Permissions only protect against other users of the system, who access the system through normal software means. They are totally useless against someone who has access to the hardware, only encryption can protect against that. Setting permissions is like writing “secret” on an envelope; it works if the operating system is the only entity that's manipulating the envelope, but not if the attacker has stolen the envelope.
Places where sensitive files are likely to end up include mainly:
- the swap area;
/tmp (if it isn't in RAM);/var/tmp (but few programs write there);- email and printer (and possibly other) spools under
/var/spool;
- possibly some information in
/etc, such as Wifi passwords.
It's difficult to be sure to cover all the sensitive files; to be safe you'd need to encrypt all of /var. Furthermore there's no simple way (nor even a mildly advanced way) to put system files under ecryptfs: ecryptfs is fundamentally oriented towards encrypting a single user's files. While it isn't mathematically impossible, I wouldn't recommend attempting it unless you know what to do when it breaks (and it will break); it's one of these if-you-need-to-ask-then-don't-do-it things. I wouldn't do it, I'd encrypt the whole system instead.
You can encrypt the system after installation, but it isn't easy. The basic idea to boot from rescue media, shrink the existing partition to span less than the whole disk, move it to the end of the disk, create an encrypted container in the now free beginning of the disk, create an LVM volume on it, create a filesystem, move the files from the plaintext area, resize the plaintext volume to be small (~200 MB), move /boot to the plaintext volume, extend the encrypted container and the LVM volume to the whole disk, make some swap space again, enlarge filesystem, mount the plaintext volume under /boot, and reinstall Grub and regenerate the initramfs. (I hope I didn't forget anything…)
If you're concerned about sensitive files outside your home, reinstalling would probably be easier.
An easier compromise would be to make /home an encrypted volume, rather than encrypting your home as a directory tree. (This may also slightly improve performance.) The basic idea is:
- Boot from rescue media.
- Shrink the existing filesystem and containing partition (
ext2resize, parted).
- Create a dmcrypt volume in the freed space (
cryptsetup).
- Make two LVM volumes on the dmcrypt volume (
pvcreate, vgcreate, lvcreate × 2), one for swap (mkswap) and one for /home (mkfs).
- Mount the volume for
/home and move /home there.
- Update
/etc/fstab and /etc/crypttab.
- Now you can move other sensitive directories (e.g. printer spool) to
/home, and make a symbolic link to follow them.
- To protect the sensitive files that you just erased, wipe the free space on the plaintext volume.
