If a user mounts an encrypted file system, is it possible to limit the visibility of that file system such that other users are not able to view it or even see that the file system is mounted?
I can not tell you how to do it, but namespaces is the way to go. These are new-ish. the Linux kernel supports them, and I think I heard that they are in some other kernels.
en.wikipedia.org/wiki/Cgroups#Namespace_isolation on Linux Kernel there are namespaces, you can hide mounts and other resources. It is often used with cgroups to create light weight virtual machines (Then all OSes use same kernel). But could also be used for what you are trying to do.
Be careful, when I played with them, I needed root privileges to use them (this is not strictly true see capabilities — fine grained privileges, to do what traditionally required root). Therefore any tool that you create should drop these privileges/capabilities when it has done setting up the namespace.
is it possible to limit the visibility of that file system such that other users are not able to view it
The same rules apply as if it wasn't on an encrypted system. Encryption just changes how the on-disk structures are finally stored.
That means that the normal ACL controls are still going to be in effect, just going through an added layer where something has to decrypt the filesystem. If the users have read/execute permissions to the filesystem directories then they'll be able to access it like normal.
The exact steps to implement that vary between the filesystems you can choose to encrypt. On ext3/ext4 filesystems, for instance, you can remove world read/execute from the mount point and just
setfacl as appropriate to give the users the desired level of access to that particular directory tree.
or even see that the file system is mounted?
They're going to be able to see that the filesystem is mounted. For example I can run
df as a non-privileged user:
[jxd87@xxx ~]$ df -hP Filesystem Size Used Avail Use% Mounted on /dev/mapper/VG00-LV00 1.5G 438M 966M 32% / tmpfs 64G 0 64G 0% /dev/shm /dev/sda1 194M 93M 92M 51% /boot /dev/mapper/VG00-LV02 1.9G 252M 1.6G 15% /opt /dev/mapper/VG00-tmp 740M 451M 252M 65% /tmp /dev/mapper/VG00-LV04 1.5G 826M 578M 59% /usr /dev/mapper/VG00-LV01 1.5G 1.1G 307M 79% /var /dev/mapper/VG00-log 740M 107M 595M 16% /var/log /dev/mapper/VG00-audit 740M 31M 671M 5% /var/log/audit xxx:/ifs/rc170 200G 135G 66G 68% /home/rc170 xxx:/ifs/dco 200G 135G 66G 68% /home/dco xxx:/ifs/jad87 200G 135G 66G 68% /home/jxd87