Use EncFS to encrypt files so that a particular user or process can access them, but root cannot

encfsencryptionfilesystemsrootSecurity

I have a process which I would like to have access to an encrypted file system. This is very easy to do with EncFS, but this requires a user mounting the encrypted file system, therefore giving any user who has access to the mounting user access to the data, e.g. root.

Is it possible to have the process mount the file system so that only it has access to the data? If not, is there another way to prevent those who do not know the passphrase from accessing the data?

Best Answer

What Gilles said is correct, you can't prevent root from accessing the mount. It may not be able to access the mount directly (without the fuse allow_other option), but it can always switch to that user.

However, what you can do is lazy unmount the mount after the process has changed it's current working directory into the mount point. Once the process is inside the mount point, you can do a lazy unmount. This will prevent any new processes from being able to access the mount point, but processes which were running inside it will continue to have access.

Example

encfs /enc/source /enc/target
( cd /enc/target && some_long_running_process) &
fusermount -uz /enc/target

some_long_running_process, and any children processes it spawns off will have full access to the mount point. But if anything not a child of that process tries to access the mount, it'll just get an empty directory.

Note that there is a brief window where the mount point is available, in which something else can change directory into it, but the window is very small if scripted.

Also note, there are still a few ways root could gain access to the mount point, but they're not simple, and are very hackish.

Related Question