5

What exactly happens when an application deletes a file?

Is there any way to control this behavior? Basically I want to shred instead of rm in all cases, but of course applications do not make calls to rm, I am guessing they interact directly with the kernel?? Would I have to modify the kernel to implement this feature?

Improve this question
8
  • 3
    Deleting a file ends up in the kernel's unlink system call (man 2 unlink). When you try to intercept that one, you need to watch out for specials (link count, file is still in use) before starting to wipe it.
    – ott--
    Commented Feb 26, 2013 at 15:28
  • @ott-- you should put this as an answer below. I was just about to submit something similar to this, and then saw this.
    – sparticvs
    Commented Feb 26, 2013 at 15:43
  • 1
    I'd suggest that instead of writing your own fs, or attempted to do this in the C library somehow, patch an existing filesystem. E.g., maybe take a look at lwn.net/Articles/462398
    – derobert
    Commented Feb 26, 2013 at 16:03
  • 1
    What are you trying to achieve? For journalling filesystems, shredding data is well nigh impossible; same for SSDs.
    – Deer Hunter
    Commented Feb 26, 2013 at 16:19
  • @derobert nice link, I guess I'm not the only person to have thought of this
    – jsj
    Commented Feb 26, 2013 at 16:19

3 Answers 3

Reset to default
4

Rather than trying to intercept all filesystem calls, what about encrypting the filesystem your data is stored upon? Then, all of your data gains the benefit of being securely encrypted, including that which was deleted.

Improve this answer
3
  • 1
    Encryption is vulnerable to social engineering. But yes I get your point.
    – jsj
    Commented Feb 26, 2013 at 14:58
  • 2
    @trideceth12 Not encrypting is vulnerable to technical engineering. shred is useless in most circumstances.
    – Gilles 'SO- stop being evil'
    Commented Feb 27, 2013 at 1:14
  • Okay from research it seems the consensus position is to encrypt the sensitive info separately, and then destroy the key when the information is to be deleted. This prevents being compelled to reveal the key.
    – jsj
    Commented Feb 28, 2013 at 0:20
2

You would have to go in to the C libraries as well as the filesystem kernel modules in order to catch all cases. Applications most often call a library routine that then calls a routine inside the filesystem module.

In short, the only reliable way to control this behavior is to write and use your own filesystem. I don't think you want to go there - I know I wouldn't.

Improve this answer
1
0

The chattr s attribute might work on ext4-filesystems. I did not bother up until now.

I used wipe in important cases manually up until now.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .