passphrase is independent from login passphrase
+\fI~/.ecryptfs/wrapping-independent\fP - this file exists if the wrapping passphrase is independent from login passphrase
 
 .SH SEE ALSO
 .PD 0

=== added file 'doc/manpage/ecryptfs-setup-swap.1'
--- doc/manpage/ecryptfs-setup-swap.1	1970-01-01 00:00:00 +0000
+++ doc/manpage/ecryptfs-setup-swap.1	2010-02-17 20:48:18 +0000
@@ -0,0 +1,29 @@
+.TH ecryptfs-setup-swap 1 2009-08-17 ecryptfs-utils "eCryptfs"
+.SH NAME
+ecryptfs-setup-swap \- ensure that any swap space is encrypted
+
+.SH SYNOPSIS
+\fBecryptfs-setup-swap\fP [-f|--force]
+
+.SH DESCRIPTION
+This script will detect existing swap partitions or swap files, and encrypt them, using cryptsetup.
+
+Encrypted swap is essential to securing any system using eCryptfs, since decrypted file contents will exist in the system's memory, which may be swapped to disk at any time.  If the system swap space is not also encrypted, it is possible that decrypted files could be written to disk in clear text.
+
+Note that most Linux distributions do not yet support resuming from an encrypted swap space, and thus hibernate/resume will not work.  Suspend/resume is unaffected.
+
+Upon running the utility, the user will be informed of the hibernate/resume break, and asked to confirm the behavior.  The -f|--force option can be used to bypass this interactive prompt.
+
+.SH SEE ALSO
+.PD 0
+.TP
+\fBcryptsetup\fP(8)
+
+.TP
+\fIhttp://launchpad.net/ecryptfs/\fP
+.PD
+
+.SH AUTHOR
+This manpage and the utility was written by Dustin Kirkland <[e-mail]> for Ubuntu systems (but may be used by others).  Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation.
+
+On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.

=== added file 'doc/manpage/ecryptfs-stat.1'
--- doc/manpage/ecryptfs-stat.1	1970-01-01 00:00:00 +0000
+++ doc/manpage/ecryptfs-stat.1	2010-02-17 20:48:18 +0000
@@ -0,0 +1,18 @@
+.TH ecryptfs-setup-swap 1 2009-08-17 ecryptfs-utils "eCryptfs"
+.SH NAME
+ecryptfs-stat \- Present statistics on encrypted eCryptfs file attributes
+
+.SH SYNOPSIS
+\fBecryptfs-stat\fP filename
+
+.SH DESCRIPTION
+This program will present statistics on encrypted eCryptfs file and its attributes.
+
+.TP
+\fIhttp://launchpad.net/ecryptfs/\fP
+.PD
+
+.SH AUTHOR
+This manpage was written by Dustin Kirkland <[e-mail]> for Ubuntu systems (but may be used by others).  Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation.
+
+On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.

=== modified file 'doc/manpage/ecryptfs.7'
--- doc/manpage/ecryptfs.7	2009-04-21 23:20:27 +0000
+++ doc/manpage/ecryptfs.7	2010-02-17 20:48:18 +0000
@@ -34,7 +34,7 @@
 Do not check the mount key signature against the values in the user's ~/.ecryptfs/sig-cache.txt file. This is useful for such things as non-interactive setup scripts, so that the mount helper does not stop and prompt the user in the event that the key sig is not in the cache.
 .TP
 .B ecryptfs_encrypted_view
-This option, when set, will have eCryptfs return the encrypted versions of the lower files, rather than decrypt encrypted files and return the decrypted data from the lower files. This options is useful for such things as backup utilities.
+This option provides a unified encrypted file format of the eCryptfs files in the lower mount point.  Currently, it is only useful if the lower mount point contains files with the metadata stored in the extended attribute.  Upon a file read in the upper mount point, the encrypted version of the file will be presented with the metadata in the file header instead of the xattr.  Files cannot be opened for writing when this option is enabled. 
 .TP
 .B ecryptfs_xattr
 Store the metadata in the extended attribute of the lower files rather than the header region of the lower files.
@@ -79,7 +79,7 @@
 The filename should be the filename of a file containing an RSA SSL key.
 .TP
 .B openssl_passwd_file=(filename)
-The password should be specified in a file with passwd=(openssl-password). It is highly reccomended that the file be stored on a secure medium such as a personal usb key.
+The password should be specified in a file with openssl_passwd=(openssl-password). It is highly reccomended that the file be stored on a secure medium such as a personal usb key.
 .TP
 .B openssl_passwd_fd=(file descriptor)
 The password is specified through the specified file descriptor.
@@ -93,15 +93,13 @@
 
 .PP
 
-The following command will layover mount eCryptfs on /secret with a passphrase contained in a file stored on secure media mounted at /mnt/secureusb/.
+The following command will layover mount eCryptfs on /secret with a passphrase contained in a file stored on secure media mounted at /mnt/usb/.
 
-\fBmount -t ecryptfs -o
-key=passphrase:passphrase_passwd_file=/mnt/secureusb/passwd_file.txt
-/secret /secret\fP
+\fBmount -t ecryptfs -o key=passphrase:passphrase_passwd_file=/mnt/usb/file.txt /secret /secret\fP
 
 .PP
 
-Where passwd_file.txt contains the contents
+Where file.txt contains the contents
 \fB"passphrase_passwd=[passphrase]"\fP.
 
 .SH SEE ALSO
@@ -119,6 +117,8 @@
 .SH NOTES
 Do not run eCryptfs in verbose-mode unless you are doing so for the sole purpose of development, since secret values will be written out to the system log in that case. Make certain that your eCryptfs mount covers all locations where your applications may write sensitive data. In addition, use dm-crypt to encrypt your swap space with a random key on boot, or see \fBecryptfs-setup-swap\fP(1).
 
+Passphrases have a maximum length of 64 characters.
+
 .SH BUGS
 Please post bug reports to the eCryptfs bug tracker on Launchpad.net: https://bugs.launchpad.net/ecryptfs/+filebug.
 
@@ -128,131 +128,3 @@
 This manpage was (re-)written by Dustin Kirkland <[e-mail]> for Ubuntu systems (but may be used by others).  Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation.
 
 On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
-.\" Automatically generated by Pod::Man v1.37, Pod::Parser v1.35
-.\"
-.\" Standard preamble:
-.\" ========================================================================
-.de Sh \" Subsection heading
-.br
-.if t .Sp
-.ne 5
-.PP
-\fB\\$1\fR
-.PP
-..
-.de Sp \" Vertical space (when we can't use .PP)
-.if t .sp .5v
-.if n .sp
-..
-.de Vb \" Begin verbatim text
-.ft CW
-.nf
-.ne \\$1
-..
-.de Ve \" End verbatim text
-.ft R
-.fi
-..
-.\" Set up some character translations and predefined strings.  \*(-- will
-.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
-.\" double quote, and \*(R" will give a right double quote.  | will give a
-.\" real vertical bar.  \*(C+ will give a nicer C++.  Capital omega is used to
-.\" do unbreakable dashes and therefore won't be available.  \*(C` and \*(C'
-.\" expand to `' in nroff, nothing in troff, for use with C<>.
-.tr \(*W-|\(bv\*(Tr
-.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
-.ie n \{\
-.    ds -- \(*W-
-.    ds PI pi
-.    if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
-.    if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\"  diablo 12 pitch
-.    ds L" ""
-.    ds R" ""
-.    ds C` ""
-.    ds C' ""
-'br\}
-.el\{\
-.    ds -- \|\(em\|
-.    ds PI \(*p
-.    ds L" ``
-.    ds R" ''
-'br\}
-.\"
-.\" If the F register is turned on, we'll generate index entries on stderr for
-.\" titles (.TH), headers (.SH), subsections (.Sh), items (.Ip), and index
-.\" entries marked with X<> in POD.  Of course, you'll have to process the
-.\" output yourself in some meaningful fashion.
-.if \nF \{\
-.    de IX
-.    tm Index:\\$1\t\\n%\t"\\$2"
-..
-.    nr % 0
-.    rr F
-.\}
-.\"
-.\" For nroff, turn off justification.  Always turn off hyphenation; it makes
-.\" way too many mistakes in technical documents.
-.hy 0
-.if n .na
-.\"
-.\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
-.\" Fear.  Run.  Save yourself.  No user-serviceable parts.
-.    \" fudge factors for nroff and troff
-.if n \{\
-.    ds #H 0
-.    ds #V .8m
-.    ds #F .3m
-.    ds #[ \f1
-.    ds #] \fP
-.\}
-.if t \{\
-.    ds #H ((1u-(\\\\n(.fu%2u))*.13m)
-.    ds #V .6m
-.    ds #F 0
-.    ds #[ \&
-.    ds #] \&
-.\}
-.    \" simple accents for nroff and troff
-.if n \{\
-.    ds ' \&
-.    ds ` \&
-.    ds ^ \&
-.    ds , \&
-.    ds ~ ~
-.    ds /
-.\}
-.if t \{\
-.    ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
-.    ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
-.    ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
-.    ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
-.    ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
-.    ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
-.\}
-.    \" troff and (daisy-wheel) nroff accents
-.ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
-.ds 8 \h'\*(#H'\(*b\h'-\*(#H'
-.ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
-.ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
-.ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
-.ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
-.ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
-.ds ae a\h'-(\w'a'u*4/10)'e
-.ds Ae A\h'-(\w'A'u*4/10)'E
-.    \" corrections for vroff
-.if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
-.if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
-.    \" for low resolution devices (crt and lpr)
-.if \n(.H>23 .if \n(.V>19 \
-\{\
-.    ds : e
-.    ds 8 ss
-.    ds o a
-.    ds d- d\h'-1'\(ga
-.    ds D- D\h'-1'\(hy
-.    ds th \o'bp'
-.    ds Th \o'LP'
-.    ds ae ae
-.    ds Ae AE
-.\}
-.rm #[ #] #H #V #F C

=== modified file 'doc/manpage/mount.ecryptfs_private.1'
--- doc/manpage/mount.ecryptfs_private.1	2009-02-23 21:31:11 +0000
+++ doc/manpage/mount.ecryptfs_private.1	2010-02-17 20:48:18 +0000
@@ -8,7 +8,7 @@
 \fBNOTE:\fP This program will \fBnot\fP dynamically load the relevant keys.  For this reason, it is recommended that users use \fBecryptfs-mount-private\fP(1) instead!
 
 .SH DESCRIPTION
-\fBmount.ecryptfs_private\fP is a mount helper utility for non-root users to cryptographically mount a private directory, ~/Private.
+\fBmount.ecryptfs_private\fP is a mount helper utility for non-root users, who are members of \fBecryptfs\fP group, to cryptographically mount a private directory, ~/Private.
 
 If, and only if:
   - the private mount passphrase is in their kernel keyring, and

=== added file 'doc/manpage/umount.ecryptfs.8'
--- doc/manpage/umount.ecryptfs.8	1970-01-01 00:00:00 +0000
+++ doc/manpage/umount.ecryptfs.8	2010-02-17 20:48:19 +0000
@@ -0,0 +1,23 @@
+.TH umount.ecryptfs 8 2009-08-17 ecryptfs-utils "eCryptfs"
+.SH NAME
+umount.ecryptfs \- eCryptfs umount helper.
+
+.SH SYNOPSIS
+\fBumount\fP [\fIecryptfs\ mount\ point\fP]
+
+.SH DESCRIPTION
+\fBumount.ecryptfs\fP is an eCryptfs umount helper, that will also unlink keys from the keyring.
+
+.SH "SEE ALSO"
+.PD 0
+.TP
+\fBmount.ecryptfs\fP(8), \fBmount\fP(8)
+
+.TP
+\fIhttp://launchpad.net/ecryptfs/\fP
+.PD
+
+.SH AUTHOR
+This manpage was written by Dustin Kirkland <[e-mail]> for Ubuntu systems (but may be used by others).  Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation.
+
+On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.

=== modified file 'doc/manpage/umount.ecryptfs_private.1'
--- doc/manpage/umount.ecryptfs_private.1	2009-02-23 21:31:11 +0000
+++ doc/manpage/umount.ecryptfs_private.1	2010-02-17 20:48:19 +0000
@@ -14,7 +14,7 @@
 Force the unmount, ignoring the value of the mount counter in \fI/tmp/ecryptfs-USERNAME-Private\fP
 
 .SH DESCRIPTION
-\fBumount.ecryptfs_private\fP is a mount helper utility for non-root users to unmount a cryptographically mounted private directory, ~/Private.
+\fBumount.ecryptfs_private\fP is a mount helper utility for non-root users, who ares members of \fBecryptfs\fP group, to unmount a cryptographically mounted private directory, ~/Private.
 
 If, and only if:
   - the private mount passphrase is in their kernel keyring, and

=== modified file 'doc/sourceforge_webpage/README'
--- doc/sourceforge_webpage/README	2009-02-03 08:50:36 +0000
+++ doc/sourceforge_webpage/README	2010-02-17 20:48:19 +0000
@@ -38,11 +38,6 @@
     1.0 or higher)
    - Finding its way into some distro's
    - Obtainable from <http://people.redhat.com/~dhowells/keyutils> 
-  - libgcrypt
-    - Part of most distro's; install the development package
-    - If you need to build from source, you probably will want these:
-     - <ftp://ftp.gnupg.org/gcrypt/libgpg-error>
-     - <ftp://ftp.gnupg.org/gcrypt/libgcrypt>
 
 
 KERNEL BUILD OPTIONS

=== added directory 'lintian'
=== added file 'lintian/ecryptfs-utils'
--- lintian/ecryptfs-utils	1970-01-01 00:00:00 +0000
+++ lintian/ecryptfs-utils	2010-02-17 20:48:19 +0000
@@ -0,0 +1,12 @@
+# This setuid is required for encrypted-home and encrypted-private;
+# Other distros or sysadmins could perhaps make it 4750, and create
+# an ecryptfs group, adding permitted users to this group (though
+# we're not doing this in Ubuntu).
+ecryptfs-utils: setuid-binary sbin/mount.ecryptfs_private 4755 root/root
+
+# The *.desktop files should be executable
+ecryptfs-utils: executable-not-elf-or-script
+
+# We're not creating these files, but rather moving them, and the utilities
+# that use them provide the necessary owernship checks.
+ecryptfs-utils: possibly-insecure-handling-of-tmp-files-in-maintainer-script

=== modified file 'scripts/build-ubuntu.sh'
--- scripts/build-ubuntu.sh	2009-03-24 20:39:50 +0000
+++ scripts/build-ubuntu.sh	2010-02-17 20:48:19 +0000
@@ -7,5 +7,5 @@
 cd ubuntu
 tar zxvf *.orig.tar.gz
 cd ecryptfs-utils*/
-cp -a ../../ecryptfs/debian .
+cp -a ../../upstream/debian .
 debuild -uc -us

=== modified file 'scripts/release.sh'
--- scripts/release.sh	2009-04-22 00:17:57 +0000
+++ scripts/release.sh	2010-02-17 20:48:19 +0000
@@ -8,7 +8,7 @@
 	exit 1
 }
 
-head -n1 debian/changelog | grep "unreleased" || error "This version must be 'unreleased'"
+head -n1 debian/changelog | grep -i "unreleased" || error "This version must be 'unreleased'"
 
 
 rm -f ./ecryptfs-utils*.tar.*
@@ -36,5 +36,9 @@
 echo "TO MAKE THE RELEASE OFFICIAL, UPLOAD:"
 echo -n "  "
 ls ../ecryptfs-utils*.orig.tar.gz
-echo "---->  https://launchpad.net/ecryptfs/trunk"
+echo "---->  https://launchpad.net/ecryptfs/trunk/+addrelease"
+echo
+echo " dch --release released"
+echo " debcommit --release"
+echo " bzr push lp:ecryptfs"
 echo

=== modified file 'src/desktop/Makefile.am'
--- src/desktop/Makefile.am	2009-04-07 22:33:58 +0000
+++ src/desktop/Makefile.am	2010-02-17 20:48:19 +0000
@@ -1,3 +1,4 @@
 MAINTAINERCLEANFILES = $(srcdir)/Makefile.in
 
-dist_dataroot_DATA = ecryptfs-mount-private.desktop ecryptfs-setup-private.desktop ecryptfs-record-passphrase
+eudatarootdir = $(datarootdir)/ecryptfs-utils
+dist_eudataroot_SCRIPTS = ecryptfs-mount-private.desktop ecryptfs-setup-private.desktop ecryptfs-record-passphrase

=== modified file 'src/desktop/ecryptfs-mount-private.desktop' (properties changed: -x to +x)
=== modified file 'src/desktop/ecryptfs-record-passphrase' (properties changed: -x to +x)
--- src/desktop/ecryptfs-record-passphrase	2009-04-07 22:33:58 +0000
+++ src/desktop/ecryptfs-record-passphrase	2010-02-17 20:48:19 +0000
@@ -6,13 +6,16 @@
 Terminal: True
 Command: "sh -c 'ecryptfs-unwrap-passphrase $HOME/.ecryptfs/wrapped-passphrase 2>/dev/null && echo [Enter] && head -n1 && touch $HOME/.ecryptfs/.wrapped-passphrase.recorded '"
 Description: To encrypt your home directory or "Private" folder, a strong
- passphrase has been autogenerated. Usually your directory is unlocked
+ passphrase has been automatically generated. Usually your directory is unlocked
  with your user password, but if you ever need to manually recover this
  directory, you will need this passphrase. Please print or write it down and
  store it in a safe location.
  .
- You can run the "ecryptfs-unwrap-passphrase" command now to do this. Enter
- your user password at the "Passphrase" prompt.
+ If you click "Run this action now", enter your login password at the "Passphrase"
+ prompt and you can display your randomly generated passphrase.
+ .
+ Otherwise, you will need to run "ecryptfs-unwrap-passphrase" from the command
+ line to retrive and record your generated passphrase.
 Description-de: Um Ihr Heimat- oder "Private"-Verzeichnis zu verschlüsseln,
  wurde automatisch ein starkes Passwort geniert. Normalerweise wird Ihr
  Verzeichnis mit Ihrem Benutzerpasswort freigegeben, aber wenn Sie jemals

=== modified file 'src/desktop/ecryptfs-setup-private.desktop' (properties changed: -x to +x)
=== modified file 'src/include/ecryptfs.h'
--- src/include/ecryptfs.h	2009-02-06 13:20:40 +0000
+++ src/include/ecryptfs.h	2010-02-17 20:48:19 +0000
@@ -512,6 +512,7 @@
 					    uint32_t version);
 int get_string(char *val, int len, int echo);
 int get_string_stdin(char **val, char *prompt, int echo);
+int stack_pop(struct val_node **head);
 int stack_pop_val(struct val_node **head, void **val);
 int ecryptfs_mount(char *source, char *target, unsigned long flags, char *opts);
 int ecryptfs_get_current_kernel_ciphers(
@@ -581,6 +582,7 @@
 int ecryptfs_insert_wrapped_passphrase_into_keyring(
 	char *auth_tok_sig, char *filename, char *wrapping_passphrase,
 	char *salt);
+char *ecryptfs_get_wrapped_passphrase_filename();
 struct ecryptfs_key_mod_ops *passphrase_get_key_mod_ops(void);
 int ecryptfs_validate_keyring(void);
 #define ECRYPTFS_SHM_KEY 0x3c81b7f5
@@ -630,5 +632,8 @@
 char *ecryptfs_get_passphrase(char *prompt);
 int ecryptfs_run_daemon(struct ecryptfs_messaging_ctx *mctx);
 
+#define ECRYPTFS_PRIVATE_DIR "Private"
+char *ecryptfs_fetch_private_mnt(char *pw_dir);
+int ecryptfs_private_is_mounted(char *dev, char *mnt, char *sig, int mounting);
 
 #endif

=== modified file 'src/key_mod/ecryptfs_key_mod_gpg.c'
--- src/key_mod/ecryptfs_key_mod_gpg.c	2009-04-22 09:05:00 +0000
+++ src/key_mod/ecryptfs_key_mod_gpg.c	2010-02-17 20:48:19 +0000
@@ -18,6 +18,7 @@
  * 02111-1307, USA.
  */
 
+#include "config.h"
 #include <fcntl.h>
 #include <pwd.h>
 #include <stdio.h>
@@ -29,7 +30,6 @@
 #include <gpgme.h>
 #include <sys/types.h>
 #include <sys/stat.h>
-#include "config.h"
 #include "../include/ecryptfs.h"
 #include "../include/decision_graph.h"
 
@@ -131,7 +131,7 @@
 
 int ecryptfs_gpg_encrypt(char *to, int size, char *from, unsigned char *blob)
 {
-	int rc;
+	int rc = 0;
 
 /*	gpg_op_encrypt(...); */
 out:
@@ -251,7 +251,7 @@
 			 struct val_node **head, void **foo)
 {
 	struct key_mod_gpg *key_mod_gpg = (struct key_mod_gpg *)(*foo);
-	int i;
+	int i = 0;
 	gpgme_error_t err;
 	int rc = 0;
 	gpgme_key_t key;
@@ -283,10 +283,7 @@
 
 static int generate_name_val_list(struct ecryptfs_name_val_pair *head)
 {
-	struct stat buf;
-	int i = 0;
 	uid_t id = getuid();
-	struct passwd *pw = getpwuid(id);
 	int rc = 0;
 
 	head->next = NULL;
@@ -304,6 +301,7 @@
 		destroy_key_mod_gpg(key_mod_gpg);
 		free(key_mod_gpg);
 	}
+	return 0;
 }
 
 
@@ -312,7 +310,6 @@
 {
 	struct key_mod_gpg *key_mod_gpg;
 	gpgme_error_t err;
-	gpgme_keylist_result_t keylist_res;
 	int rc = 0;
 
 	(*foo) = NULL;
@@ -329,7 +326,7 @@
 	if ((err = gpgme_op_keylist_start(key_mod_gpg->ctx, "", 0))) {
 		printf("Error attempting to start keylist\n");
 		rc = -EINVAL;
-		gpgme_release(ctx);
+		gpgme_release(key_mod_gpg->ctx);
 		free(key_mod_gpg);
 		goto out;
 	}

=== modified file 'src/key_mod/ecryptfs_key_mod_openssl.c'
--- src/key_mod/ecryptfs_key_mod_openssl.c	2009-04-22 09:05:00 +0000
+++ src/key_mod/ecryptfs_key_mod_openssl.c	2010-02-17 20:48:19 +0000
@@ -550,6 +550,30 @@
 	return rc;
 }
 
+static int limit_key_size(struct val_node **params, 
+			  struct ecryptfs_subgraph_ctx *subgraph_ctx)
+{
+	char *buf;
+	int rc;
+	RSA *rsa = NULL;
+
+	if ((rc=ecryptfs_openssl_read_key(&rsa, 
+				(unsigned char *)subgraph_ctx->key_mod->blob)))
+		return rc;
+	/* 41 is for padding and 3 are for additional data send from 
+	 * kernel (1 for cipher type and 2 for checksum */
+	if ((rc = asprintf(&buf, "max_key_bytes=%d", 
+			   RSA_size(rsa)-41-3)) == -1) {
+		rc = -ENOMEM;
+		goto out;
+	}
+
+	rc = stack_push(params, buf);
+out:	
+	RSA_free(rsa);
+	return rc;
+}
+
 /**
  *
  * 
@@ -575,6 +599,7 @@
 		syslog(LOG_ERR, "Error processing OpenSSL key; rc = [%d]", rc);
 		goto out;
 	}
+	limit_key_size(mnt_params, subgraph_ctx);
 	ecryptfs_openssl_destroy_subgraph_ctx(subgraph_ctx);
 	free(subgraph_ctx);
 	(*foo) = NULL;
@@ -629,7 +654,7 @@
 		walker = walker->next;
 	}
 	if (!walker) {
-		syslog(LOG_ERR, "%s: No passwd option found in file\n",
+		syslog(LOG_ERR, "%s: No openssl_passwd option found in file\n",
 		       __FUNCTION__);
 		rc = MOUNT_ERROR;
 		goto out;
@@ -639,6 +664,7 @@
 		syslog(LOG_ERR, "Error processing OpenSSL key; rc = [%d]", rc);
 		goto out;
 	}
+	limit_key_size(mnt_params, subgraph_ctx);
 	ecryptfs_openssl_destroy_subgraph_ctx(subgraph_ctx);
 	free(subgraph_ctx);
 	(*foo) = NULL;
@@ -727,7 +753,7 @@
 	 .display_opts = NULL,
 	 .default_val = NULL,
 	 .suggested_val = NULL,
-	 .flags = ECRYPTFS_PARAM_FLAG_MASK_OUTPUT,
+	 .flags = ECRYPTFS_PARAM_FLAG_MASK_OUTPUT | VERIFY_VALUE,
 	 .num_transitions = 1,
 	 .tl = {{.val = NULL,
 		 .pretty_val = NULL,

=== modified file 'src/key_mod/ecryptfs_key_mod_pkcs11_helper.c'
--- src/key_mod/ecryptfs_key_mod_pkcs11_helper.c	2009-04-22 09:05:00 +0000
+++ src/key_mod/ecryptfs_key_mod_pkcs11_helper.c	2010-02-17 20:48:19 +0000
@@ -20,6 +20,7 @@
  * 02111-1307, USA.
  */
 
+#include "config.h"
 #include <fcntl.h>
 #include <pwd.h>
 #include <stdio.h>
@@ -28,11 +29,12 @@
 #include <errno.h>
 #include <stdlib.h>
 #include <unistd.h>
+#include <openssl/err.h>
+#include <openssl/pem.h>
 #include <openssl/x509.h>
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <pkcs11-helper-1.0/pkcs11h-certificate.h>
-#include "config.h"
 #include "../include/ecryptfs.h"
 #include "../include/decision_graph.h"
 
@@ -590,7 +592,6 @@
 		char dn[1024] = {0};
 		char serial[1024] = {0};
 		char *ser = NULL;
-		char *ssh_key = NULL;
 		size_t ser_len = 0;
 		int n;
 
@@ -1536,7 +1537,6 @@
 	struct ecryptfs_ctx *ctx = &_ctx;
 	struct ecryptfs_name_val_pair nvp_head;
 	struct val_node *dummy_mnt_params;
-	uid_t id;
 	struct passwd *pw;
 	char *rcfile_fullpath = NULL;
 	int fd;
@@ -1647,6 +1647,7 @@
 	if (pkcs11h_key_param_nodes[PKCS11H_KEY_TOK_ID].suggested_val)
 		free(pkcs11h_key_param_nodes[PKCS11H_KEY_TOK_ID].suggested_val);
 	pkcs11h_terminate ();
+	return 0;
 }
 
 static struct ecryptfs_key_mod_ops ecryptfs_pkcs11h_ops = {

=== modified file 'src/key_mod/ecryptfs_key_mod_tspi.c'
--- src/key_mod/ecryptfs_key_mod_tspi.c	2009-02-09 15:33:25 +0000
+++ src/key_mod/ecryptfs_key_mod_tspi.c	2010-02-17 20:48:19 +0000
@@ -317,6 +317,7 @@
 	struct tspi_data tspi_data;
 	struct ecryptfs_tspi_connect_ticket *ticket;
 	int rc = 0;
+	BYTE wellknown[] = TSS_WELL_KNOWN_SECRET;
 
 	pthread_mutex_lock(&encrypt_lock);
 	(*to_size) = 0;
@@ -345,8 +346,9 @@
 		rc = -EIO;
 		goto out;
 	}
-	if ((result = Tspi_Policy_SetSecret(h_srk_policy, TSS_SECRET_MODE_PLAIN,
-					    0, NULL))
+	if ((result = Tspi_Policy_SetSecret(h_srk_policy,
+					    TSS_SECRET_MODE_SHA1,
+					    sizeof(wellknown), wellknown))
 	    != TSS_SUCCESS) {
 		syslog(LOG_ERR, "Tspi_Policy_SetSecret failed: [%s]\n",
 		       Trspi_Error_String(result));
@@ -415,6 +417,7 @@
 	struct ecryptfs_tspi_connect_ticket *ticket;
 	TSS_RESULT result;
 	int rc = 0;
+	BYTE wellknown[] = TSS_WELL_KNOWN_SECRET;
 
 	pthread_mutex_lock(&decrypt_lock);
 	ecryptfs_tspi_deserialize(&tspi_data, blob);
@@ -442,7 +445,8 @@
 		goto out;
 	}
 	if ((result = Tspi_Policy_SetSecret(h_srk_policy,
-					    TSS_SECRET_MODE_PLAIN, 0, NULL))
+					    TSS_SECRET_MODE_SHA1,
+					    sizeof(wellknown), wellknown))
 	    != TSS_SUCCESS) {
 		syslog(LOG_ERR, "Tspi_Policy_SetSecret failed: [%s]\n",
 		       Trspi_Error_String(result));

=== modified file 'src/libecryptfs-swig/libecryptfs.i'
--- src/libecryptfs-swig/libecryptfs.i	2009-02-03 08:50:36 +0000
+++ src/libecryptfs-swig/libecryptfs.i	2010-02-17 20:48:19 +0000
@@ -9,7 +9,7 @@
 #include "../include/ecryptfs.h"
 
 %typemap(out) binary_data {
-    $result = PyString_FromStringAndSize($1.data,$1.size);
+    $result = PyString_FromStringAndSize((char *)($1.data),$1.size);
 }
 
 extern binary_data ecryptfs_passphrase_blob(char *salt, char *passphrase);

=== modified file 'src/libecryptfs-swig/libecryptfs.py'
--- src/libecryptfs-swig/libecryptfs.py	2009-02-03 08:50:36 +0000
+++ src/libecryptfs-swig/libecryptfs.py	2010-02-17 20:48:19 +0000
@@ -1,5 +1,5 @@
 # This file was automatically generated by SWIG (http://www.swig.org).
-# Version 1.3.31
+# Version 1.3.36
 #
 # Don't modify this file, modify the SWIG interface instead.
 # This file is compatible with both classic and new-style classes.

=== modified file 'src/libecryptfs-swig/libecryptfs_wrap.c'
--- src/libecryptfs-swig/libecryptfs_wrap.c	2009-02-03 08:50:36 +0000
+++ src/libecryptfs-swig/libecryptfs_wrap.c	2010-02-17 20:48:19 +0000
@@ -1,6 +1,6 @@
 /* ----------------------------------------------------------------------------
  * This file was automatically generated by SWIG (http://www.swig.org).
- * Version 1.3.31
+ * Version 1.3.36
  * 
  * This file is not intended to be easily readable and contains a number of 
  * coding conventions designed to improve portability and efficiency. Do not make
@@ -17,14 +17,14 @@
 
 /* template workaround for compilers that cannot correctly implement the C++ standard */
 #ifndef SWIGTEMPLATEDISAMBIGUATOR
-# if defined(__SUNPRO_CC)
-#   if (__SUNPRO_CC <= 0x560)
-#     define SWIGTEMPLATEDISAMBIGUATOR template
-#   else
-#     define SWIGTEMPLATEDISAMBIGUATOR 
-#   endif
+# if defined(__SUNPRO_CC) && (__SUNPRO_CC <= 0x560)
+#  define SWIGTEMPLATEDISAMBIGUATOR template
+# elif defined(__HP_aCC)
+/* Needed even with `aCC -AA' when `aCC -V' reports HP ANSI C++ B3910B A.03.55 */
+/* If we find a maximum version that requires this, the test would be __HP_aCC <= 35500 for A.03.55 */
+#  define SWIGTEMPLATEDISAMBIGUATOR template
 # else
-#   define SWIGTEMPLATEDISAMBIGUATOR 
+#  define SWIGTEMPLATEDISAMBIGUATOR
 # endif
 #endif
 
@@ -52,6 +52,12 @@
 # endif
 #endif
 
+#ifndef SWIG_MSC_UNSUPPRESS_4505
+# if defined(_MSC_VER)
+#   pragma warning(disable : 4505) /* unreferenced local function has been removed */
+# endif 
+#endif
+
 #ifndef SWIGUNUSEDPARM
 # ifdef __cplusplus
 #   define SWIGUNUSEDPARM(p)
@@ -107,6 +113,12 @@
 # define _CRT_SECURE_NO_DEPRECATE
 #endif
 
+/* Deal with Microsoft's attempt at deprecating methods in the standard C++ library */
+#if !defined(SWIG_NO_SCL_SECURE_NO_DEPRECATE) && defined(_MSC_VER) && !defined(_SCL_SECURE_NO_DEPRECATE)
+# define _SCL_SECURE_NO_DEPRECATE
+#endif
+
+
 
 /* Python.h has to appear first */
 #include <Python.h>
@@ -120,7 +132,7 @@
 
 /* This should only be incremented when either the layout of swig_type_info changes,
    or for whatever reason, the runtime changes incompatibly */
-#define SWIG_RUNTIME_VERSION "3"
+#define SWIG_RUNTIME_VERSION "4"
 
 /* define SWIG_TYPE_TABLE_NAME as "SWIG_TYPE_TABLE" */
 #ifdef SWIG_TYPE_TABLE
@@ -155,6 +167,7 @@
 
 /* Flags for pointer conversions */
 #define SWIG_POINTER_DISOWN        0x1
+#define SWIG_CAST_NEW_MEMORY       0x2
 
 /* Flags for new pointer objects */
 #define SWIG_POINTER_OWN           0x1
@@ -295,10 +308,10 @@
 extern "C" {
 #endif
 
-typedef void *(*swig_converter_func)(void *);
+typedef void *(*swig_converter_func)(void *, int *);
 typedef struct swig_type_info *(*swig_dycast_func)(void **);
 
-/* Structure to store inforomation on one type */
+/* Structure to store information on one type */
 typedef struct swig_type_info {
   const char             *name;			/* mangled name of this type */
   const char             *str;			/* human readable name of this type */
@@ -343,7 +356,7 @@
     while ((*f2 == ' ') && (f2 != l2)) ++f2;
     if (*f1 != *f2) return (*f1 > *f2) ? 1 : -1;
   }
-  return (l1 - f1) - (l2 - f2);
+  return (int)((l1 - f1) - (l2 - f2));
 }
 
 /*
@@ -425,8 +438,8 @@
   Cast a pointer up an inheritance hierarchy
 */
 SWIGRUNTIMEINLINE void *
-SWIG_TypeCast(swig_cast_info *ty, void *ptr) {
-  return ((!ty) || (!ty->converter)) ? ptr : (*ty->converter)(ptr);
+SWIG_TypeCast(swig_cast_info *ty, void *ptr, int *newmemory) {
+  return ((!ty) || (!ty->converter)) ? ptr : (*ty->converter)(ptr, newmemory);
 }
 
 /* 
@@ -850,7 +863,7 @@
     Py_DECREF(old_str);
     Py_DECREF(value);
   } else {
-    PyErr_Format(PyExc_RuntimeError, mesg);
+    PyErr_SetString(PyExc_RuntimeError, mesg);
   }
 }
 
@@ -1090,14 +1103,14 @@
 /* Unpack the argument tuple */
 
 SWIGINTERN int
-SWIG_Python_UnpackTuple(PyObject *args, const char *name, int min, int max, PyObject **objs)
+SWIG_Python_UnpackTuple(PyObject *args, const char *name, Py_ssize_t min, Py_ssize_t max, PyObject **objs)
 {
   if (!args) {
     if (!min && !max) {
       return 1;
     } else {
       PyErr_Format(PyExc_TypeError, "%s expected %s%d arguments, got none", 
-		   name, (min == max ? "" : "at least "), min);
+		   name, (min == max ? "" : "at least "), (int)min);
       return 0;
     }
   }  
@@ -1105,14 +1118,14 @@
     PyErr_SetString(PyExc_SystemError, "UnpackTuple() argument list is not a tuple");
     return 0;
   } else {
-    register int l = PyTuple_GET_SIZE(args);
+    register Py_ssize_t l = PyTuple_GET_SIZE(args);
     if (l < min) {
       PyErr_Format(PyExc_TypeError, "%s expected %s%d arguments, got %d", 
-		   name, (min == max ? "" : "at least "), min, l);
+		   name, (min == max ? "" : "at least "), (int)min, (int)l);
       return 0;
     } else if (l > max) {
       PyErr_Format(PyExc_TypeError, "%s expected %s%d arguments, got %d", 
-		   name, (min == max ? "" : "at most "), max, l);
+		   name, (min == max ? "" : "at most "), (int)max, (int)l);
       return 0;
     } else {
       register int i;
@@ -1410,7 +1423,7 @@
 {
   PySwigObject *sobj = (PySwigObject *) v;
   PyObject *next = sobj->next;
-  if (sobj->own) {
+  if (sobj->own == SWIG_POINTER_OWN) {
     swig_type_info *ty = sobj->ty;
     PySwigClientData *data = ty ? (PySwigClientData *) ty->clientdata : 0;
     PyObject *destroy = data ? data->destroy : 0;
@@ -1428,12 +1441,13 @@
 	res = ((*meth)(mself, v));
       }
       Py_XDECREF(res);
-    } else {
+    } 
+#if !defined(SWIG_PYTHON_SILENT_MEMLEAK)
+    else {
       const char *name = SWIG_TypePrettyName(ty);
-#if !defined(SWIG_PYTHON_SILENT_MEMLEAK)
-      printf("swig/python detected a memory leak of type '%s', no destructor found.\n", name);
+      printf("swig/python detected a memory leak of type '%s', no destructor found.\n", (name ? name : "unknown"));
+    }
 #endif
-    }
   } 
   Py_XDECREF(next);
   PyObject_DEL(v);
@@ -1591,9 +1605,11 @@
     (unaryfunc)0,                 /*nb_float*/
     (unaryfunc)PySwigObject_oct,  /*nb_oct*/
     (unaryfunc)PySwigObject_hex,  /*nb_hex*/
-#if PY_VERSION_HEX >= 0x02020000
-    0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 /* nb_inplace_add -> nb_inplace_true_divide */ 
-#elif PY_VERSION_HEX >= 0x02000000
+#if PY_VERSION_HEX >= 0x02050000 /* 2.5.0 */
+    0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 /* nb_inplace_add -> nb_index */
+#elif PY_VERSION_HEX >= 0x02020000 /* 2.2.0 */
+    0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 /* nb_inplace_add -> nb_inplace_true_divide */
+#elif PY_VERSION_HEX >= 0x02000000 /* 2.0.0 */
     0,0,0,0,0,0,0,0,0,0,0 /* nb_inplace_add -> nb_inplace_or */
 #endif
   };
@@ -1936,7 +1952,7 @@
 
 SWIGRUNTIME int
 SWIG_Python_AcquirePtr(PyObject *obj, int own) {
-  if (own) {
+  if (own == SWIG_POINTER_OWN) {
     PySwigObject *sobj = SWIG_Python_GetSwigThis(obj);
     if (sobj) {
       int oldown = sobj->own;
@@ -1957,6 +1973,8 @@
     return SWIG_OK;
   } else {
     PySwigObject *sobj = SWIG_Python_GetSwigThis(obj);
+    if (own)
+      *own = 0;
     while (sobj) {
       void *vptr = sobj->ptr;
       if (ty) {
@@ -1970,7 +1988,15 @@
 	  if (!tc) {
 	    sobj = (PySwigObject *)sobj->next;
 	  } else {
-	    if (ptr) *ptr = SWIG_TypeCast(tc,vptr);
+	    if (ptr) {
+              int newmemory = 0;
+              *ptr = SWIG_TypeCast(tc,vptr,&newmemory);
+              if (newmemory == SWIG_CAST_NEW_MEMORY) {
+                assert(own);
+                if (own)
+                  *own = *own | SWIG_CAST_NEW_MEMORY;
+              }
+            }
 	    break;
 	  }
 	}
@@ -1980,7 +2006,8 @@
       }
     }
     if (sobj) {
-      if (own) *own = sobj->own;
+      if (own)
+        *own = *own | sobj->own;
       if (flags & SWIG_POINTER_DISOWN) {
 	sobj->own = 0;
       }
@@ -2045,8 +2072,13 @@
     }
     if (ty) {
       swig_cast_info *tc = SWIG_TypeCheck(desc,ty);
-      if (!tc) return SWIG_ERROR;
-      *ptr = SWIG_TypeCast(tc,vptr);
+      if (tc) {
+        int newmemory = 0;
+        *ptr = SWIG_TypeCast(tc,vptr,&newmemory);
+        assert(!newmemory); /* newmemory handling not yet implemented */
+      } else {
+        return SWIG_ERROR;
+      }
     } else {
       *ptr = vptr;
     }
@@ -2469,7 +2501,7 @@
 
 #define SWIG_name    "_libecryptfs"
 
-#define SWIGVERSION 0x010331 
+#define SWIGVERSION 0x010336 
 #define SWIG_VERSION SWIGVERSION
 
 
@@ -2567,7 +2599,6 @@
   PyObject *resultobj = 0;
   char *arg1 = (char *) 0 ;
   char *arg2 = (char *) 0 ;
-  binary_data result;
   int res1 ;
   char *buf1 = 0 ;
   int alloc1 = 0 ;
@@ -2576,6 +2607,7 @@
   int alloc2 = 0 ;
   PyObject * obj0 = 0 ;
   PyObject * obj1 = 0 ;
+  binary_data result;
   
   if (!PyArg_ParseTuple(args,(char *)"OO:ecryptfs_passphrase_blob",&obj0,&obj1)) SWIG_fail;
   res1 = SWIG_AsCharPtrAndSize(obj0, &buf1, NULL, &alloc1);
@@ -2590,7 +2622,7 @@
   arg2 = (char *)(buf2);
   result = ecryptfs_passphrase_blob(arg1,arg2);
   {
-    resultobj = PyString_FromStringAndSize((char *)(&result)->data,(&result)->size);
+    resultobj = PyString_FromStringAndSize((char *)((&result)->data),(&result)->size);
   }
   if (alloc1 == SWIG_NEWOBJ) free((char*)buf1);
   if (alloc2 == SWIG_NEWOBJ) free((char*)buf2);
@@ -2605,11 +2637,11 @@
 SWIGINTERN PyObject *_wrap_ecryptfs_passphrase_sig_from_blob(PyObject *SWIGUNUSEDPARM(self), PyObject *args) {
   PyObject *resultobj = 0;
   char *arg1 = (char *) 0 ;
-  binary_data result;
   int res1 ;
   char *buf1 = 0 ;
   int alloc1 = 0 ;
   PyObject * obj0 = 0 ;
+  binary_data result;
   
   if (!PyArg_ParseTuple(args,(char *)"O:ecryptfs_passphrase_sig_from_blob",&obj0)) SWIG_fail;
   res1 = SWIG_AsCharPtrAndSize(obj0, &buf1, NULL, &alloc1);
@@ -2619,7 +2651,7 @@
   arg1 = (char *)(buf1);
   result = ecryptfs_passphrase_sig_from_blob(arg1);
   {
-    resultobj = PyString_FromStringAndSize((char *)(&result)->data,(&result)->size);
+    resultobj = PyString_FromStringAndSize((char *)((&result)->data),(&result)->size);
   }
   if (alloc1 == SWIG_NEWOBJ) free((char*)buf1);
   return resultobj;
@@ -2633,15 +2665,15 @@
   PyObject *resultobj = 0;
   char *arg1 = (char *) 0 ;
   char *arg2 = (char *) 0 ;
+  int res1 ;
+  char *buf1 = 0 ;
+  int alloc1 = 0 ;
+  int res2 ;
+  char *buf2 = 0 ;
+  int alloc2 = 0 ;
+  PyObject * obj0 = 0 ;
+  PyObject * obj1 = 0 ;
   int result;
-  int res1 ;
-  char *buf1 = 0 ;
-  int alloc1 = 0 ;
-  int res2 ;
-  char *buf2 = 0 ;
-  int alloc2 = 0 ;
-  PyObject * obj0 = 0 ;
-  PyObject * obj1 = 0 ;
   
   if (!PyArg_ParseTuple(args,(char *)"OO:ecryptfs_add_blob_to_keyring",&obj0,&obj1)) SWIG_fail;
   res1 = SWIG_AsCharPtrAndSize(obj0, &buf1, NULL, &alloc1);
@@ -2754,7 +2786,7 @@
 SWIG_InitializeModule(void *clientdata) {
   size_t i;
   swig_module_info *module_head, *iter;
-  int found;
+  int found, init;
   
   clientdata = clientdata;
   
@@ -2764,6 +2796,9 @@
     swig_module.type_initial = swig_type_initial;
     swig_module.cast_initial = swig_cast_initial;
     swig_module.next = &swig_module;
+    init = 1;
+  } else {
+    init = 0;
   }
   
   /* Try and load any already created modules */
@@ -2792,6 +2827,12 @@
     module_head->next = &swig_module;
   }
   
+  /* When multiple interpeters are used, a module could have already been initialized in
+       a different interpreter, but not yet have a pointer in this interpreter.
+       In this case, we do not want to continue adding types... everything should be
+       set up already */
+  if (init == 0) return;
+  
   /* Now work on filling in swig_module.types */
 #ifdef SWIGRUNTIME_DEBUG
   printf("SWIG_InitializeModule: size %d\n", swig_module.size);

=== modified file 'src/libecryptfs/cipher_list.c'
--- src/libecryptfs/cipher_list.c	2009-04-22 09:05:00 +0000
+++ src/libecryptfs/cipher_list.c	2010-02-17 20:48:19 +0000
@@ -338,7 +338,7 @@
 	{"tea", "tea.ko", 8, 16, 16, 7, 0},
 	{"xeta", "tea.ko", 8, 16, 16, 9, 0},
 	{"xtea", "tea.ko", 8, 16, 16, 8, 0},
-	{"blowfish", "blowfish.ko", 16, 16, 32, 2, 1},
+	{"blowfish", "blowfish.ko", 16, 16, 56, 2, 1},
 	{"twofish", "twofish.ko", 16, 16, 32, 4, 1},
 	{"khazad", "khazad.ko", 8, 16, 16, 11, 0},
 	{"cast5", "cast5.ko", 8, 5, 16, 14, 1},

=== modified file 'src/libecryptfs/cmd_ln_parser.c'
--- src/libecryptfs/cmd_ln_parser.c	2009-04-22 09:05:00 +0000
+++ src/libecryptfs/cmd_ln_parser.c	2010-02-17 20:48:19 +0000
@@ -200,7 +200,7 @@
 
 	fd = open(fullpath, O_RDONLY);
 	if (fd == -1) {
-		rc = -EIO;
+		rc = -errno;
 		goto out;
 	}
 	rc = parse_options_file(fd, nvp_list_head);

=== modified file 'src/libecryptfs/decision_graph.c'
--- src/libecryptfs/decision_graph.c	2009-04-23 16:31:05 +0000
+++ src/libecryptfs/decision_graph.c	2010-02-17 20:48:19 +0000
@@ -209,8 +209,15 @@
 		  struct ecryptfs_name_val_pair *nvp_head,
 		  struct val_node **mnt_params, void **foo)
 {
+	static int repeated = 0;
+	static struct param_node *lastnode = NULL;
 	int i, rc;
 
+	if (current != lastnode)
+		repeated = 0;
+
+	lastnode = current;
+
 	for (i = 0; i < current->num_transitions; i++) {
 		struct transition_node *tn = &current->tl[i];
 		struct ecryptfs_name_val_pair *nvp = nvp_head->next;
@@ -275,11 +282,17 @@
 				trans_func_tok_id =
 					tn->trans_func(ctx, current,
 						       mnt_params, foo);
-			if (trans_func_tok_id == WRONG_VALUE && 
-			    (ctx->verbosity || 
-			     (current->flags & STDIN_REQUIRED))) {
-			    *next = current;
-			    return 0;
+			if (trans_func_tok_id == WRONG_VALUE) { 
+				if (ctx->verbosity || 
+				    (current->flags & STDIN_REQUIRED)) {
+						if (++repeated >= 5)
+							return -EINVAL;
+						else {
+							*next = current;
+							return 0;
+						}
+				} else 
+					return -EINVAL;
 			}
 			if (trans_func_tok_id == MOUNT_ERROR || 
 			    trans_func_tok_id < 0)
@@ -289,6 +302,8 @@
 			else return -EINVAL;
 		}
 	}
+	if (current->num_transitions)
+		return MOUNT_ERROR;
 	return NULL_TOK;
 }
 
@@ -560,10 +575,13 @@
 			}
 			prompt[i] = '\0';
 get_value:
-			rc = (ctx->get_string)
-				(&(node->val), prompt,
-				 (node->flags
-				  & ECRYPTFS_PARAM_FLAG_ECHO_INPUT));
+			if ((rc = (ctx->get_string)
+				      (&(node->val), prompt,
+					(node->flags
+					  & ECRYPTFS_PARAM_FLAG_ECHO_INPUT)))) {
+				free(prompt);
+				return rc;
+			}
 			val = atoi(node->val);
 			if (val > 0 && val <= node->num_transitions) {
 				free(node->val);
@@ -627,26 +645,34 @@
 				(&(node->val), prompt,
 				 (node->flags
 				  & ECRYPTFS_PARAM_FLAG_ECHO_INPUT));
+			free(prompt);
+			if (rc)
+				goto out;
 			if (node->val[0] == '\0' && 
 			    (node->flags & ECRYPTFS_NONEMPTY_VALUE_REQUIRED)) {
 				fprintf(stderr,"Wrong input, non-empty value "
 					"required!\n");
 				goto obtain_value;
 			}
-			free(prompt);
 			if (node->flags & VERIFY_VALUE) {
 				rc = asprintf(&verify_prompt, "Verify %s",
 					      node->prompt);
 				if (rc == -1)
-					return MOUNT_ERROR;
+					return -ENOMEM;
 				rc = (ctx->get_string)
 					(&verify, verify_prompt,
 					 (node->flags
 					  & ECRYPTFS_PARAM_FLAG_ECHO_INPUT));
+				free(verify_prompt);
 				if (rc)
-					return MOUNT_ERROR;
-				if (strcmp(verify, node->val))
+					return -EIO;
+				rc = strcmp(verify, node->val); 
+				free(verify);
+				if (rc) {
+					free(node->val);
+					node->val = NULL;
 					goto obtain_value;
+				}
 			}
 			if (node->val[0] == '\0') {
 				free(node->val);

=== modified file 'src/libecryptfs/key_management.c'
--- src/libecryptfs/key_management.c	2009-04-22 09:36:25 +0000
+++ src/libecryptfs/key_management.c	2010-02-17 20:48:19 +0000
@@ -18,13 +18,10 @@
  * 02111-1307, USA.
  */
 
+#include "config.h"
 #include <errno.h>
-#ifdef ENABLE_NSS
 #include <nss.h>
 #include <pk11func.h>
-#else
-#include <gcrypt.h>
-#endif /* #ifdef ENABLE_NSS */
 #include <keyutils.h>
 #ifndef S_SPLINT_S
 #include <stdio.h>
@@ -38,7 +35,7 @@
 #include <sys/mman.h>
 #include <sys/types.h>
 #include <sys/stat.h>
-#include "config.h"
+#include <pwd.h>
 #include "../include/ecryptfs.h"
 
 #ifndef ENOKEY
@@ -166,8 +163,6 @@
 	rc = (int)keyctl_search(KEY_SPEC_USER_KEYRING, "user", auth_tok_sig, 0);
 	if (rc != -1) { /* we already have this key in keyring; we're done */
 		rc = 1;
-		syslog(LOG_WARNING, "Passphrase key already in keyring;"
-		       " rc = [%d]\n", rc);
 		goto out;
 	} else if ((rc == -1) && (errno != ENOKEY)) {
 		int errnum = errno;
@@ -180,11 +175,11 @@
 	rc = add_key("user", auth_tok_sig, (void *)auth_tok,
 		     sizeof(struct ecryptfs_auth_tok), KEY_SPEC_USER_KEYRING);
 	if (rc == -1) {
-		int errnum = errno;
-
+		rc = -errno;
 		syslog(LOG_ERR, "Error adding key with sig [%s]; rc = [%d] "
 		       "\"%m\"\n", auth_tok_sig, rc);
-		rc = (errnum < 0) ? errnum : errnum * -1;
+		if (rc == -EDQUOT)
+			syslog(LOG_WARNING, "Error adding key to keyring - keyring is full\n");
 		goto out;
 	}
 	rc = 0;
@@ -300,7 +295,6 @@
 		ECRYPTFS_AES_BLOCK_SIZE + 1];
 	int encrypted_passphrase_pos = 0;
 	int decrypted_passphrase_pos = 0;
-#ifdef ENABLE_NSS
 	int tmp1_outlen = 0;
 	int tmp2_outlen = 0;
 	SECStatus err;
@@ -309,11 +303,6 @@
 	PK11SlotInfo *slot = NULL;
 	PK11Context *enc_ctx = NULL;
 	SECItem *sec_param = NULL;
-#else
-#warning Building against gcrypt instead of nss
-	gcry_cipher_hd_t gcry_handle;
-	gcry_error_t gcry_err;
-#endif /* #ifdef ENABLE_NSS */
 	int encrypted_passphrase_bytes;
 	int decrypted_passphrase_bytes;
 	int fd;
@@ -345,7 +334,6 @@
 					       - (decrypted_passphrase_bytes
 						  % ECRYPTFS_AES_BLOCK_SIZE));
 	encrypted_passphrase_bytes = decrypted_passphrase_bytes;
-#ifdef ENABLE_NSS
 	NSS_NoDB_Init(NULL);
 	slot = PK11_GetBestSlot(CKM_AES_ECB, NULL);
 	key_item.data = (unsigned char *)wrapping_key;
@@ -406,41 +394,6 @@
 		rc = - EIO;
 		goto out;
 	}
-#else
-	if ((gcry_err = gcry_cipher_open(&gcry_handle, GCRY_CIPHER_AES,
-					 GCRY_CIPHER_MODE_ECB, 0))) {
-		syslog(LOG_ERR, "Error attempting to initialize AES cipher; "
-		       "gcry_error_t = [%d]\n", gcry_err);
-		rc = -EIO;
-		goto out;
-	}
-	if ((gcry_err = gcry_cipher_setkey(gcry_handle, wrapping_key,
-					   ECRYPTFS_AES_KEY_BYTES))) {
-		syslog(LOG_ERR, "Error attempting to set AES key; "
-		       "gcry_error_t = [%d]\n", gcry_err);
-		rc = -EIO;
-		gcry_cipher_close(gcry_handle);
-		goto out;
-	}
-	while (decrypted_passphrase_bytes > 0) {
-		if ((gcry_err = gcry_cipher_encrypt(
-			     gcry_handle,
-			     &encrypted_passphrase[encrypted_passphrase_pos],
-			     ECRYPTFS_AES_BLOCK_SIZE,
-			     &decrypted_passphrase[decrypted_passphrase_pos],
-			     ECRYPTFS_AES_BLOCK_SIZE))) {
-			syslog(LOG_ERR, "Error attempting to encrypt block; "
-			       "gcry_error = [%d]\n", gcry_err);
-			rc = -EIO;
-			gcry_cipher_close(gcry_handle);
-			goto out;
-		}
-		encrypted_passphrase_pos += ECRYPTFS_AES_BLOCK_SIZE;
-		decrypted_passphrase_pos += ECRYPTFS_AES_BLOCK_SIZE;
-		decrypted_passphrase_bytes -= ECRYPTFS_AES_BLOCK_SIZE;
-	}
-	gcry_cipher_close(gcry_handle);
-#endif /* #ifdef ENABLE_NSS */
 	unlink(filename);
 	if ((fd = open(filename, (O_WRONLY | O_CREAT | O_EXCL),
 		       (S_IRUSR | S_IWUSR))) == -1) {
@@ -486,7 +439,6 @@
 	char encrypted_passphrase[ECRYPTFS_MAX_PASSPHRASE_BYTES + 1];
 	int encrypted_passphrase_pos = 0;
 	int decrypted_passphrase_pos = 0;
-#ifdef ENABLE_NSS
 	int tmp1_outlen = 0;
 	int tmp2_outlen = 0;
 	SECStatus err;
@@ -495,10 +447,6 @@
 	PK11SlotInfo *slot = NULL;
 	PK11Context *enc_ctx = NULL;
 	SECItem *sec_param = NULL;
-#else
-	gcry_cipher_hd_t gcry_handle;
-	gcry_error_t gcry_err;
-#endif /* #ifdef ENABLE_NSS */
 	int encrypted_passphrase_bytes;
 	int fd;
 	ssize_t size;
@@ -545,7 +493,6 @@
 		goto out;
 	}
 	encrypted_passphrase_bytes = size;
-#ifdef ENABLE_NSS
 	NSS_NoDB_Init(NULL);
 	slot = PK11_GetBestSlot(CKM_AES_ECB, NULL);
 	key_item.data = (unsigned char *)wrapping_key;
@@ -605,41 +552,6 @@
 		rc = - EIO;
 		goto out;
 	}
-#else
-	if ((gcry_err = gcry_cipher_open(&gcry_handle, GCRY_CIPHER_AES,
-					 GCRY_CIPHER_MODE_ECB, 0))) {
-		syslog(LOG_ERR, "Error attempting to initialize AES cipher; "
-		       "gcry_error_t = [%d]\n", gcry_err);
-		rc = -EIO;
-		goto out;
-	}
-	if ((gcry_err = gcry_cipher_setkey(gcry_handle, wrapping_key,
-					   ECRYPTFS_AES_KEY_BYTES))) {
-		syslog(LOG_ERR, "Error attempting to set AES key; "
-		       "gcry_error_t = [%d]\n", gcry_err);
-		rc = -EIO;
-		gcry_cipher_close(gcry_handle);
-		goto out;
-	}
-	memset(decrypted_passphrase, 0, ECRYPTFS_MAX_PASSPHRASE_BYTES + 1);
-	while (encrypted_passphrase_bytes > 0) {
-		if ((gcry_err = gcry_cipher_decrypt(
-			     gcry_handle,
-			     &decrypted_passphrase[encrypted_passphrase_pos],
-			     ECRYPTFS_AES_BLOCK_SIZE,
-			     &encrypted_passphrase[decrypted_passphrase_pos],
-			     ECRYPTFS_AES_BLOCK_SIZE))) {
-			syslog(LOG_ERR, "Error attempting to decrypt block; "
-			       "gcry_error = [%d]\n", gcry_err);
-			rc = -EIO;
-			gcry_cipher_close(gcry_handle);
-			goto out;
-		}
-		encrypted_passphrase_pos += ECRYPTFS_AES_BLOCK_SIZE;
-		decrypted_passphrase_pos += ECRYPTFS_AES_BLOCK_SIZE;
-		encrypted_passphrase_bytes -= ECRYPTFS_AES_BLOCK_SIZE;
-	}
-#endif /* #ifdef ENABLE_NSS */
 out:
 	return rc;
 }
@@ -676,18 +588,20 @@
 		if ((rc = ecryptfs_add_passphrase_key_to_keyring(
 					auth_tok_sig,
 					decrypted_passphrase,
-					ECRYPTFS_DEFAULT_SALT_FNEK_HEX))) {
+					ECRYPTFS_DEFAULT_SALT_FNEK_HEX)) != 0) {
 			syslog(LOG_ERR,
 			   "Error attempting to add filename encryption key to "
 			   "user session keyring; rc = [%d]\n", rc);
+			goto out;
 		}
 	}
 	if ((rc = ecryptfs_add_passphrase_key_to_keyring(auth_tok_sig,
 							 decrypted_passphrase,
-							 salt))) {
+							 salt)) != 0) {
 		syslog(LOG_ERR, "Error attempting to add passphrase key to "
 		       "user session keyring; rc = [%d]\n", rc);
-	}
+	} else
+		rc = 0;
 out:
 	return rc;
 }
@@ -744,10 +658,13 @@
 	rc = add_key("user", auth_tok_sig, (void *)auth_tok,
 		     (sizeof(struct ecryptfs_auth_tok) + blob_size),
 		     KEY_SPEC_USER_KEYRING);
-	if (rc < 0)
+	if (rc < 0) {
+		rc = -errno;
 		syslog(LOG_ERR, "Error adding key with sig [%s]; rc ="
 		       " [%d]\n", auth_tok_sig, rc);
-	else rc = 0;
+		if (rc == -EDQUOT)
+			syslog(LOG_WARNING, "Error adding key to keyring - keyring is full\n");
+	} else rc = 0;
 out:
 	if (auth_tok != NULL) {
 		memset(auth_tok, 0, (sizeof(struct ecryptfs_auth_tok) + blob_size));
@@ -765,14 +682,14 @@
 	memset(&nvp_list_head, 0, sizeof(struct ecryptfs_name_val_pair));
 	rc = ecryptfs_parse_rc_file(&nvp_list_head);
 	if (rc) {
-		if (rc != -EIO) {
+		if (rc != -ENOENT) {
 			syslog(LOG_WARNING,
 				"Error attempting to parse .ecryptfsrc file; "
 				"rc = [%d]", rc);
 		}
 		goto out;
 	}
-	nvp = &nvp_list_head;
+	nvp = nvp_list_head.next;
 	while (nvp) {
 		if (strcmp(nvp->name, "salt") == 0) {
 			int valsize;
@@ -780,7 +697,7 @@
 			if (!nvp->value)
 				goto next_iteration;
 			valsize = strlen(nvp->value);
-			if (valsize != ECRYPTFS_SALT_SIZE_HEX);
+			if (valsize != ECRYPTFS_SALT_SIZE_HEX)
 				goto next_iteration;
 			memcpy(salt_hex, nvp->value, ECRYPTFS_SALT_SIZE_HEX);
 			goto out_free;
@@ -917,7 +834,8 @@
 	ecryptfs_enable_echo(&current_settings);
 	p = strrchr(passphrase, '\n');
 	if (p) *p = '\0';
-	printf("\n");
+	if (prompt != NULL)
+		printf("\n");
 	if (strlen(passphrase) > ECRYPTFS_MAX_PASSWORD_LENGTH) {
 		fprintf(stderr,"Passphrase is too long. Use at most %u "
 			       "characters long passphrase.\n",
@@ -927,3 +845,23 @@
 	}
 	return passphrase;
 }
+
+char *ecryptfs_get_wrapped_passphrase_filename() {
+	struct passwd *pwd = NULL;
+	struct stat s;
+	char *filename = NULL;
+	if ((pwd = getpwuid(getuid())) == NULL) {
+		perror("getpwuid");
+		return NULL;
+	}
+	if ((asprintf(&filename,
+	    "%s/.ecryptfs/wrapped-passphrase", pwd->pw_dir) < 0)) {
+		perror("asprintf");
+		return NULL;
+	}
+	if (stat(filename, &s) != 0) {
+		perror("stat");
+		return NULL;
+	}
+	return filename;
+}

=== modified file 'src/libecryptfs/libecryptfs.pc.in'
--- src/libecryptfs/libecryptfs.pc.in	2009-02-03 08:50:36 +0000
+++ src/libecryptfs/libecryptfs.pc.in	2010-02-17 20:48:19 +0000
@@ -6,5 +6,5 @@
 Name: libecryptfs
 Description: eCryptfs library
 Version: @PACKAGE_VERSION@
-Cflags: -I${includedir} @LIBGCRYPT_CFLAGS@ @KEYUTILS_CFLAGS@
-Libs: @LIBGCRYPT_LIBS@ @KEYUTILS_LIBS@ -L${libdir} -lecryptfs
+Cflags: -I${includedir} @KEYUTILS_CFLAGS@
+Libs: @KEYUTILS_LIBS@ -L${libdir} -lecryptfs

=== modified file 'src/libecryptfs/main.c'
--- src/libecryptfs/main.c	2009-02-09 15:33:25 +0000
+++ src/libecryptfs/main.c	2010-02-17 20:48:19 +0000
@@ -21,12 +21,8 @@
 
 #include "config.h"
 #include <errno.h>
-#ifdef ENABLE_NSS
 #include <nss.h>
 #include <pk11func.h>
-#else
-#include <gcrypt.h>
-#endif /* #ifdef ENABLE_NSS */
 #include <mntent.h>
 #ifndef S_SPLINT_S
 #include <stdio.h>
@@ -37,9 +33,10 @@
 #include <signal.h>
 #include <sys/mount.h>
 #include <getopt.h>
+#include <sys/types.h>
 #include <keyutils.h>
-#include <sys/types.h>
 #include <sys/ipc.h>
+#include <sys/param.h>
 #include <sys/shm.h>
 #include <sys/sem.h>
 #include "../include/ecryptfs.h"
@@ -77,16 +74,8 @@
 
 int do_hash(char *src, int src_size, char *dst, int algo)
 {
-#ifdef ENABLE_NSS
 	SECStatus err;
-#else
-	gcry_md_hd_t hd;
-	gcry_error_t err = 0;
-	unsigned char * hash;
-	unsigned int mdlen;
-#endif /* #ifdef ENABLE_NSS */
 
-#ifdef ENABLE_NSS
 	NSS_NoDB_Init(NULL);
 	err = PK11_HashBuf(algo, (unsigned char *)dst, (unsigned char *)src,
 			   src_size);
@@ -97,23 +86,115 @@
 		err = -EINVAL;
 		goto out;
 	}
-#else
-	err = gcry_md_open(&hd, algo, 0);
-	mdlen = gcry_md_get_algo_dlen(algo);
-	if (err) {
-		syslog(LOG_ERR, "Failed to open hash algo [%d]: "
-		       "[%d]\n", algo, err);
-		goto out;
-	}
-	gcry_md_write(hd, src, src_size);
-	hash = gcry_md_read(hd, algo);
-	memcpy(dst, hash, mdlen);
-	gcry_md_close(hd);
-#endif /* #ifdef ENABLE_NSS */
 out:
 	return (int)err;
 }
 
+/* Read ecryptfs private mount from file
+ * Allocate and return a string
+ */
+char *ecryptfs_fetch_private_mnt(char *pw_dir) {
+	char *mnt_file = NULL;
+	char *mnt_default = NULL;
+	char *mnt = NULL;
+	FILE *fh = NULL;
+	/* Construct mnt file name */
+	if (asprintf(&mnt_default, "%s/%s", pw_dir, ECRYPTFS_PRIVATE_DIR) < 0
+			|| mnt_default == NULL) {
+		perror("asprintf");
+		return NULL;
+	}
+	if (
+			asprintf(&mnt_file, "%s/.ecryptfs/%s.mnt", pw_dir, ECRYPTFS_PRIVATE_DIR) < 0
+			|| mnt_file == NULL) {
+		perror("asprintf");
+		return NULL;
+	}
+	fh = fopen(mnt_file, "r");
+	if (fh == NULL) {
+		mnt = mnt_default;
+	} else {
+		flockfile(fh);
+		if ((mnt = (char *)malloc(MAXPATHLEN+1)) == NULL) {
+			perror("malloc");
+			return NULL;
+		}
+		if (fgets(mnt, MAXPATHLEN, fh) == NULL) {
+			mnt = mnt_default;
+		} else {
+			/* Ensure that mnt doesn't contain newlines */
+			mnt = strtok(mnt, "\n");
+		}
+		fclose(fh);
+	}
+	if (mnt_file != NULL)
+		free(mnt_file);
+	if (mnt_default != NULL && mnt != mnt_default)
+		free(mnt_default);
+	return mnt;
+}
+
+
+/* Check if an ecryptfs private device or mount point is mounted.
+ * Return 1 if a filesystem in mtab matches dev && mnt && sig.
+ * Return 0 otherwise.
+ */
+int ecryptfs_private_is_mounted(char *dev, char *mnt, char *sig, int mounting) {
+	FILE *fh = NULL;
+	struct mntent *m = NULL;
+	char *opt = NULL;
+	int mounted;
+	if (asprintf(&opt, "ecryptfs_sig=%s", sig) < 0) {
+		perror("asprintf");
+		return 0;
+	}
+	fh = setmntent("/proc/mounts", "r");
+	if (fh == NULL) {
+		perror("setmntent");
+		return 0;
+	}
+	mounted = 0;
+	flockfile(fh);
+	while ((m = getmntent(fh)) != NULL) {
+		if (strcmp(m->mnt_type, "ecryptfs") != 0)
+			/* Skip if this entry is not an ecryptfs mount */
+			continue;
+		if (mounting == 1) {
+			/* If mounting, return "already mounted" if EITHER the
+ 			 * dev or the mnt dir shows up in mtab/mounts;
+ 			 * regardless of the signature of such mounts;
+ 			 */
+			if (dev != NULL && strcmp(m->mnt_fsname, dev) == 0) {
+				mounted = 1;
+				break;
+			}
+			if (mnt != NULL && strcmp(m->mnt_dir, mnt) == 0) {
+				mounted = 1;
+				break;
+			}
+		} else {
+			/* Otherwise, we're unmounting, and we need to be
+			 * very conservative in finding a perfect match
+			 * to unmount.  The device, mountpoint, and signature
+			 * must *all* match perfectly.
+			 */
+			if (
+			    strcmp(m->mnt_fsname, dev) == 0 &&
+			    strcmp(m->mnt_dir, mnt) == 0 &&
+			    hasmntopt(m, opt) != NULL
+			) {
+				mounted = 1;
+				break;
+			}
+		}
+	}
+	endmntent(fh);
+	if (opt != NULL)
+		free(opt);
+	return mounted;
+}
+
+
 /**
  * TODO: We need to support more hash algs
  * @fekek: ECRYPTFS_MAX_KEY_BYTES bytes of allocated memory
@@ -133,11 +214,7 @@
 	char salt_and_passphrase[ECRYPTFS_MAX_PASSPHRASE_BYTES
 				 + ECRYPTFS_SALT_SIZE];
 	int passphrase_size;
-#ifdef ENABLE_NSS
 	int alg = SEC_OID_SHA512;
-#else
-	int alg = GCRY_MD_SHA512;
-#endif /* #ifdef ENABLE_NSS */
 	int dig_len = SHA512_DIGEST_LENGTH;
 	char buf[SHA512_DIGEST_LENGTH];
 	int hash_iterations = ECRYPTFS_DEFAULT_NUM_HASH_ITERATIONS;
@@ -890,3 +967,4 @@
 {
 	return &ctx_ops;
 }
+

=== modified file 'src/libecryptfs/module_mgr.c'
--- src/libecryptfs/module_mgr.c	2009-04-21 17:59:16 +0000
+++ src/libecryptfs/module_mgr.c	2010-02-17 20:48:19 +0000
@@ -97,15 +97,20 @@
 		.trans_func = sig_param_node_callback}}
 };
 
-/* returns: 1 for str=="yes" or "y", 0 for "no" or "n", -1 elsewhere */
-static int is_yes(const char *str)
+/* returns: 
+ * 	on_null for str == NULL
+ *	1 for str=="yes" or "y"
+ *	0 for str=="no" or "n"
+ *	-1 elsewhere */
+static int is_yes(const char *str, int on_null)
 {
 	if (str) {
 		if (!strcmp(str,"y") || !strcmp(str,"yes"))
 			return 1;
 		if (!strcmp(str,"no") || !strcmp(str,"n"))
 			return 0;
-	}
+	} else
+		return on_null;
 
 	return -1;
 }
@@ -120,7 +125,7 @@
 {
 	int rc;
 
-	if (((rc=is_yes(node->val)) == 1) || (node->flags & PARAMETER_SET)) {
+	if (((rc=is_yes(node->val, 0)) == 1) || (node->flags & PARAMETER_SET)) {
 		rc = stack_push(head, opt_name);
 	} else if (rc == -1)
 		rc = WRONG_VALUE;
@@ -207,7 +212,7 @@
 static struct param_node filename_crypto_fnek_sig_param_node = {
 	.num_mnt_opt_names = 1,
 	.mnt_opt_names = {"ecryptfs_fnek_sig"},
-	.prompt = "Filname Encryption Key (FNEK) Signature",
+	.prompt = "Filename Encryption Key (FNEK) Signature",
 	.val_type = VAL_STR,
 	.val = NULL,
 	.display_opts = NULL,
@@ -227,7 +232,7 @@
 {
 	int yn, rc = 0;
 
-	if (((yn=is_yes(node->val)) > 0)
+	if (((yn=is_yes(node->val, 0)) > 0)
 	    || (node->flags & PARAMETER_SET)) {
 		int i;
 		struct val_node *val_node;
@@ -407,6 +412,7 @@
 	{"twofish", 32, 2},
 	{"blowfish", 16, 1},
 	{"blowfish", 32, 2},
+	{"blowfish", 56, 2},
 	{"khazad", 16, 1},
 	{"arc4", 16, 1},
 	{"arc4", 32, 2},
@@ -432,15 +438,18 @@
 	return rc;
 }
 
-static int init_ecryptfs_key_bytes_param_node(char *cipher_name)
+static int init_ecryptfs_key_bytes_param_node(char *cipher_name, 
+					      int min, int max)
 {
 	int i;
 	int rc = 0;
 
 	i = 0;
 	while (supported_key_bytes[i].cipher_name) {
-		if (strcmp(cipher_name, supported_key_bytes[i].cipher_name)
-		    == 0) {
+		if ((supported_key_bytes[i].key_bytes >= min) && 
+		    (supported_key_bytes[i].key_bytes <= max) &&
+		    (strcmp(cipher_name, supported_key_bytes[i].cipher_name)
+		      == 0)) {
 			struct transition_node *tn;
 			
 			tn = &ecryptfs_key_bytes_param_node.tl[
@@ -468,6 +477,11 @@
 		}
 		i++;
 	}
+	if (ecryptfs_key_bytes_param_node.num_transitions == 0) {
+		syslog(LOG_ERR, "Error initializing key_bytes selection: "
+		       "there is no posibility left for used params\n");
+		return -EINVAL;
+	}
 out:
 	return rc;
 }
@@ -477,8 +491,40 @@
 {
 	char *opt;
 	int rc;
-
-	rc = init_ecryptfs_key_bytes_param_node(node->val);
+	int min = 0, max = 999999;
+	struct val_node *tmp = *head, *tmpprev = NULL;
+
+	while (tmp) {
+		char *ptr;
+		int popval = 0;
+		if (tmp->val && (strstr(tmp->val,"max_key_bytes=") != NULL) && 
+		    ((ptr=strchr(tmp->val,'=')) != NULL)) {
+			char *eptr;
+			max = strtol(++ptr, &eptr, 10);
+			if (eptr == ptr)
+				return -EINVAL;
+			popval = 1;
+		}
+		if (tmp->val && (strstr(tmp->val,"min_key_bytes=") != NULL) && 
+		    ((ptr=strchr(tmp->val,'=')) != NULL)) {
+			char *eptr;
+			min = strtol(++ptr, &eptr, 10);
+			if (eptr == ptr)
+				return -EINVAL;
+			popval = 1;
+		}
+		if (popval) {
+			if (tmp == *head)
+				*head = (*head)->next;
+			stack_pop(&tmp);
+			if (tmpprev != NULL)
+				tmpprev->next = tmp;
+		}
+		tmpprev = tmp;
+		tmp = tmp->next;
+	}
+
+	rc = init_ecryptfs_key_bytes_param_node(node->val, min, max);
 	if (rc) {
 		syslog(LOG_ERR, "%s: Error initializing key_bytes param node; "
 		       "rc = [%d]\n", __FUNCTION__, rc);

=== modified file 'src/pam_ecryptfs/Makefile.am'
--- src/pam_ecryptfs/Makefile.am	2009-02-03 08:50:36 +0000
+++ src/pam_ecryptfs/Makefile.am	2010-02-17 20:48:19 +0000
@@ -12,6 +12,6 @@
 endif
 
 pam_ecryptfs_la_SOURCES = pam_ecryptfs.c
-pam_ecryptfs_la_CFLAGS = $(AM_CFLAGS) $(LIBGCRYPT_CFLAGS)
-pam_ecryptfs_la_LIBADD = $(top_builddir)/src/libecryptfs/libecryptfs.la $(PAM_LIBS) $(LIBGCRYPT_LIBS)
+pam_ecryptfs_la_CFLAGS = $(AM_CFLAGS)
+pam_ecryptfs_la_LIBADD = $(top_builddir)/src/libecryptfs/libecryptfs.la $(PAM_LIBS)
 pam_ecryptfs_la_LDFLAGS = $(AM_LDFLAGS) -module -avoid-version -shared

=== modified file 'src/pam_ecryptfs/pam_ecryptfs.c'
--- src/pam_ecryptfs/pam_ecryptfs.c	2009-04-21 23:20:27 +0000
+++ src/pam_ecryptfs/pam_ecryptfs.c	2010-02-17 20:48:23 +0000
@@ -1,4 +1,5 @@
-/**
+/* -*- Mode: C; tab-width: 4; indent-tabs-mode: t; c-basic-offset: 4 -*-
+ *
  * pam_ecryptfs.c: PAM module that sends the user's authentication
  * tokens into the kernel keyring.
  *
@@ -73,30 +74,48 @@
 	char *file_path;
 	int rc = 0;
 	struct stat s;
-	if (asprintf(
-		&file_path, "%s/.ecryptfs/%s",
-		homedir,
-		ECRYPTFS_DEFAULT_WRAPPED_PASSPHRASE_FILENAME) == -1)
-		return -ENOMEM;
-	if (stat(file_path, &s) != 0) {
-		if (errno != ENOENT)
-			rc = -errno;
-		goto out;
-	} 
-	free(file_path);
 	if (asprintf(&file_path, "%s/.ecryptfs/auto-mount", homedir) == -1)
 		return -ENOMEM;
 	if (stat(file_path, &s) != 0) {
 		if (errno != ENOENT)
 			rc = -errno;
 		goto out;
-	} 
+	}
 	rc = 1;
 out:
 	free(file_path);
 	return rc;
 }
 
+static int wrap_passphrase_if_necessary(char *username, uid_t uid, char *wrapped_pw_filename, char *passphrase, char *salt)
+{
+	char *unwrapped_pw_filename = NULL;
+	struct stat s;
+	int rc = 0;
+
+	rc = asprintf(&unwrapped_pw_filename, "/dev/shm/.ecryptfs-%s", username);
+	if (rc == -1) {
+		syslog(LOG_ERR, "Unable to allocate memory\n");
+		return -ENOMEM;
+	}
+	/* If /dev/shm/.ecryptfs-$USER exists and owned by the user
+	   and ~/.ecryptfs/wrapped-passphrase does not exist
+	   and a passphrase is set:
+	   wrap the unwrapped passphrase file */
+	if (stat(unwrapped_pw_filename, &s) == 0 && (s.st_uid == uid) &&
+	    stat(wrapped_pw_filename, &s) != 0  &&
+	    passphrase != NULL && *passphrase != '\0' &&
+	    username != NULL && *username != '\0') {
+		setuid(uid);
+		rc = ecryptfs_wrap_passphrase_file(wrapped_pw_filename, passphrase, salt, unwrapped_pw_filename);
+		if (rc != 0) {
+			syslog(LOG_ERR, "Error wrapping cleartext password; " "rc = [%d]\n", rc);
+		}
+		return rc;
+	}
+	return 0;
+}
+
 PAM_EXTERN int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc,
 				   const char **argv)
 {
@@ -108,8 +127,10 @@
 	char salt[ECRYPTFS_SALT_SIZE];
 	char salt_hex[ECRYPTFS_SALT_SIZE_HEX];
 	char *auth_tok_sig;
+	char *private_mnt = NULL;
 	pid_t child_pid, tmp_pid;
 	long rc;
+	uint32_t version;
 
 	syslog(LOG_INFO, "%s: Called\n", __FUNCTION__);
 	rc = pam_get_user(pamh, &username, NULL);
@@ -130,6 +151,18 @@
 	}
 	if (!ecryptfs_pam_automount_set(homedir))
 		goto out;
+	private_mnt = ecryptfs_fetch_private_mnt(homedir);
+	if (ecryptfs_private_is_mounted(NULL, private_mnt, NULL, 1)) {
+		syslog(LOG_INFO, "%s: %s is already mounted\n", __FUNCTION__,
+			homedir);
+		/* If private/home is already mounted, then we can skip
+		   costly loading of keys */
+		goto out;
+	}
+	/* we need side effect of this check:
+	   load ecryptfs module if not loaded already */
+	if (ecryptfs_get_version(&version) != 0)
+		syslog(LOG_WARNING, "Can't check if kernel supports ecryptfs\n");
 	saved_uid = geteuid();
 	seteuid(uid);
 	rc = pam_get_item(pamh, PAM_AUTHTOK, (const void **)&passphrase);
@@ -147,7 +180,6 @@
 	}
 	rc = ecryptfs_read_salt_hex_from_rc(salt_hex);
 	if (rc) {
-		syslog(LOG_WARNING, "%s\n", ECRYPTFS_WARN_DEFAULT_SALT);
 		from_hex(salt, ECRYPTFS_DEFAULT_SALT_HEX, ECRYPTFS_SALT_SIZE);
 	} else
 		from_hex(salt, salt_hex, ECRYPTFS_SALT_SIZE);
@@ -166,7 +198,9 @@
 		if ((argc == 1)
 		    && (memcmp(argv[0], "unwrap\0", 7) == 0)) {
 			char *wrapped_pw_filename;
-			
+			char *unwrapped_pw_filename;
+			struct stat s;
+
 			rc = asprintf(
 				&wrapped_pw_filename, "%s/.ecryptfs/%s",
 				homedir,
@@ -176,6 +210,11 @@
 				rc = -ENOMEM;
 				goto out_child;
 			}
+			if (wrap_passphrase_if_necessary(username, uid, wrapped_pw_filename, passphrase, salt) == 0) {
+				syslog(LOG_INFO, "Passphrase file wrapped");
+			} else {
+				goto out_child;
+			}
 			rc = ecryptfs_insert_wrapped_passphrase_into_keyring(
 				auth_tok_sig, wrapped_pw_filename, passphrase,
 				salt);
@@ -185,9 +224,6 @@
 				auth_tok_sig, passphrase, salt);
 		}
 		if (rc == 1) {
-			syslog(LOG_WARNING, "There is already a key in the "
-			       "user session keyring for the given "
-			       "passphrase.\n");
 			goto out_child;
 		}
 		if (rc) {
@@ -198,8 +234,8 @@
 		if (fork() == 0) {
 			if ((rc = ecryptfs_set_zombie_session_placeholder())) {
 				syslog(LOG_ERR, "Error attempting to create "
-				       "and register zombie process; "
-				       "rc = [%ld]\n", rc);
+						"and register zombie process; "
+						"rc = [%ld]\n", rc);
 			}
 		}
 out_child:
@@ -211,6 +247,8 @@
 		syslog(LOG_WARNING,
 		       "waitpid() returned with error condition\n");
 out:
+	if (private_mnt != NULL)
+		free(private_mnt);
 	return PAM_SUCCESS;
 }
 
@@ -272,7 +310,7 @@
 		return 1;
         }
         if (
-	    (asprintf(&sigfile, "%s/.ecryptfs/%s.sig", pwd->pw_dir, 
+	    (asprintf(&sigfile, "%s/.ecryptfs/%s.sig", pwd->pw_dir,
 	     PRIVATE_DIR) < 0) || sigfile == NULL) {
 		syslog(LOG_ERR, "Error allocating memory for sigfile name");
 		return 1;
@@ -288,7 +326,7 @@
 	if ((pid = fork()) < 0) {
 		syslog(LOG_ERR, "Error setting up private mount");
 		return 1;
-	} 
+	}
 	if (pid == 0) {
 		if (mount == 1) {
 		        if ((asprintf(&recorded,
@@ -313,7 +351,7 @@
 			}
 			/* run mount.ecryptfs_private as the user */
 			setresuid(pwd->pw_uid, pwd->pw_uid, pwd->pw_uid);
-			execl("/sbin/mount.ecryptfs_private", 
+			execl("/sbin/mount.ecryptfs_private",
 			      "mount.ecryptfs_private", NULL);
 		} else {
 			if (stat(autofile, &s) != 0) {
@@ -324,14 +362,12 @@
 			}
 			/* run umount.ecryptfs_private as the user */
 			setresuid(pwd->pw_uid, pwd->pw_uid, pwd->pw_uid);
-			execl("/sbin/umount.ecryptfs_private", 
+			execl("/sbin/umount.ecryptfs_private",
  			      "umount.ecryptfs_private", NULL);
 		}
 		return 1;
 	} else {
 		waitpid(pid, &rc, 0);
-		syslog(LOG_INFO, 
-		       "Mount of private directory return code [%d]", rc);
 		goto out;
 	}
 out:
@@ -374,12 +410,10 @@
 	char *old_passphrase = NULL;
 	char *new_passphrase = NULL;
 	char *wrapped_pw_filename;
-	char *unwrapped_pw_filename;
 	char *name = NULL;
 	char salt[ECRYPTFS_SALT_SIZE];
 	char salt_hex[ECRYPTFS_SALT_SIZE_HEX];
 	pid_t child_pid, tmp_pid;
-	struct stat s;
 	int rc = PAM_SUCCESS;
 
 	rc = pam_get_user(pamh, &username, NULL);
@@ -434,36 +468,17 @@
 		rc = -ENOMEM;
 		goto out;
 	}
-	rc = asprintf(&unwrapped_pw_filename, "/dev/shm/.ecryptfs-%s", name);
-	if (rc == -1) {
-		syslog(LOG_ERR, "Unable to allocate memory\n");
-		rc = -ENOMEM;
-		goto out;
-	}
 	if ((rc = ecryptfs_read_salt_hex_from_rc(salt_hex))) {
-		syslog(LOG_WARNING, "%s\n", ECRYPTFS_WARN_DEFAULT_SALT);
 		from_hex(salt, ECRYPTFS_DEFAULT_SALT_HEX, ECRYPTFS_SALT_SIZE);
 	} else {
 		from_hex(salt, salt_hex, ECRYPTFS_SALT_SIZE);
 	}
-	/* If /dev/shm/.ecryptfs-$USER exists and owned by the user
-	   and ~/.ecryptfs/wrapped-passphrase does not exist
-	   and a new_passphrase is set:
-	   wrap the unwrapped passphrase file */
-	if (stat(unwrapped_pw_filename, &s) == 0 && (s.st_uid == uid) &&
-	    stat(wrapped_pw_filename, &s) != 0  &&
-	    new_passphrase != NULL && *new_passphrase != '\0' &&
-	    name != NULL && *name != '\0') {
-		setuid(uid);
-		rc = ecryptfs_wrap_passphrase_file(wrapped_pw_filename,
-			new_passphrase, salt, unwrapped_pw_filename);
-		if (rc != 0) {
-			syslog(LOG_ERR,
-			  "Error wrapping cleartext password; "
-	       		  "rc = [%d]\n", rc);
-		}
+	if (wrap_passphrase_if_necessary(username, uid, wrapped_pw_filename, new_passphrase, salt) == 0) {
+		syslog(LOG_INFO, "Passphrase file wrapped");
+	} else {
 		goto out;
 	}
+
 	seteuid(saved_uid);
 	if (!old_passphrase || !new_passphrase || *new_passphrase == '\0') {
 		syslog(LOG_WARNING, "eCryptfs PAM passphrase change module "

=== added directory 'src/python'
=== added file 'src/python/__init__.py'
=== added file 'src/python/ecryptfsapi.py'
--- src/python/ecryptfsapi.py	1970-01-01 00:00:00 +0000
+++ src/python/ecryptfsapi.py	2010-02-17 20:48:23 +0000
@@ -0,0 +1,82 @@
+#!/usr/bin/env python
+#
+#    ecryptfsapi.py, Copyright 2008, 2009 Michael Rooney <[e-mail]>
+#    Date: 2009-05-28
+#    Version: 0.4
+#
+#    This is a python API for interacting with ecryptfs-utils and its
+#    encrypted directories.
+#
+#    This program is free software: you can redistribute it and/or modify
+#    it under the terms of the GNU General Public License as published by
+#    the Free Software Foundation, either version 3 of the License, or
+#    (at your option) any later version.
+#
+#    This program is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU General Public License for more details.
+#
+#    You should have received a copy of the GNU General Public License
+#    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import commands, os
+
+AUTOMOUNT_FILE = os.path.expanduser("~/.ecryptfs/auto-mount")
+AUTOUMOUNT_FILE = os.path.expanduser("~/.ecryptfs/auto-umount")
+PRIVATE_LOCATION_FILE = os.path.expanduser("~/.ecryptfs/Private.mnt")
+PRIVATE_LOCATION = os.path.exists(PRIVATE_LOCATION_FILE) and open(PRIVATE_LOCATION_FILE).read().strip()
+
+def set_automount(doAuto):
+    """Enable or disable automounting for this user."""
+    if doAuto:
+        command = "touch %s" % AUTOMOUNT_FILE
+        #open(AUTOMOUNT_FILE, "w")
+    else:
+        command = "rm %s" % AUTOMOUNT_FILE
+        #os.remove(AUTOMOUNT_FILE)
+
+    return commands.getstatusoutput(command)
+
+def get_automount():
+    """Return whether or not automounting is enabled for this user."""
+    return os.path.exists(AUTOMOUNT_FILE)
+
+def set_autounmount(doAuto):
+    """Enable or disable automounting for this user."""
+    if doAuto:
+        command = "touch %s" % AUTOUMOUNT_FILE
+    else:
+        command = "rm %s" % AUTOUMOUNT_FILE
+
+    return commands.getstatusoutput(command)
+
+def get_autounmount():
+    """Return whether or not autounmounting is enabled for this user."""
+    return os.path.exists(AUTOUMOUNT_FILE)
+
+def set_mounted(doMount):
+    """Set the mounted (unencrypted) state of ~/Private."""
+    if doMount:
+        command = "/sbin/mount.ecryptfs_private"
+    else:
+        command = "/sbin/umount.ecryptfs_private"
+
+    return commands.getstatusoutput(command)
+
+def get_mounted():
+    """Return whether or not ~/Private is mounted (unencrypted)."""
+    if PRIVATE_LOCATION:
+        mounts = open("/proc/mounts").read()
+        return PRIVATE_LOCATION in mounts
+    else:
+        return False
+
+def needs_setup():
+    """
+    Return whether or not an encrypted directory has been set up by ecryptfs
+    for this user, either Home or Private.
+    """
+    encryptedHome = False #TODO: implement
+    encryptedPrivate = PRIVATE_LOCATION
+    return not (encryptedHome or encryptedPrivate)

=== modified file 'src/utils/Makefile.am'
--- src/utils/Makefile.am	2009-04-21 23:36:43 +0000
+++ src/utils/Makefile.am	2010-02-17 20:48:23 +0000
@@ -1,6 +1,6 @@
 MAINTAINERCLEANFILES = $(srcdir)/Makefile.in
 
-EXTRA_DIST=ecryptfsrc ecryptfs-rewrite-file ecryptfs-setup-private ecryptfs-setup-swap ecryptfs-mount-private ecryptfs-umount-private ecryptfs-dot-private
+EXTRA_DIST=ecryptfsrc ecryptfs-rewrite-file ecryptfs-setup-private ecryptfs-setup-swap ecryptfs-mount-private ecryptfs-umount-private ecryptfs-migrate-home
 
 rootsbin_PROGRAMS=mount.ecryptfs \
 		  umount.ecryptfs \
@@ -16,7 +16,8 @@
 	      ecryptfs-mount-private \
 	      ecryptfs-umount-private \
 	      ecryptfs-rewrite-file \
-	      ecryptfs-dot-private
+	      ecryptfs-migrate-home
+bin2dir = $(bindir)
 
 noinst_PROGRAMS=test
 
@@ -55,7 +56,7 @@
 ecryptfs_generate_tpm_key_LDADD = $(TSPI_LIBS)
 
 mount_ecryptfs_private_SOURCES = mount.ecryptfs_private.c
-mount_ecryptfs_private_LDADD = $(KEYUTILS_LIBS)
+mount_ecryptfs_private_LDADD = $(top_builddir)/src/libecryptfs/libecryptfs.la $(KEYUTILS_LIBS)
 
 ecryptfs_stat_SOURCES = ecryptfs-stat.c
 ecryptfs_stat_LDADD = $(top_builddir)/src/libecryptfs/libecryptfs.la

=== removed file 'src/utils/ecryptfs-dot-private'
--- src/utils/ecryptfs-dot-private	2009-04-08 22:36:45 +0000
+++ src/utils/ecryptfs-dot-private	1970-01-01 00:00:00 +0000
@@ -1,34 +0,0 @@
-#!/bin/sh -e
-#
-#    ecryptfs-dot-private
-#    Copyright (C) 2009 Canonical Ltd.
-#
-#    Authors: Dustin Kirkland <[e-mail]>
-#
-#    This program is free software: you can redistribute it and/or modify
-#    it under the terms of the GNU General Public License as published by
-#    the Free Software Foundation, version 2 of the License.
-#
-#    This program is distributed in the hope that it will be useful,
-#    but WITHOUT ANY WARRANTY; without even the implied warranty of
-#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-#    GNU General Public License for more details.
-#
-#    You should have received a copy of the GNU General Public License
-
-if echo "$0" | grep -qs "ecryptfs"; then
-	echo "ERROR: This file must be sourced, rather than executed:"
-	echo
-	echo "  . $0"
-	echo
-	exit 1
-fi
-
-# Hacky, umount.ecryptfs_private should be taught to exit 1 on
-# unsuccessful unmount, must check who else depends on this exit code.
-if /sbin/umount.ecryptfs_private | grep -v "Sessions still open"; then
-	cd "$HOME"/.Private
-else
-	echo "ERROR: Unable to access .Private, please close some sessions"
-fi
-/sbin/mount.ecryptfs_private

=== added file 'src/utils/ecryptfs-migrate-home'
--- src/utils/ecryptfs-migrate-home	1970-01-01 00:00:00 +0000
+++ src/utils/ecryptfs-migrate-home	2010-02-17 20:48:23 +0000
@@ -0,0 +1,195 @@
+#!/bin/sh
+# -*- sh-basic-offset: 4; sh-indentation: 4; tab-width: 4; indent-tabs-mode: t; sh-indent-comment: t; -*-
+# This script encrypts an user's home
+#
+# Written by Yan Li <[e-mail]>, <[e-mail]>
+# Copyright (C) 2010 Intel Corporation
+#
+# Modified by Dustin Kirkland <[e-mail]>
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License as
+# published by the Free Software Foundation; either version 2 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
+# 02111-1307, USA.
+
+set -e
+
+PRIVATE_DIR="Private"
+
+usage() {
+       echo "
+Usage:
+
+$0 -u USER
+
+ -u,--user       Migrate USER's home directory to an encrypted home directory
+
+WARNING: Make a complete backup copy of the non-encrypted data to
+another system or external media. This script is dangerous and, in
+case of an error, could result in data lost, or lock you out of your
+system!
+
+This program must be executed by root.
+
+"
+	exit 1
+}
+
+error() {
+	echo "$(gettext 'ERROR: ')" "$@" 1>&2
+	exit 1
+}
+
+warning() {
+	echo "$(gettext 'WARNING: ')" "$@" 1>&2
+}
+
+info() {
+	echo "$(gettext 'INFO: ')" "$@" 1>&2
+}
+
+assert_dir_empty() {
+	local DIR="$1"
+	if [ -e "$DIR" ]; then
+		# if $DIR is a directory, make sure it's empty
+		if [ -d "$DIR" ]; then
+			ls=$(ls -A "$DIR" | wc -l)
+			if [ "$ls" != "0" ]; then
+				echo 1>&2 "If you already have some data in directory $DIR,"
+				echo 1>&2 "please move all of these files and directories out of the way, and"
+				echo 1>&2 "follow the instructions in:"
+				echo 1>&2 "    ecryptfs-setup-private --undo"
+				echo 1>&2 
+				error "$DIR is not empty, cannot continue."
+			fi
+		else
+			error "$DIR exists but is not an empty directory, cannot continue."
+		fi
+	fi
+}
+
+# get user home by username
+get_user_home () {
+	local USER_NAME="$1"
+	local USER_HOME=$(grep "^$USER_NAME:" /etc/passwd | cut -d":" -f 6)
+	if [ -z "$USER_HOME" ]; then
+		error "Cannot find the home directory of $USER_NAME."
+	fi
+	echo "$USER_HOME"
+}
+
+sanity_check () {
+	local USER_NAME="$1"
+	local USER_HOME="$2"
+	if [ -e "$USER_HOME/.ecryptfs" ]; then
+		error "$USER_HOME appears to be encrypted already."
+	fi
+	# Check for rsync
+	if ! which rsync >/dev/null 2>&1; then
+		error "Please install the rsync package."
+	fi
+	# Check free space: make sure we have sufficient disk space
+	# available. To make a full copy, we will need at least 2.5x the
+	# disk usage of the target home directory.
+	info "Checking disk space, this may take a few moments.  Please be patient."
+	needed=$(du -s "$USER_HOME" | awk '{printf "%.0f", $1*2.5}')
+	free=$(df -P "$USER_HOME" | tail -n 1 | awk '{print $4}')
+	if [ $needed -gt $free ]; then
+		info "2.5x the size your current home directory is required to perform a migration."
+		info "Once the migration succeeds, you may recover most of this space by deleting the cleartext directory."
+		error "Not enough free disk space."
+	fi
+	assert_dir_empty "$USER_HOME/.$PRIVATE_DIR"
+	assert_dir_empty "$USER_HOME/.ecryptfs"
+	assert_dir_empty "/home/.ecryptfs/$USER_NAME"
+}
+
+encrypt_dir () {
+	local USER_NAME="$1"
+	local USER_HOME="$2"
+	if ! which lsof >/dev/null 2>&1; then
+		info "Please install lsof."
+		error "Can not tell whether $USER_HOME is in use or not."
+	fi
+	info "Checking for open files in $USER_HOME"
+	lsof=$(lsof +D "$USER_HOME" | wc -l)
+	if [ "$lsof" != "0" ]; then
+		info "The following files are in use:"
+		echo
+		lsof +D "$USER_HOME" | sed "s/^/    /"
+		echo
+		error "Cannot proceed."
+	fi
+	# start encryption
+	orig=$(mktemp /home/$USER_NAME.XXXXXXXX)
+	rm "$orig" && mv "$USER_HOME" "$orig"
+	chmod 700 "$orig"
+	mkdir -p -m 700 "$USER_HOME"
+	USER_GROUP=$(id -g "$USER_NAME")
+	chown "$USER_NAME:$USER_GROUP" "$USER_HOME" "$orig"
+	ECRYPTFS_SETUP_PRIVATE_ARGS=""
+	if [ -n "$LOGINPASS" ]; then
+		ECRYPTFS_SETUP_PRIVATE_ARGS="-l $LOGINPASS"
+	fi
+	if [ -n "$MOUNTPASS" ]; then
+		ECRYPTFS_SETUP_PRIVATE_ARGS="$ECRYPTFS_SETUP_PRIVATE_ARGS -m $MOUNTPASS"
+	fi
+	if ! ecryptfs-setup-private -u "$USER_NAME" -b $ECRYPTFS_SETUP_PRIVATE_ARGS; then
+		# too bad, something went wrong, we'll try to recover
+		rm -rf "$USER_HOME"
+		mv "$orig" "$USER_HOME"
+		exit 1
+	fi
+	info "Encrypted home has been set up, encrypting files now...this may take a while."
+	rsync -a "$orig/" "$USER_HOME/"
+	umount "$USER_HOME/"
+	echo
+	info "======================================================================"
+	info "The file encryption appears to have completed successfully, however,"
+	info "$USER_NAME MUST LOGIN IMMEDIATELY (BEFORE THE NEXT REBOOT) TO COMPLETE THE MIGRATION!!!"
+	info "======================================================================"
+	echo
+	info "If $USER_NAME can log in and read and write their files, then the migration is complete, and you should remove $orig."
+	echo
+	info "Otherwise, remove $USER_HOME and move $orig back to $USER_HOME."
+	echo
+}
+
+DO_ENCRYPT=
+while true; do
+	[ -z "$1" ] && break
+	case "$1" in
+		-u|--user)
+			DO_ENCRYPT=1
+			USER_NAME="$2"
+			shift 2
+		;;
+		*)
+			usage
+		;;
+	esac
+done
+
+if [ "$DO_ENCRYPT" != "1" ]; then
+	usage
+fi
+
+if [ "$(id -u)" != "0" ]; then
+	error "This program must be executed with root privileges"
+fi
+
+if [ "$DO_ENCRYPT" = "1" ]; then
+	USER_HOME=$(get_user_home "$USER_NAME")
+	sanity_check "$USER_NAME" "$USER_HOME"
+	encrypt_dir "$USER_NAME" "$USER_HOME" "$LOGINPASS" "$MOUNTPASS"
+fi

=== modified file 'src/utils/ecryptfs-mount-private'
--- src/utils/ecryptfs-mount-private	2009-03-20 21:44:01 +0000
+++ src/utils/ecryptfs-mount-private	2010-02-17 20:48:23 +0000
@@ -15,12 +15,13 @@
 PRIVATE_DIR="Private"
 WRAPPING_PASS="LOGIN"
 PW_ATTEMPTS=3
-MESSAGE="Enter your login passphrase: "
+TEXTDOMAIN="ecryptfs-utils"
+MESSAGE=`gettext "Enter your login passphrase:"`
 
 if [ -f $HOME/.ecryptfs/wrapping-independent ]; then
 	# use a wrapping passphrase different from the login passphrase
 	WRAPPING_PASS="INDEPENDENT"
-	MESSAGE="Enter your wrapping passphrase: "
+	MESSAGE=`gettext "Enter your wrapping passphrase:"`
 fi
 
 WRAPPED_PASSPHRASE_FILE="$HOME/.ecryptfs/wrapped-passphrase"
@@ -45,24 +46,24 @@
 		if printf "%s\0" "$LOGINPASS" | ecryptfs-insert-wrapped-passphrase-into-keyring "$WRAPPED_PASSPHRASE_FILE" - ; then
 			break
 		else
-			echo "ERROR: Your passphrase is incorrect"
+			echo `gettext "ERROR:"` `gettext "Your passphrase is incorrect"`
 			tries=$(($tries + 1))
 			continue
 		fi
 	done
 	if [ $tries -ge $PW_ATTEMPTS ]; then
-		echo "ERROR: Too many incorrect password attempts, exiting"
+		echo `gettext "ERROR:"` `gettext "Too many incorrect password attempts, exiting"`
 		exit 1
 	fi
 	/sbin/mount.ecryptfs_private
 else
-	echo "ERROR: Encrypted $PRIVATE_DIR is not setup properly"
+	echo `gettext "ERROR:"` `gettext "Encrypted private directory is not setup properly"`
 	exit 1
 fi
 if grep -qs "$HOME/.Private $PWD ecryptfs " /proc/mounts 2>/dev/null; then
 	echo
-	echo "INFO: Your private directory has been mounted."
-	echo "INFO: To see this change in your current shell:"
+	echo `gettext "INFO:"` `gettext "Your private directory has been mounted."`
+	echo `gettext "INFO:"` `gettext "To see this change in your current shell:"`
 	echo "  cd $PWD"
 	echo
 fi

=== modified file 'src/utils/ecryptfs-rewrite-file'
--- src/utils/ecryptfs-rewrite-file	2009-03-20 22:11:25 +0000
+++ src/utils/ecryptfs-rewrite-file	2010-02-17 20:48:23 +0000
@@ -17,45 +17,59 @@
 #    You should have received a copy of the GNU General Public License
 #    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+TEXTDOMAIN="ecryptfs-utils"
+
 error() {
-	echo
-	echo "ERROR: $1" 1>&2
+	echo `gettext "[FAILED]"`
+	echo `gettext "ERROR:"` "$1" 1>&2
 }
 j=0
+OKs=0
 for i in "$@"; do
-	[ "$i" = "." ] && continue
 	j=`expr $j + 1`
-	echo -n "INFO: Rewriting [$j/$#] [$i] ... "
+	echo -n `gettext "INFO:"` `gettext "Rewriting"` "[$j/$#] [$i] ... "
+	if [ ! -e "$i" ] ; then
+		error `gettext "File does not exist"`
+		continue
+	fi
+	if [ "$i" = "." ]; then
+		echo `gettext "[EXCLUDED]"` >&2
+		continue
+	fi
 	opt=
 	if [ -d "$i" -a ! -h "$i" ]; then
 		# A directory, re-encrypt the filename
 		temp1=`mktemp -d "$i".XXXXXXXXXX` || {
-			error "Could not create tempdir"
+			error `gettext "Could not create tempdir"`
 			continue
 		}
-		mv -f -T "$i" "$temp1" || {
-			error "Could not rename [$i] to [$temp1]"
+		mv -f -T "$i" "$temp1" 2>/dev/null  || {
+			error `gettext "Could not rename"` "[$i] -> [$temp1]"
 			rmdir "$temp1"
 			continue
 		}
-		mv -f "$temp1" "$i"	|| {
-			error "Could not rename [$temp1] to [$i]"
+		mv -f "$temp1" "$i" 2>/dev/null || {
+			error `gettext "Could not rename"` "[$temp1] -> [$i]"
 		}
 	else
 		# A file or symlink, re-encrypt the contents
 		temp1=`mktemp "$i".XXXXXXXXXX` || {
-			error "Could not create tempfile"
+			error `gettext "Could not create tempfile"`
 			continue
 		}
-		cp -a "$i" "$temp1" || {
-			error "Could not copy [$i] to [$temp1]"
+		cp -a "$i" "$temp1" 2>/dev/null || {
+			error `gettext "Could not copy"` "[$i] -> [$temp1]"
 			rm -f "$temp1"
 			continue
 		}
-		mv -f "$temp1" "$i" || {
-			error "Could not rename [$temp1] to [$i]"
+		mv -f "$temp1" "$i" 2>/dev/null || {
+			error `gettext "Could not rename"` "[$temp1] -> [$i]"
+			continue
 		}
 	fi
-	echo "[OK]"
+	echo `gettext "[OK]"`
+	OKs=$((OKs+1))
 done
+echo "$OKs/$j" `gettext "rewrites succeeded"`
+[ $OKs -ne $j ] && exit 1
 exit 0

=== modified file 'src/utils/ecryptfs-setup-private'
--- src/utils/ecryptfs-setup-private	2009-03-24 19:38:23 +0000
+++ src/utils/ecryptfs-setup-private	2010-02-17 20:48:23 +0000
@@ -8,8 +8,10 @@
 # Copyright (C) 2007-2008 International Business Machines
 PRIVATE_DIR="Private"
 WRAPPING_PASS="LOGIN"
+ECRYPTFS_DIR="/home/.ecryptfs"
 PW_ATTEMPTS=3
-MESSAGE="Enter your login passphrase"
+TEXTDOMAIN="ecryptfs-utils"
+MESSAGE="$(gettext 'Enter your login passphrase')"
 CIPHER="aes"
 KEYBYTES="16"
 FNEK=
@@ -18,42 +20,43 @@
 GREP_OPTIONS=
 
 usage() {
-	echo
-	echo "Usage:"
-	echo "  $0 [-f|--force] [-w|--wrapping] [--nopwcheck] [-n|--no-fnek]"
-	echo "  [-u|--username USER] [-l|--loginpass LOGINPASS]"
-	echo "  [-m|--mountpass MOUNTPASS]"
-	echo
-	echo " -f, --force      Force overwriting of an existing setup"
-	echo " -w, --wrapping   Use an independent wrapping passphrase,"
-	echo "                  different from the login passphrase"
-	echo " -n, --no-fnek    Do not encrypt filenames; If this flag is"
-	echo "                  omitted, and the kernel supports filename"
-	echo "                  encryption, then filenames will be encrypted"
-	echo " -u, --username   Username for encrypted private mountpoint,"
-	echo "                  defaults to yourself"
-	echo " -l, --loginpass  Login/Wrapping passphrase for USER,"
-	echo "                  used to wrap MOUNTPASS"
-	echo " --nopwcheck      Do not check the validity of the specified"
-	echo "                  login password (useful for LDAP user accounts)"
-	echo " --noautomount    Setup this user such that the encrypted private"
-	echo "                  directory is not automatically mounted on login"
-	echo " --noautoumount   Setup this user such that the encrypted private"
-	echo "                  directory is not automatically unmounted at"
-	echo "                  logout"
-	echo " -m, --mountpass  Passphrase for mounting the ecryptfs directory,"
-	echo "                  defaults to randomly generated $KEYBYTES bytes"
-	echo " -b, --bootstrap  Bootstrap a new user's entire home directory"
-	echo "                  Generates a random mount passphrase, which"
-	echo "			will be wrapped when the new login passphrase"
-	echo "			is set. SHOULD ONLY BE CALLED FROM 'adduser'."
-	echo " --undo           Provide instructions on how to undo an"
-	echo "                  encrypted private setup"
-	echo
-	echo "   Be sure to properly escape your parameters according to your"
-	echo "   shell's special character nuances, and also surround the"
-	echo "   parameters by double quotes, if necessary."
-	echo
+	echo "
+Usage:
+
+$0 [-f|--force] [-w|--wrapping] [--nopwcheck] [-n|--no-fnek]
+  [-u|--username USER] [-l|--loginpass LOGINPASS]
+  [-m|--mountpass MOUNTPASS]
+
+ -f, --force      Force overwriting of an existing setup
+ -w, --wrapping   Use an independent wrapping passphrase,
+                  different from the login passphrase
+ -n, --no-fnek    Do not encrypt filenames; If this flag is
+                  omitted, and the kernel supports filename
+                  encryption, then filenames will be encrypted
+ -u, --username   Username for encrypted private mountpoint,
+                  defaults to yourself
+ -l, --loginpass  Login/Wrapping passphrase for USER,
+                  used to wrap MOUNTPASS
+ --nopwcheck      Do not check the validity of the specified
+                  login password (useful for LDAP user accounts)
+ --noautomount    Setup this user such that the encrypted private
+                  directory is not automatically mounted on login
+ --noautoumount   Setup this user such that the encrypted private
+                  directory is not automatically unmounted at
+                  logout
+ -m, --mountpass  Passphrase for mounting the ecryptfs directory,
+                  defaults to randomly generated $KEYBYTES bytes
+ -b, --bootstrap  Bootstrap a new user's entire home directory
+                  Generates a random mount passphrase, which
+		  will be wrapped when the new login passphrase
+		  is set. SHOULD ONLY BE CALLED FROM 'adduser'.
+ --undo           Provide instructions on how to undo an
+                  encrypted private setup
+
+   Be sure to properly escape your parameters according to your
+   shell's special character nuances, and also surround the
+   parameters by double quotes, if necessary.
+"
 	exit 1
 }
 
@@ -63,7 +66,7 @@
 you will need to very carefully perform the following actions manually:
 
  1. Obtain your Private directory mountpoint
-   $ PRIVATE=\`cat ~/.ecryptfs/Private.mnt 2>/dev/null || echo \$HOME/Private\`
+   $ PRIVATE=\`cat ~/.ecryptfs/Private.mnt 2>/dev/null || echo \$HOME/$PRIVATE_DIR\`
  2. Ensure that you have moved all relevant data out of your \$PRIVATE directory
  3. Unmount your encrypted private directory
    $ ecryptfs-umount-private
@@ -78,14 +81,15 @@
 }
 
 error() {
-	echo "ERROR: $1" 1>&2
+	echo "$(gettext 'ERROR: ')" "$@" 1>&2
 	exit 1
 }
 
 error_testing() {
 	rm -f "$1" >/dev/null
+	shift
 	/sbin/umount.ecryptfs_private >/dev/null
-	error "$2"
+	error "$@"
 	exit 1
 }
 
@@ -98,7 +102,7 @@
 
 filename_encryption_available() {
 	version=$(cat /sys/fs/ecryptfs/version 2>/dev/null)
-	[ -z "$version" ] && error "Can't get ecryptfs version, ecryptfs kernel module not loaded?"
+	[ -z "$version" ] && error "$(gettext 'Cannot get ecryptfs version, ecryptfs kernel module not loaded?')"
 	[ $(($version & 0x100)) -eq 0 ] && return 1
 	return 0
 }
@@ -125,7 +129,7 @@
 		;;
 		-w|--wrapping)
 			WRAPPING_PASS="INDEPENDENT"
-			MESSAGE="Enter your wrapping passphrase"
+			MESSAGE="$(gettext 'Enter your wrapping passphrase')"
 			shift 1
 		;;
 		-f|--force)
@@ -149,7 +153,7 @@
 			exit 0
 		;;
 		-b|--bootstrap)
-			[ `whoami` = "root" ] || error "You must be root to bootstrap encrypt a home directory"
+			[ `whoami` = "root" ] || error "$(gettext 'You must be root to bootstrap encrypt a home directory')"
 			BOOTSTRAP=1
 			MOUNTPASS=`random_passphrase $KEYBYTES`
 			RANDOM_MOUNTPASS=1
@@ -168,16 +172,16 @@
 # Prompt for the USER name, if not on the command line and not in the env
 if [ -z "$USER" ]; then
 	while [ true ]; do
-		echo -n "Enter the username: "
+		echo -n "$(gettext 'Enter the username: ')"
 		USER=`head -n1`
 		echo
 		if [ -z "$USER" ]; then
-			echo "ERROR: You must provide a username"
+			echo "$(gettext 'ERROR: ')" "$(gettext 'You must provide a username')"
 			continue
 		else
 			# Verify that the user exists
 			if ! id "$USER" >/dev/null; then
-				echo "ERROR: User [$USER] does not exist"
+				echo "$(gettext 'ERROR: ')" "$(gettext 'User does not exist')" " [$USER]"
 				continue
 			fi
 			break
@@ -185,49 +189,61 @@
 	done
 else
 	# Verify that the user exists
-	id "$USER" >/dev/null || error "User [$USER] does not exist"
+	id "$USER" >/dev/null || error "$(gettext 'User does not exist')" "[$USER]"
+fi
+
+# Obtain USER's primary group
+GROUP=$(id -g $USER)
+
+# Check if the ecryptfs group exists, and user is member of ecryptfs group
+if grep -qs "^ecryptfs:" /etc/group; then
+	if ! id "$USER" | grep -qs "\(ecryptfs\)"; then
+	       error "$(gettext 'User needs to be a member of ecryptfs group')"
+	fi
 fi
 
 # Obtain the user's home directory
 HOME=`getent passwd "$USER" | awk -F: '{print $6}'`
 if [ ! -d "$HOME" ]; then
-	error "User home directory [$HOME] does not exist"
+	error "$(gettext 'User home directory does not exist')" "[$HOME]"
 fi
 
 if [ "$BOOTSTRAP" = "1" ]; then
 	# If we want to encrypt the entire homedir, we need the .ecryptfs
 	# config dir elsewhere, but linked into the homedir
-	mkdir -p -m 700 /var/lib/ecryptfs/$USER
-	ln -sf /var/lib/ecryptfs/$USER $HOME/.ecryptfs
+	mkdir -p -m 700 $ECRYPTFS_DIR/$USER/.ecryptfs 
+	ln -sf $ECRYPTFS_DIR/$USER/.ecryptfs $HOME/.ecryptfs
+	ln -sf $ECRYPTFS_DIR/$USER/.$PRIVATE_DIR $HOME/.$PRIVATE_DIR
 	MOUNTPOINT="$HOME"
+	CRYPTDIR="$ECRYPTFS_DIR/$USER/.$PRIVATE_DIR"
 else
 	mkdir -m 700 $HOME/.ecryptfs
 	MOUNTPOINT="$HOME/$PRIVATE_DIR"
+	CRYPTDIR="$HOME/.$PRIVATE_DIR"
 fi
 
 # Check for previously setup private directory
 if [ -s "$HOME/.ecryptfs/wrapped-passphrase" -a "$FORCE" != "1" ]; then
-	error "wrapped-passphrase file already exists, use --force to overwrite."
+	error "$(gettext 'wrapped-passphrase file already exists, use --force to overwrite.')"
 fi
 if [ -s "$HOME/.ecryptfs/$PRIVATE_DIR.sig" -a "$FORCE" != "1" ]; then
-	error "$PRIVATE_DIR.sig file already exists, use --force to overwrite."
+	error "$PRIVATE_DIR.sig" "$(gettext 'file already exists, use --force to overwrite.')"
 fi
 
 # Check for active mounts
-CRYPTDIR="$HOME/.$PRIVATE_DIR"
-grep -qs "$MOUNTPOINT " /proc/mounts && error "[$MOUNTPOINT] is already mounted"
-grep -qs "$CRYPTDIR " /proc/mounts && error "[$CRYPTDIR] is already mounted"
+grep -qs "$MOUNTPOINT " /proc/mounts && error "[$MOUNTPOINT]" "$(gettext 'is already mounted')"
+grep -qs "$CRYPTDIR " /proc/mounts && error "[$CRYPTDIR]" "$(gettext 'is already mounted')"
 
 # Check that the mount point and encrypted directory are empty (skip symlinks).
 # Perhaps one day we could provide a migration mode (using rsync or something),
 # but this would be VERY hard to do safely.
 count=`ls -Al "$MOUNTPOINT" 2>/dev/null | egrep -c "^[drwx-]{10}"`
 if [ "$count" != "0" ]; then
-	error "$MOUNTPOINT must be empty before proceeding"
+	error "$MOUNTPOINT" "$(gettext 'must be empty before proceeding')"
 fi
 count=`ls -Al "$CRYPTDIR" 2>/dev/null | egrep -c "^[dlrwx-]{10}"`
 if [ "$count" != "0" ]; then
-	error "$CRYPTDIR must be empty before proceeding"
+	error "$CRYPTDIR" "$(gettext 'must be empty before proceeding')"
 fi
 
 stty_orig=`stty -g`
@@ -240,14 +256,16 @@
 		LOGINPASS=`head -n1`
 		stty $stty_orig
 		echo
-		if [ $WRAPPING_PASS != "LOGIN" ]; then
+		if [ $WRAPPING_PASS != "LOGIN" -o ! -x /sbin/unix_chkpwd ]; then
+			# If we can't check the accuracy of the user's entered
+			# passphrase, force them to type it twice (matching)
 			stty -echo
 			echo -n "$MESSAGE (again): "
 			LOGINPASS2=`head -n1`
 			stty $stty_orig
 			echo
 			if [ "$LOGINPASS" != "$LOGINPASS2" ]; then
-				echo "ERROR: Wrapping passphrases must match"
+				echo "$(gettext 'ERROR: ')" "$(gettext 'Wrapping passphrases must match')"
 			else
 				break
 			fi
@@ -255,25 +273,24 @@
 			continue
 		fi
 		if [ -z "$LOGINPASS" ]; then
-			echo "ERROR: You must provide a login passphrase"
+			echo "$(gettext 'ERROR: ')" "$(gettext 'You must provide a login passphrase')"
 			tries=$(($tries + 1))
 		else
 			if [ "$NOPWCHECK" = "1" ]; then
-				echo "INFO: Skipping password verification"
+				echo "$(gettext 'INFO:')" "$(gettext 'Skipping password verification')"
 				break
 			else
 				if printf "%s\0" "$LOGINPASS" | /sbin/unix_chkpwd "$USER" nullok; then
 					break
 				else
-					echo "ERROR: Your login passphrase is incorrect"
+					echo "$(gettext 'ERROR: ')" "$(gettext 'Your login passphrase is incorrect')"
 					tries=$(($tries + 1))
 				fi
 			fi
 		fi
 	done
 	if [ $tries -ge $PW_ATTEMPTS ]; then
-		echo "ERROR: Too many incorrect password attempts, exiting"
-		exit 1
+		error "$(gettext 'Too many incorrect password attempts, exiting')"
 	fi
 fi
 
@@ -282,7 +299,7 @@
 	tries=0
 	while [ $tries -lt $PW_ATTEMPTS ]; do
 		stty -echo
-		echo -n "Enter your mount passphrase [leave blank to generate one]: "
+		echo -n "$(gettext 'Enter your mount passphrase [leave blank to generate one]: ')"
 		MOUNTPASS=`head -n1`
 		stty $stty_orig
 		echo
@@ -292,12 +309,12 @@
 			break
 		else
 			stty -echo
-			echo -n "Enter your mount passphrase (again): "
+			echo -n "$(gettext 'Enter your mount passphrase (again): ')"
 			MOUNTPASS2=`head -n1`
 			stty $stty_orig
 			echo
 			if [ "$MOUNTPASS" != "$MOUNTPASS2" ]; then
-				echo "ERROR: Mount passphrases do not match"
+				echo "$(gettext 'ERROR: ')" "$(gettext 'Mount passphrases do not match')"
 				tries=$(($tries + 1))
 			else
 				break
@@ -305,58 +322,43 @@
 		fi
 	done
 	if [ $tries -ge $PW_ATTEMPTS ]; then
-		echo "ERROR: Too many incorrect passphrase attempts, exiting"
-		exit 1
+		error "$(gettext 'Too many incorrect passphrase attempts, exiting')"
 	fi
 fi
 
-#echo
-#echo "Using username [$USER]"
-#echo "Using mount passphrase [$MOUNTPASS]"
-#echo "Using login passphrase [$LOGINPASS]"
-#echo "Using mount point [$MOUNTPOINT]"
-#echo "Using encrypted dir [$CRYPTDIR]"
-#echo
-#echo "This script will attempt to set up your system to mount"
-#echo "$MOUNTPOINT with eCryptfs automatically on login,"
-#echo "using your login passphrase."
 echo
 echo "************************************************************************"
-if [ "$RANDOM_MOUNTPASS" = "1" ]; then
-	echo "YOU SHOULD RECORD THIS MOUNT PASSPHRASE AND STORE IN A SAFE LOCATION:"
-	echo "$MOUNTPASS"
-else
-	echo "YOU SHOULD RECORD YOUR MOUNT PASSPHRASE AND STORE IN A SAFE LOCATION:"
-fi
-echo "THIS WILL BE REQUIRED IF YOU NEED TO RECOVER YOUR DATA AT A LATER TIME."
+echo "$(gettext 'YOU SHOULD RECORD YOUR MOUNT PASSPHRASE AND STORE IT IN A SAFE LOCATION.')"
+echo "  ecryptfs-unwrap-passphrase ~/.ecryptfs/wrapped-passphrase"
+echo "$(gettext 'THIS WILL BE REQUIRED IF YOU NEED TO RECOVER YOUR DATA AT A LATER TIME.')"
 echo "************************************************************************"
 echo
 
 ###############################################################################
 
 # Setup private directory in home
-mkdir -m 700 -p "$CRYPTDIR" || error "Could not create crypt directory [$CRYPTDIR]"
-mkdir -m 700 -p "$MOUNTPOINT" || error "Could not create mount directory [$MOUNTPOINT]"
+mkdir -m 700 -p "$CRYPTDIR" || error "$(gettext 'Could not create crypt directory')" "[$CRYPTDIR]"
+mkdir -m 700 -p "$MOUNTPOINT" || error "$(gettext 'Could not create mount directory')" "[$MOUNTPOINT]"
 ln -sf /usr/share/ecryptfs-utils/ecryptfs-mount-private.txt "$MOUNTPOINT"/README.txt
 ln -sf /usr/share/ecryptfs-utils/ecryptfs-mount-private.desktop "$MOUNTPOINT"/Access-Your-Private-Data.desktop
 chmod 500 "$MOUNTPOINT"
 
 # Setup ~/.ecryptfs directory
 if [ "$NOAUTOMOUNT" = "1" ]; then
-	echo "INFO: $HOME/$PRIVATE_DIR will not be mounted on login"
+	echo "$(gettext 'INFO:')" "$HOME/$PRIVATE_DIR" "$(gettext 'will not be mounted on login')"
 else
-	touch $HOME/.ecryptfs/auto-mount || error "Could not setup ecryptfs auto-mount"
+	touch $HOME/.ecryptfs/auto-mount || error "$(gettext 'Could not setup ecryptfs auto-mount')"
 fi
 if [ "$NOAUTOUMOUNT" = "1" ]; then
-	echo "INFO: $HOME/$PRIVATE_DIR will not be unmounted on logout"
+	echo "$(gettext 'INFO:')" "$HOME/$PRIVATE_DIR" "$(gettext 'will not be unmounted on logout')"
 else
-	touch $HOME/.ecryptfs/auto-umount || error "Could not setup ecryptfs auto-umount"
+	touch $HOME/.ecryptfs/auto-umount || error "$(gettext 'Could not setup ecryptfs auto-umount')"
 fi
 
 if [ "$WRAPPING_PASS" = "LOGIN" ]; then
-	rm -f $HOME/.ecryptfs/wrapping-independent || error "Could not remove ecryptfs wrapping-independent"
+	rm -f $HOME/.ecryptfs/wrapping-independent || error "$(gettext 'Could not remove ecryptfs wrapping-independent')"
 else
-	touch $HOME/.ecryptfs/wrapping-independent || error "Could not setup ecryptfs wrapping-independent"
+	touch $HOME/.ecryptfs/wrapping-independent || error "$(gettext 'Could not setup ecryptfs wrapping-independent')"
 fi
 
 
@@ -364,7 +366,7 @@
 timestamp=`date +%Y%m%d%H%M%S`
 for i in "$HOME/.ecryptfs/wrapped-passphrase" "$HOME/.ecryptfs/$PRIVATE_DIR.sig"; do
 	if [ -s "$i" ]; then
-		mv -f "$i" "$i.$timestamp" || error "Could not backup existing data [$i]"
+		mv -f "$i" "$i.$timestamp" || error "(gettext 'Could not backup existing data')" "[$i]"
 	fi
 done
 
@@ -380,7 +382,7 @@
 	printf "%s" "$MOUNTPASS" > "$temp"
 	mv "$temp" "/dev/shm/.ecryptfs-$USER"
 else
-	printf "%s\n%s" "$MOUNTPASS" "$LOGINPASS" | ecryptfs-wrap-passphrase "$HOME/.ecryptfs/wrapped-passphrase" - || error "Could not wrap passphrase"
+	printf "%s\n%s" "$MOUNTPASS" "$LOGINPASS" | ecryptfs-wrap-passphrase "$HOME/.ecryptfs/wrapped-passphrase" - || error "$(gettext 'Could not wrap passphrase')"
 fi
 umask $u
 
@@ -388,21 +390,21 @@
 # On subsequent logins, this should be handled by "pam_ecryptfs.so unwrap"
 response=`printf "%s" "$MOUNTPASS" | ecryptfs-add-passphrase $FNEK -`
 if [ $? -ne 0 ]; then
-	error "Could not add passphrase to the current keyring"
+	error "$(gettext 'Could not add passphrase to the current keyring')"
 fi
 sig=`echo "$response" | grep "Inserted auth tok" | sed "s/^.*\[//" | sed "s/\].*$//"`
 if ! echo "$sig" | egrep -qs "^[0-9a-fA-F]{$KEYBYTES,$KEYBYTES}$"; then
-	error "Could not obtain the key signature"
+	error "$(gettext 'Could not obtain the key signature')"
 fi
 temp=`mktemp`
-echo "$sig" > "$temp" || error "Could not create signature file [$HOME/.ecryptfs/$PRIVATE_DIR.sig]"
+echo "$sig" > "$temp" || error "$(gettext 'Could not create signature file')" "[$HOME/.ecryptfs/$PRIVATE_DIR.sig]"
 mv "$temp" "$HOME/.ecryptfs/$PRIVATE_DIR.sig"
 temp=`mktemp`
-echo "$MOUNTPOINT" > "$temp" || error "Could not create mountpoint file [$HOME/.ecryptfs/$PRIVATE_DIR.mnt]"
+echo "$MOUNTPOINT" > "$temp" || error "$(gettext 'Could not create mountpoint file')" "[$HOME/.ecryptfs/$PRIVATE_DIR.mnt]"
 mv "$temp" "$HOME/.ecryptfs/$PRIVATE_DIR.mnt"
 
 echo
-echo "Done configuring."
+echo "$(gettext 'Done configuring.')"
 echo
 
 # Skip the tests if we're in bootstrap mode, but exit with the encrypted
@@ -412,7 +414,9 @@
 	# and the calling 'adduser' is about to copy over /etc/skel
 	# NOTE: it is the responsibility of 'adduser' to unmount!
 	# And ensure that $USER owns the files/dirs we've created as root
-	chown $USER:$USER "$CRYPTDIR" /dev/shm/.ecryptfs-$USER
+	chown $USER:$GROUP "$CRYPTDIR" /dev/shm/.ecryptfs-$USER
+	chown -R $USER:$GROUP $ECRYPTFS_DIR/$USER
+	chown -R $USER:$GROUP $MOUNTPOINT
 	if [ "$FNEK" = "--fnek" ]; then
 		fnek_sig=`tail -n 1 "$HOME/.ecryptfs/$PRIVATE_DIR.sig"`
 		sig=`head -n 1 "$HOME/.ecryptfs/$PRIVATE_DIR.sig"`
@@ -420,42 +424,37 @@
 	else
 		sig_opt="ecryptfs_sig=$sig"
 	fi
+	# Do the mount, and provide some helpful symlinks
 	mount -i -t ecryptfs -o "rw,$sig_opt,ecryptfs_cipher=$CIPHER,ecryptfs_key_bytes=$KEYBYTES" "$CRYPTDIR" "$MOUNTPOINT" || error "Could not mount"
-	ln -sf /var/lib/ecryptfs/$USER $MOUNTPOINT/.ecryptfs
-	for i in auto-mount \
-		 auto-umount \
-		 $PRIVATE_DIR.mnt \
-		 $PRIVATE_DIR.sig \
-		 wrapped-passphrase;
-	do
-		[ -e $HOME/.ecryptfs/$i ] && chown $USER:$USER $MOUNTPOINT/.ecryptfs/$i
-	done
-	chown $USER:$USER /var/lib/ecryptfs/$USER
-	chown -h $USER:$USER $MOUNTPOINT/.ecryptfs
+	ln -sf $ECRYPTFS_DIR/$USER/.ecryptfs $MOUNTPOINT/.ecryptfs
+	ln -sf $ECRYPTFS_DIR/$USER/.$PRIVATE_DIR $MOUNTPOINT/.$PRIVATE_DIR
+	chown -R $USER:$GROUP $ECRYPTFS_DIR/$USER
+	chown -R $USER:$GROUP $MOUNTPOINT
 	exit 0
 fi
 
 # Now let's perform some basic mount/write/umount/read sanity testing...
-echo "Testing mount/write/umount/read..."
-/sbin/mount.ecryptfs_private || error "Could not mount private ecryptfs directory"
-temp=`mktemp "$MOUNTPOINT/ecryptfs.test.XXXXXX"` || error_testing "$temp" "Could not create empty file"
-random_data=`head -c 16000 /dev/urandom | od -x` || error_testing "$temp" "Could not generate random data"
-echo "$random_data" > "$temp" || error_testing "$temp" "Could not write encrypted file"
-md5sum1=`md5sum "$temp"` || error_testing "$temp" "Could not read encrypted file"
-/sbin/umount.ecryptfs_private || error_testing "$temp" "Could not unmount private ecryptfs directory"
-/sbin/mount.ecryptfs_private || error_testing "$temp" "Could not mount private ecryptfs directory (2)"
-md5sum2=`md5sum "$temp"` || error_testing "$temp" "Could not read encrypted file (2)"
+echo "$(gettext 'Testing mount/write/umount/read...')"
+/sbin/mount.ecryptfs_private || error "$(gettext 'Could not mount private ecryptfs directory')"
+temp=`mktemp "$MOUNTPOINT/ecryptfs.test.XXXXXX"` || error_testing "$temp" "$(gettext 'Could not create empty file')"
+random_data=`head -c 16000 /dev/urandom | od -x` || error_testing "$temp" "$(gettext 'Could not generate random data')"
+echo "$random_data" > "$temp" || error_testing "$temp" "$(gettext 'Could not write encrypted file')"
+md5sum1=`md5sum "$temp"` || error_testing "$temp" "$(gettext 'Could not read encrypted file')"
+/sbin/umount.ecryptfs_private || error_testing "$temp" "$(gettext 'Could not unmount private ecryptfs directory')"
+/sbin/mount.ecryptfs_private || error_testing "$temp" "$(gettext 'Could not mount private ecryptfs directory (2)')"
+md5sum2=`md5sum "$temp"` || error_testing "$temp" "$(gettext 'Could not read encrypted file (2)')"
 rm -f "$temp"
 # Use ecryptfs-umount-private on the final run, to clear the used keys
 # out of the keyring
-ecryptfs-umount-private || error_testing "$temp" "Could not unmount private ecryptfs directory (2)"
+ecryptfs-umount-private || error_testing "$temp" "$(gettext 'Could not unmount private ecryptfs directory (2)')"
 if [ "$md5sum1" != "$md5sum2" ]; then
-	error "Testing failed."
+	error "$(gettext 'Testing failed.')"
 else
-	echo "Testing succeeded."
+	echo "$(gettext 'Testing succeeded.')"
 fi
 
 echo
-echo "Logout, and log back in to begin using your encrypted directory."
+echo "$(gettext 'Logout, and log back in to begin using your encrypted directory.')"
 echo
+
 exit 0

=== modified file 'src/utils/ecryptfs-setup-swap'
--- src/utils/ecryptfs-setup-swap	2009-03-20 21:44:01 +0000
+++ src/utils/ecryptfs-setup-swap	2010-02-17 20:48:23 +0000
@@ -19,23 +19,25 @@
 # The cryptswap setup used here follows a guide published at:
 #  * http://ubuntumagnet.com/2007/11/creating-encrypted-swap-file-ubuntu-using-cryptsetup
 
+TEXTDOMAIN="ecryptfs-utils"
+
 error() {
-	echo "ERROR: $1" 1>&2
+	echo `gettext "ERROR:"` "$@" 1>&2
 	exit 1
 }
 
 info() {
-	echo "INFO: $1"
+	echo `gettext "INFO:"` "$@"
 }
 
-warning() {
-	echo "WARNING: "
+warn() {
+	echo `gettext "WARNING:"` "$@" 1>&2
 }
 
 usage() {
 	echo
-	echo "Usage:"
-	echo "  $0 [-f|--force]"
+	echo `gettext "Usage:"`
+	echo "  $0 [-f|--force] [-n|--no-reload]"
 	echo
 	exit 1
 }
@@ -48,6 +50,10 @@
 			FORCE=1
 			shift 1
 		;;
+		-n|--no-reload)
+			NO_RELOAD=1
+			shift 1
+		;;
 		*)
 			usage
 		;;
@@ -55,94 +61,83 @@
 done
 
 # Ensure that cryptsetup is available
-[ -x /sbin/cryptsetup ] || error "Please install 'cryptsetup'"
+[ -x /sbin/cryptsetup ] || error `gettext "Please install"` "'cryptsetup'"
 
 # Ensure that we're running with root privileges
-[ -w /etc/passwd ] || error "This program must be run with 'sudo', or as root"
+[ -w /etc/passwd ] || error `gettext "This program must be run with 'sudo', or as root"`
 
 # Count swap spaces available
-# BUG: We only support setting up a single swap space at this time
 if [ $(grep -c "^/" /proc/swaps) -eq 0 ]; then
 	mem=$(grep "^MemTotal:" /proc/meminfo | awk '{print $2}')
 	swapsize=$((4*$mem))
 	info "You do not currently have any swap space defined."
 	echo
-	echo "You can create a swap file by doing:"
+	echo `gettext "You can create a swap file by doing:"`
 	echo " $ sudo dd if=/dev/zero of=/swapfile count=$swapsize"
 	echo " $ sudo mkswap /swapfile"
 	echo " $ sudo swapon /swapfile"
 	echo
-	echo "And then re-run $0"
+	echo `gettext "And then re-run"` "$0"
 	echo
 	exit 0
-elif [ $(grep -c "^/" /proc/swaps) -gt 1 ]; then
-	info "You have more than one swap space defined."
-	error "$0 only supports setting up a single swap space"
-else
-	swap=$(grep "^/" /proc/swaps | awk '{print $1}')
-fi
-
-# Make sure this is swap space
-if ! vol_id "$swap" | grep -qs "ID_FS_TYPE=swap"; then
-	error "[$swap] does not appear to be swap space"
-fi
-
-# Check if this this swap space is already setup for encryption
-if /sbin/dmsetup table "$swap" | grep -qs " crypt " 2>/dev/null; then
-	info "[$swap] already appears to be encrypted."
-	exit 0
-else
-	# keep going
-	/bin/true
-fi
-
-base=$(basename "$swap")
-if grep -qs "^$base.*swap.*cipher" /etc/crypttab 2>/dev/null; then
-	info "[$swap] already has an entry in /etc/crypttab."
-	exit 0
-fi
-if grep -qs "$swap" /etc/initramfs-tools/conf.d/cryptroot 2>/dev/null; then
-	info "[$swap] already has an entry in /etc/fstab."
-	exit 0
-fi
-
-# Ensure available dev mapper name 'cryptswap'
-if grep -qs "^cryptswap" /etc/crypttab; then
-	error "There appears to be a cryptswap entry in /etc/cryptab; aborting."
-fi
-
-# Ensure available fstab entry
-if grep -qs "^/dev/mapper/cryptswap" /etc/fstab; then
-	error "There appears to be a cryptswap entry in /etc/fstab; aborting."
-fi
-
-# Ensure that the existing swap space exists in fstab
-if grep -qs "^$swap" /etc/fstab; then
-	sed -i "s:^$swap:\#$swap:" /etc/fstab
-	info "Commented out your unencrypted swap from /etc/fstab"
-else
-	info "Your swap space isn't currently listed in /etc/fstab"
-fi
-
+fi
+
+swaps=$(grep "^/" /proc/swaps | awk '{print $1}')
+
+filtered_swaps=$(
+for swap in $swaps; do
+	# Make sure this is swap space
+	if [ "$(blkid -o value -s TYPE $swap)" != "swap" ]; then
+		warn "[$swap]" `gettext "does not appear to be swap space, skipping."`
+		continue
+	fi
+	
+	if [ "${swap#/dev/ram}" != "$swap" ]; then
+		warn "[$swap]" `gettext "is a RAM device, skipping."`
+		continue
+	fi
+
+	# Check if this swap space is already setup for encryption
+	if /sbin/dmsetup table "$swap" 2>/dev/null | grep -qs " crypt "; then
+		warn "[$swap]" `gettext "already appears to be encrypted, skipping."`
+		continue
+	fi
+
+	base=$(basename "$swap")
+	if grep -qs "^$base.*swap.*cipher" /etc/crypttab 2>/dev/null; then
+		warn "[$swap]" `gettext "already has an entry in /etc/crypttab, skipping."`
+		continue
+	fi
+	if grep -qs "$swap" /etc/initramfs-tools/conf.d/cryptroot 2>/dev/null; then
+		warn "[$swap]" `gettext "already has an entry in /etc/crypttab, skipping."`
+		continue
+	fi
+
+	echo $swap
+done
+)
+swaps="$filtered_swaps"
+if [ -z "$swaps" ]; then
+	warn "There were no usable swap devices to be encrypted.  Exiting."
+	exit 0
+fi
 ##########################################################################
 # Warn the user about breaking hibernate mode
 if [ "$FORCE" != 1 ]; then
 	echo
-	warning
-	echo "    An encrypted swap is required to help ensure that encrypted files"
-	echo "    are not leaked to disk in an unencrypted format."
-	echo
-	echo "    HOWEVER, THE SWAP ENCRYPTION CONFIGURATION PRODUCED BY THIS PROGRAM"
-	echo "    WILL BREAK HIBERNATE/RESUME ON THIS SYSTEM!"
-	echo
-	echo "    NOTE: Your suspend/resume capabilities will not be affected."
-	echo
-	echo -n "Do you want to proceed with encrypting your swap [y/N]: "
+	echo `gettext "WARNING:"`
+	echo `gettext "An encrypted swap is required to help ensure that encrypted files are not leaked to disk in an unencrypted format."`