From b111be60d289af709f7f94a03fa34c9432490ad2 Mon Sep 17 00:00:00 2001 From: Mounir IDRASSI Date: Fri, 25 Sep 2026 13:59:10 +0200 Subject: [PATCH] Unix: preserve requested protection when mounting favorites Keep caller protection unless a favorite requires read-only access. Reuse cached outer credentials when recovering hidden-protection errors. --- src/Main/FavoriteVolume.cpp | 4 +++- src/Main/UserInterface.cpp | 10 ++++++---- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/src/Main/FavoriteVolume.cpp b/src/Main/FavoriteVolume.cpp index 459d3fb8..33bc7131 100644 --- a/src/Main/FavoriteVolume.cpp +++ b/src/Main/FavoriteVolume.cpp @@ -92,7 +92,9 @@ namespace VeraCrypt options.Path.reset (new VolumePath (Path)); options.PartitionInSystemEncryptionScope = System; - options.Protection = (ReadOnly ? VolumeProtection::ReadOnly : VolumeProtection::None); + // A favorite may require read-only access, but must not weaken requested protection. + if (ReadOnly) + options.Protection = VolumeProtection::ReadOnly; options.SlotNumber = SlotNumber; } } diff --git a/src/Main/UserInterface.cpp b/src/Main/UserInterface.cpp index feb40978..b88d5286 100644 --- a/src/Main/UserInterface.cpp +++ b/src/Main/UserInterface.cpp @@ -847,13 +847,15 @@ namespace VeraCrypt newMountedVolumes.push_back (Core->MountVolume (favoriteOptions)); mountPerformed = true; } - catch (PasswordException&) + catch (PasswordException &e) { CloseSecurityTokenSessionsAfterMountScope closeTokenSessionsScope (Preferences.CloseSecurityTokenSessionsAfterMount); - // The initial silent mount attempt has already consulted cached passwords. - // Avoid repeating the same failed cache sweep before prompting the user. - shared_ptr volume = MountVolume (favoriteOptions, false); + // A protection failure accepted the outer password. Let the UI recover + // using that cache; only skip a cache sweep that failed outer authentication. + bool protectionError = dynamic_cast (&e) + || dynamic_cast (&e); + shared_ptr volume = MountVolume (favoriteOptions, protectionError); if (!volume) break;