I am currently using archlinux, It is possible to boot on an archlinux installation iso for instance, to mount my current archlinux partition and my boot partition and then to use arch-chroot. Then I have access to a root shell in my archlinux system and I can for example install, uninstall things, change root passwd ...

The question is : How to protect from such a manipulation that doesnt require the root passwd to access a root shell ?

I think that there is something to do with disk encrytion.

Assuming that I protected my archlinux partition from chrooting, how does it work if I need to chroot into it ? I usually only do mount /dev/sdax /mnt mount /dev/sday /mnt/boot arch-chroot /mnt

Thank you !

  • You have to prevent physical access. Short of that, perform an encrypted install. – Panther Dec 30 '15 at 19:05
  • Ok but how does it work if I want to chroot into my system ? Is there a command asking for my root password to uncrypt the install ? – x4rkz Dec 30 '15 at 19:13
  • Yes - there are any number of tutorial on how to do this. Covered here - wiki.archlinux.org/index.php/Change_root – Panther Dec 30 '15 at 19:31

The problem is more general than the case described and isn't specific to chroot, archlinux or linux.

In the general case, if an attacker has physical access to the system, they can read/modify any data stored on the disk, whether by physical means (removing the disk and mounting it on their own machine, possibly replacing it afterward) or through software (boot into their own OS and read/modify data without restriction as described in the original question).

As you hinted, a possible countermeasure against this would be to utilize encryption. This prevents an attacker who doesn't have the key (file, smartcard, password, etc.) from meaningfully reading or modifying data.

An attacker who encounters an encrypted system and is unable to recover the key can read the encrypted data (looks random) and write data which is unlikely to be decrypted meaningfully (equivalent of writing random bits to your HDD). They could corrupt/destroy data by doing so, but otherwise shouldn't be able to install/uninstall programs or change passwords.

In the case of full system encryption, the decryption key is required at boot time. Once the system is unlocked, then you can chroot as usual (assuming you have the correct privileges).

The way that this protects you is that you need the key in order to make meaningful read/writes of data and once the key has been inputted and the system booted, the OS's security measures (user authentication, permissions, ACLs, etc.) should kick in to control access.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.