def _open_luks_container(self):

        # Open a loopback device
        if not self._find_loopback():
            return None

        # Check if this is a LUKS device
        # noinspection PyBroadException
        try:
            _util.check_call_(["cryptsetup", "isLuks", self.loopback], stderr=subprocess.STDOUT)
            # ret = 0 if isLuks
        except Exception:
            logger.warning("Not a LUKS volume")
            # clean the loopback device, we want this method to be clean as possible
            # noinspection PyBroadException
            try:
                _util.check_call_(['losetup', '-d', self.loopback])
                self.loopback = ""
            except Exception:
                pass

            return None

        # Open the LUKS container
        self.luks_path = 'image_mounter_' + str(random.randint(10000, 99999))

        # noinspection PyBroadException
        try:
            cmd = ["cryptsetup", "luksOpen", self.loopback, self.luks_path]
            if not self.disk.read_write:
                cmd.insert(1, '-r')
            _util.check_call_(cmd)
        except Exception:
            self.luks_path = ""
            return None

        size = None
        # noinspection PyBroadException
        try:
            result = _util.check_output_(["cryptsetup", "status", self.luks_path])
            for l in result.splitlines():
                if "size:" in l and "key" not in l:
                    size = int(l.replace("size:", "").replace("sectors", "").strip()) * self.disk.block_size
        except Exception:
            pass

        container = self.volumes._make_subvolume()
        container.index = "{0}.0".format(self.index)
        container.fsdescription = 'LUKS Volume'
        container.flag = 'alloc'
        container.offset = 0
        container.size = size

        return container
Check the permission.
dataset/ETHPy150Open ralphje/imagemounter/imagemounter/volume.py/Volume._open_luks_container--crossover with--dataset/ETHPy150Open tonyseek/simple-rbac/rbac/acl.py/Registry.is_allowed