How to limit ecryptfs access to a group of processes

Question

I would like to have a script that does the following:

1. Mounts an encrypted directory using ecryptfs
2. Sets up permissions so that only a bash shell launched by it and any processes inheriting from there can access the directory.

If needed, the script can be run using sudo so it has permissions to do the mounting and setup.

The idea is that I have a few trusted programs that I want to use to process data that is stored in an encrypted directory. I wish to protect the data from other programs on the system.

However, I want the trusted programs to be able to access my home folder normally and files written by them outside the encrypted directory to be available to any application. So running the program as a different user does not seem to help.

So far I've looked into SELinux and cgroups. Of these, cgroups seems to be closer to what I want because it automatically inherits the permissions. I guess I could set up two cgroups, "trusted" and "untrusted", where "untrusted" would be the default containing all tasks. However I have found very little information about how to restrict file access using cgroups and I'm not sure if it is really possible in the way I want.

So, how to limit ecryptfs access to a group of processes?

Answer 1

Following a related question, I found the tool unshare which I was previously unaware of and which does exactly what I want.

The following script is what I came up with:

mount_privately.sh:

#!/bin/bash
sudo unshare -m /bin/bash -c "mount -t ecryptfs $1 $2; su $USER; umount $2"

Example usage:

user@localhost:~$ ./mount_privately.sh backing_dir secure_dir
Passphrase: ...
user@localhost:~$ # secure_dir is now a

It seems that it might be possible to accomplish this without root also, but this is good enough for me.