Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Is there any way to set up Linux in such a way that a regular user can not view or modify an encrypted file (located on an encrypted partition probably), while he at the same time is allowed to work with an application that has full access to that file? Please note that the file should be encrypted and not just inaccessible.

Reason: I want to use sqlite for my application, but it is not encrypted, and storing encrypted chunks is not a good idea in terms of proper indexing. So I thought maybe Linux may solve this. Oh, and this application will be delivered along with a set-up machine, so end-users wont need to mess with the partitions and installation.

share|improve this question

migrated from stackoverflow.com Jul 14 at 10:10

This question came from our site for professional and enthusiast programmers.

    
You set file permissions such that the application is a user or in a certain group and that only the process user has ownership. I.E mysql as owner and r,w,x and all other users as -. That should do it. –  Shawn Jul 1 at 21:49

1 Answer 1

The requirements are:

  • No user can access the file except through the application.
  • Some users (presumably not all) can use the application to access the file.

Thus, the file must be owned by a special user, say mysql as in Shawn's comment, and the application must likewise be owned by mysql. (Or you could do it with groups.)

Then we need a way to restrict who can run the application. I see two ways to do this.

  • We can create a group of people who are allowed to run the application, using chmod 4750 app to set the setuid bit so they can run it with the owner's effective UID. Here, the application's permissions would be -rwsr-x---.
  • We can use sudo to run it, and set up /etc/sudoers to restrict the users allowed to run it.
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.