Secure short-lived password files under a private 0700 directory (under /dev/shm when available) before write, closing a umask/chmod race.
Mount, unmount, init, and auto-mount gocryptfs volumes from Noctalia. Passwords use secret-tool (desktop keyring) plus keyctl session cache.