Do linux kernel have a feature that can be used to hide an area of hard disk (e.g last 1GB of hard disk) from root user or at least make that area completely unwritable by any means?

  • 2
    Who - if not root - should introduce that feature? That "user" could circumvent it as well... – RudiC Dec 3 '18 at 10:44
  • Depending on what the puprose is, one could possibly do it (whatever it is) by other means. – Kusalananda Dec 3 '18 at 10:59
  • Unreadable stored data at rest, yes (encrypted filesystem using an external key, such as a Yubikey)... unwritable, no, not normally. However, once the user decrypts the filesystem, then root can access the data as well. – RubberStamp Dec 3 '18 at 12:54
  • 1
    @RudiC The kernel programmer and one which configures it has more power than root user. perhaps you misunderstand my question or my wording is ambiguous. – gopy Dec 3 '18 at 13:18
  • @gopy Do you want to protect it from root only during runtime, or during early boot as well? Do you want to protect it from the root user on another computer that has the hard drive plugged into it? – forest Dec 24 '18 at 5:07

The ATA specification has something called Host Protected Area.

This means that the capacity of the device is artificially made less than the full capacity. The area above the reported maximum LBA is this Host Protected Area, and can only be accessed after sending a special command to unlock this area.

This is typically used for storing recovery data, so that the user can't accidentally repartition the disk and wipe out the recovery partition; it's not a partition, after all. My IBM Thinkpad from 2004 implemented this, and it worked quite well.

This may be useful for your application.

  • 1
  • @RubberStamp Unless you use mandatory access controls to restrict root. – forest Dec 24 '18 at 4:22
  • @forest ... by definition, the root user can change everything. You'll need to give a tested and repeatable example rather than an unqualified declarative statement. – RubberStamp Dec 24 '18 at 4:29
  • @RubberStamp That is incorrect. The root user runs in ring 3 as a regular user, and only has powers via POSIX capabilities. In other words, it only has powers by default because the kernel (which runs in ring 0) trusts it. It can be easily restricted with mandatory access controls which disable this trust. This is common on secure server configurations. Please look into how SELinux works, for example. Or look for any of the numerous examples on Information Security. – forest Dec 24 '18 at 4:33
  • @forest ... you need to give a clear, tested, and repeatable example. The root user has access everything, including the SELinux settings. There's no way to hide the settings file... which can simply be overwritten if need be by the root user, regardless of any and all permissions... and, no, pointing to another StackExchange is not a clear, tested, and repeatable example. – RubberStamp Dec 24 '18 at 4:36

No, the root user is always able to write to a block device, unless the controller of the block device determines that an area is read-only. Example: when you flip the read-only switch on an SD card, the SD card controller doesn't allow writing. There's flash memory devices with read-only partitions e.g. in your phone or TV to contain decoder keys.

For consumer hard disks you'd have to modify the firmware, otherwise root can access every byte.

  • Can a controller make a particular block read only or it can make only full device read only? – Prvt_Yadv Dec 3 '18 at 12:22
  • The controller is a microchip on the storage device. E.g. the controller on an SSD keeps track of broken sectors and usually prevents you from writing to them, and those sectors may not even be visible to the host device. – Stefaan Ghysels Dec 3 '18 at 13:04
  • How about writing a new driver for the hard disk and forcing user space programs to use this driver? (I don't know how) – gopy Dec 3 '18 at 13:22
  • 1
    You could make a device (e.g. a consumer NAS) and supply it with an OS with a custom driver that limits writing to part of a block device. However a root user can unload that kernel module and load his own OS or kernel modules as he likes. – Stefaan Ghysels Dec 3 '18 at 13:34
  • @StefaanGhysels You can set kernel.modules_disabled=1 to avoid that. – forest Dec 24 '18 at 4:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.