2

I am encrypting my /home partition and I would also like any secrets /root (not /) contains to be encrypted. Is the /root folder considered part of the /home partition by default, or do I need to explicitly add that folder to the encrypted volume? Thanks!

3

/root is normally on the root partition. It's meant to be available even if something goes wrong and other partitions can't be mounted.

Note that /root only contains what you put yourself. Sensitive data created by the system ends up under /etc or /var.

These days, with most CPUs having accelerated AES instructions, disk encryption is very cheap. So if you're concerned about confidential data outside of your home directory, you should encrypt the whole system except /boot. This is a good idea anyway because confidential data can end up in other places: wifi passwords in /etc, printed documents in /var/spool/cups, logs showing what wifi networks you connected to and when in /var/log, etc.

If you really want to encrypt only /home and not the whole system, which I repeat is not a good idea, you can make /root a symbolic link:

mv /root /home
ln -s /home/root /
  • 1
    Thanks! I am definitely not advocating adding secrets to /root, but in case some sudoer decides to do so, I want those secrets to be encrypted at rest. This works. – Chaim Eliyah Apr 18 at 20:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.