3

If a user mounts an encrypted file system, is it possible to limit the visibility of that file system such that other users are not able to view it or even see that the file system is mounted?

  • 3
    en.wikipedia.org/wiki/Cgroups#Namespace_isolation on Linux Kernel there are namespaces, you can hide mounts and other resources. It is often used with cgroups to create light weight virtual machines (Then all OSes use same kernel). But could also be used for what you are trying to do. – ctrl-alt-delor Jan 26 '15 at 22:55
  • unshare -m ... – mikeserv Jan 27 '15 at 1:05
  • @richard I think you should add this as an answer. I will accept it. I prefer your approach. – Safayet Ahmed Jan 27 '15 at 19:18
1

I can not tell you how to do it, but namespaces is the way to go. These are new-ish. the Linux kernel supports them, and I think I heard that they are in some other kernels.

en.wikipedia.org/wiki/Cgroups#Namespace_isolation on Linux Kernel there are namespaces, you can hide mounts and other resources. It is often used with cgroups to create light weight virtual machines (Then all OSes use same kernel). But could also be used for what you are trying to do.

Be careful, when I played with them, I needed root privileges to use them (this is not strictly true see capabilities — fine grained privileges, to do what traditionally required root). Therefore any tool that you create should drop these privileges/capabilities when it has done setting up the namespace.

2

is it possible to limit the visibility of that file system such that other users are not able to view it

The same rules apply as if it wasn't on an encrypted system. Encryption just changes how the on-disk structures are finally stored.

That means that the normal ACL controls are still going to be in effect, just going through an added layer where something has to decrypt the filesystem. If the users have read/execute permissions to the filesystem directories then they'll be able to access it like normal.

The exact steps to implement that vary between the filesystems you can choose to encrypt. On ext3/ext4 filesystems, for instance, you can remove world read/execute from the mount point and just setfacl as appropriate to give the users the desired level of access to that particular directory tree.

or even see that the file system is mounted?

They're going to be able to see that the filesystem is mounted. For example I can run df as a non-privileged user:

[jxd87@xxx ~]$ df -hP
Filesystem                                                                        Size  Used Avail Use% Mounted on
/dev/mapper/VG00-LV00                                                             1.5G  438M  966M  32% /
tmpfs                                                                              64G     0   64G   0% /dev/shm
/dev/sda1                                                                         194M   93M   92M  51% /boot
/dev/mapper/VG00-LV02                                                             1.9G  252M  1.6G  15% /opt
/dev/mapper/VG00-tmp                                                              740M  451M  252M  65% /tmp
/dev/mapper/VG00-LV04                                                             1.5G  826M  578M  59% /usr
/dev/mapper/VG00-LV01                                                             1.5G  1.1G  307M  79% /var
/dev/mapper/VG00-log                                                              740M  107M  595M  16% /var/log
/dev/mapper/VG00-audit                                                            740M   31M  671M   5% /var/log/audit
xxx:/ifs/rc170  200G  135G   66G  68% /home/rc170
xxx:/ifs/dco    200G  135G   66G  68% /home/dco
xxx:/ifs/jad87  200G  135G   66G  68% /home/jxd87

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.