From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <arvidjaar@gmail.com>
Received: from mail.saout.de ([127.0.0.1])
 by localhost (mail.saout.de [127.0.0.1]) (amavisd-new, port 10024)
 with ESMTP id CAT-3JfV4bjW for <dm-crypt@saout.de>;
 Sun,  9 Feb 2014 07:05:38 +0100 (CET)
Received: from mail-la0-x22f.google.com (unknown
 [IPv6:2a00:1450:4010:c03::22f])
 (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits))
 (No client certificate requested)
 by mail.saout.de (Postfix) with ESMTPS
 for <dm-crypt@saout.de>; Sun,  9 Feb 2014 07:05:37 +0100 (CET)
Received: by mail-la0-f47.google.com with SMTP id hr17so3817730lab.6
 for <dm-crypt@saout.de>; Sat, 08 Feb 2014 22:05:37 -0800 (PST)
Received: from opensuse.site (ppp91-76-154-95.pppoe.mtu-net.ru. [91.76.154.95])
 by mx.google.com with ESMTPSA id mo3sm10913617lbb.17.2014.02.08.21.41.57
 for <dm-crypt@saout.de> (version=SSLv3 cipher=RC4-SHA bits=128/128);
 Sat, 08 Feb 2014 21:41:57 -0800 (PST)
Date: Sun, 9 Feb 2014 09:41:56 +0400
From: Andrey Borzenkov <arvidjaar@gmail.com>
Message-ID: <20140209094156.17061eb4@opensuse.site>
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Subject: [dm-crypt] crypttab "tmp" option and /tmp 1777 permissions
List-Id: <dm-crypt.saout.de>
List-Unsubscribe: <http://www.saout.de/mailman/options/dm-crypt>,
 <mailto:dm-crypt-request@saout.de?subject=unsubscribe>
List-Archive: <http://www.saout.de/pipermail/dm-crypt/>
List-Post: <mailto:dm-crypt@saout.de>
List-Help: <mailto:dm-crypt-request@saout.de?subject=help>
List-Subscribe: <http://www.saout.de/mailman/listinfo/dm-crypt>,
 <mailto:dm-crypt-request@saout.de?subject=subscribe>
To: dm-crypt@saout.de

Interesting thread
https://forums.opensuse.org/showthread.php/495266-After-update-root-works-but-not-regular-user which boils down to following:

user is using "tmp" option for /tmp crypto container in /etc/crypttab
(in this case it seems it was created by installer without user even
realizing it). This recreates filesystem every time, this resetting
permissions of fs root to default. It in turn breaks KDM which
needs /tmp to be writable.

I wonder what is the proper place to fix it. Reading crypttab manual,
it says

           The encrypted block device will be prepared for using it as /tmp;
           it will be formatted using mke2fs(8). This option implies plain.

And /tmp is almost universally used with 1777 permissions today (and it
is expected to be world writable in any case), so I would say -
cryptsetup should do it; the only question is whether it should do it
unconditionally?