I would like to have a script that does the following:
- Mounts an encrypted directory using ecryptfs
- Sets up permissions so that only a
bashshell launched by it and any processes inheriting from there can access the directory.
If needed, the script can be run using sudo so it has permissions to do the mounting and setup.
The idea is that I have a few trusted programs that I want to use to process data that is stored in an encrypted directory. I wish to protect the data from other programs on the system.
However, I want the trusted programs to be able to access my home folder normally and files written by them outside the encrypted directory to be available to any application. So running the program as a different user does not seem to help.
So far I've looked into SELinux and cgroups. Of these, cgroups seems to be closer to what I want because it automatically inherits the permissions. I guess I could set up two cgroups, "trusted" and "untrusted", where "untrusted" would be the default containing all tasks. However I have found very little information about how to restrict file access using cgroups and I'm not sure if it is really possible in the way I want.
So, how to limit ecryptfs access to a group of processes?