lkml.org 
[lkml]   [2000]   [Feb]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: Userland encrypted filesystem that root cannot access.
From
** On Feb 21, H. Peter Anvin scribbled:
> Grendel wrote:
> > >
> > > While mounted? No. Root has access to the entire machine and
> > Why not? Just never decrypt data on fs read. Feed the client with encrypted
> > data and leave it to them to decrypt it.
> >
>
> Then it's not an encrypted **FILESYSTEM**. Application level encryption
> is a whole other matter. Even so, root can intercept the client process
> and read the data out of its memory.
The file system can have two modes of operation: encrypt only,
encrypt/decrypt. In the first mode the data written is encrypted but data
read is sent as-is to the client which must take care of the decryption
process. The first mode eliminates the other possibility you mentioned of
intercepting the user's process in case when that process is running on
another machine and data is transferred encrypted. It might seem that having
a file system that only encrypts written data makes little sense, but I
think that it would have its use in situation Mike described - nobody, even
root, wouldn't be able to read anything from the FS - it would be like a
black hole. Of course, it would require an userland implementation of the FS
driver as well to read the FS data or the FS would have to be exported using
nbd, for example, and mounted on the other (secure) machine in
encrypt/decrypt mode. With the assumption that the workstation mounting the
FS is used only by authorized personnel, the entire affair is completely
secure.

marek
[unhandled content-type:application/pgp-signature]
\
 
 \ /
  Last update: 2005-03-22 13:56    [W:0.759 / U:0.016 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site