Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I need to mount a directory in a way that prevents user accessing it. However I need to have access to all attributes (including permission) from root. Is following method safe or is there a way around it:

mkdir /mnt/protect
chmod 700 /mnt/protect
mkdir /mnt/protect/some_dir
mount /dev/sdXn /mnt/protect/some_dir
share|improve this question
add comment

1 Answer

up vote 4 down vote accepted

Yes, is should be secure, since any non-root user will not be able to read or enter any directory under /mnt/protect - that is unless you make something stupid like create a hard link to some file under /mnt/protect/ in a place that is accessible to others.

[Edit]: As Maciej has pointed out, it is actually (almost always?) forbidden to create cross-device hardlinks. What you could (but, of course should never) do is create a bind mount to some place under the "protected" filesystem. That would constitute a security breach.

share|improve this answer
2  
Note: it is possible to use chmod 700 on the root of the mounted filesystem after it has been mounted. This way you don't have to remember that you want it protected. –  Stéphane Gimenez Aug 3 '11 at 9:03
1  
@Stéph I confess that, at first, I didn't get what you mean. But now I see that you propose a different approach to the whole problem - yours works per-filesystem (regardless of the mountpoint) and Maciej's is per-mountpoint (regardless of mounted filesystems). –  rozcietrzewiacz Aug 4 '11 at 6:49
    
Last time I've check it wasn't possible to do hard links to directories or cross-filesystems (of course that are the features of specific filesystems ;) ). –  Maciej Piechotka Aug 4 '11 at 20:50
    
To directories, you can't make a hardlink (that is why I wrote create a hard link to some file. But for cross-filesystem links - good point, Macieju :) –  rozcietrzewiacz Aug 5 '11 at 10:31
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.