I'm using cryptsetup to create a LUKS file-based device to stash information in:# create a file as a containerdd if=/dev/zero of=zulu.bin bs=1024 count=102400# create a keydd if=/dev/urandom bs=1 count=8192 2>/dev/null | \  base64 | \  cut -b 1-8192 | \  tr -d '\n' | \  gpg2 --output zulu-key.gpg -aser DEADBEEF# format the file-based devicegpg2 --decrypt zulu-key.gpg | \  cryptsetup luksFormat --iter-time=10000 --hash sha256 \    --cipher aes-cbc-essiv:sha256 --key-size 256 --key-file - \    zulu.binThere are a lot of things less than optimal here, namely block-device encryption provides no  cryptographic authentication, etc.In any case, I cannot open this device as a non-root user:$ gpg2 --decrypt zulu-key.gpg | \    cryptsetup open -d - zulu.bin zuluCannot initialize device-mapper, running as non-root user.What I essentially need is an entire filesystem that is encrypted but stored in a file. I need to be able to open and close this encrypted filesystem at will and without elevated privileges.I have thought about simply creating a tmpfs or ramfs and then simply dding the device directly piped into GnuPG and then I'd get GnuPG's encryption, authentication, and non-repudiation, but I'm not sure if this will work.Is there a good known way to allocate a filesystem of an arbitrary size as a file that is encrypted at rest via GnuPG, can be opened into RAM, and then can be again piped into GnuPG for encryption to take the device offline again? Is it possible to do this as a normal user using FUSE?My use case is needing an arbitrarily sized filesystem which is encrypted so that programs writing files to said filesystem need not know about encryption at all; GnuPG would handle the encryption when closing the device and writing ciphertext to disk as a file.
Open a LUKS volume as a non-root user?
gpg;luks;dm crypt