There's an scenario that I'm worried about, and I'm not sure if it's possible to archieve. I got a machine with this setup:
- A LUKS-ciphered main system partition.
- An user with sudo access (added to sudoers list).
- The sudoer canno't log in as root (since he doesn't know the password), also - canno't do "sudo su".
- I got, as sysadmin, root access.
The question is: can I prevent or deny somehow the sudoer user from changing the LUKS Master Key?
I can deny him from executing dm-setup or cryptsetup, but he could always move and rename the files, or he may could download some library and program himself an application to change the MK. I don't know if there's something to prevent him from execute a linux action from kernel level, which dm-setup/cryptsetup interfaces to.
So, if I give sudoer access to an user, is there any way to keep the LUKS Master Key unchanged?