mjhjmtu

If I add the line: ALL= /usr/bin/truecrypt to the sudoers file this lets all users mount volumes at arbitrary mount-points. The problem is a user could create a truecrypt volume and then mount it at /etc/apache2 or /var/www -- directories which they shouldn't be able to tamper with.

If a user doesn't have sudo rights to run /usr/bin/truecrypt then truecrypt fails after prompting for the administrator/user password.

What's the proper way to configure the system/truecrypt so users can mount volumes in a sane/safe way? e.g. they can only mount volumes to mount-points which they own (or have write-access to)?

I would suggest you attempt adding your mounts to your fstab. It can be found at /etc/fstab on most systems.

fstab will allow you to restrict who has access and who can mount which devices to which mount points. The option you are looking for will most likely be uid. You can determine a user's UID by examining /etc/passwd. Typically, you will be using uid 1000 as the first user created on the system.

sshfs#server.local:/mnt/Mountpoint /mnt/LocalDir fuse comment=sshfs,noauto,users,exec,uid=1000,gid=1000,allow_other,reconnect,transform_symlinks,BatchMode=yes,IdentityFile=/home/me/.ssh/server 0 0

This example shows how I mount a remote filesystem locally using sshfs. I have restricted it so that only my user is allowed to do such a thing. There are additional options in this sshfs example that you will most likely not need, but I think if you take a look it might clear things up.

further reading

Mount TrueCrypt volumes as a normal user

tl;dr

Set up uid and even guid in your fstab to restrict access to certain users. This will restrict mounting/unmounting as well as file access if set up correctly. Also, investigate whether or not you are utilizing FUSE, as that can cause additional conflict.