The main goal: To protect any bootable disk (OS disk) from being accessed by attaching it to another system.

Many DVRs have their own filesystem, so if you would try to attach its hard dive to another system, the files there could not be accessed.

In Linux installation, are we able to make our own filesystem derived from, for example, ext4 or ext3, so any other Linux system would not be able to read the disk, so it (the hard drive) will work only as master and booting up the system?

By that way, any file/directory permissions will not be overridden by attaching the drive to another system and then using the sudo there.

The scenario explanation

A web application should be delivered to another company on a machine (PC) that will act as a server. We need to add extra layer of security for our code. On the OS we will restrict access to the application's files to www-data, the Apache user, and Apache will work as a service.

So in that company, just press the power button on of the server's machine, it will run the web server and serve the application, and for any reason they need to restart the server, again it will run again.

The basic idea, is to prevent any unauthorized trying of detached the drive and reattach it to another system to get the application's files. It is clear that encryption will not work smoothly like that way and need our contribution to restart the server.

  • 7
    Is there a reason why you don't want to just encrypt it instead? – Ignacio Vazquez-Abrams Jul 21 '18 at 19:04
  • 1
    There are, IMO, a couple of technical reasons why this isn't easy or feasible. None of them of course are related to Unix or Linux in particular, but more about security in general. The only part that's "opinion-based" or even close to it, is that the threat model the OP assumes will matter in deciding what measures are worth taking. – ilkkachu Jul 21 '18 at 19:27
  • 2
    Sounds like you're looking for a DRM solution. Denuvo is quite popular with some video game publishers these days... – Mioriin Jul 21 '18 at 19:52
  • 4
    I would recommend a TPM (Trusted Platform Module) based solution. The TPM module is soldered to the motherboard and can protect the disk encryption key, thus making it hard to decrypt the disk when moved to another machine. I don't think a pure software solution to your problem can be more than security by obscurity (embedded keys that can be found if you can guess where to look for them, or a custom file system that can be disassembled, etc.) See the "Disk Encryption" Wikipedia page. – Johan Myréen Jul 21 '18 at 21:13
  • 1
    AFAIK, the TPM only stores the encryption key and most modern PCs have the chip built-in – phuclv Jul 22 '18 at 4:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.