I have access to a shared remote computer from which I would like to run some code I have written which uses an interpreter (not a compiled code). I would like to protect this source code from other users who have root access to the remote machine. There are a variety of ways to make an encrypted folder in linux. I am not writing a lot of data to the disk so I am not worried about reduced I/O speed due to the encryption process, just mainly using many CPUs and a lot of RAM on this machine.

My question is, do any of these encryption options allow the data to be protected from the root user, when I am logged in and have the filesystem mounted? A main concern is if a cron job running as root does a backup, then the source codes are automatically copied to another filesystem without even realizing it and then it is no longer encrypted.

3 Answers 3


If you can access your data, root can access your data. You have to trust root!

Even if you access encrypted data on a remote machine, root can see it (you use the tools provided by root, right?).

You can only make it harder to access your files, but never impossible. If you want your data to be save, don't use untrusted machines.


You could run a Network Block Device server on the box, and crypt-mount that locally on your own machine, then the remote root would only see encrypted dataflow. But that way the remote box has no access to unencrypted data.

If the remote box is doing the decryption by itself, so it has access to the data on its own, then the remote root has also (ways of getting) access to it. It can't be helped.

You have to be able to trust whoever owns the box that runs your code.

  • I don't think the Network Block Device would do any good because I'm not trying to store or transfer much data to the remote machine.I am wondering if running a virtual machine on the remote machine would help. I could encrypt the filesystem on the virtual machine, and this decryption would be controlled by the virtual operating system. Feb 5, 2013 at 16:21
  • It may be possible that some of the data could be in the RAM on the remote machine that root could access, but I don't think they are going to have the sophistication or desire to access any meaningful data that way, and I don't think a backup program would accidentally copy the data this way. Feb 5, 2013 at 16:25
  • Does anyone see any flaws in using an encrypted virtual machine other than data in RAM potentially could be accessed somehow? Feb 5, 2013 at 18:22
  • In principle the problem remains the same regardless how sophisticated a software solution you employ. So you're betting on root not having the know-how necessary. Feb 5, 2013 at 19:27

Briefly, there are ways to obfuscate your activities from root (i.e. creating an encrypted file container, using non-local keyfiles to unlock it, and storing data on it) but ultimately if someone with root access is dead set on finding that information, it's just not that difficult (using strace on any process that accesses/decrypts your data, for example.) Please don't take this as innuendo, but if you have a legitimate reason to run code you truly don't want other people seeing, you really need to make a request for your own private machine.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .