2

I'm new to ecryptfs and I need some clarification on how it works.
Suppose there are two root users userA and userB, If I mount some folder under userA:
[userA@Dev] $ mount ecryptfs real img
now I can visit the img folder to access decrypted data.

My questions is:
While userA is still in log in state. Can userB login and access the decrypted data? This is currently what I observed on my local machine, but I'm not sure if it was cause by my misconfiguration. If it is the case, how can I avoid other users from accessing the decrypted data while userA is in login state?

Improve this question

1 Answer 1

Reset to default
2

Yes its possible to access other users decrypted data, since eCryptFS does not distincts who is accessing a file. eCryptFS only manages the encryption/decryption of the files on the disk. As soon as it is mounted, any permitted user can read/write encrypted files transparently.

However, Linux has other technics to define access to a file or directory: E.g. the POSIX file permissions. So its highly recommended to simply restrict access to a private directory to only the user who has the key to it...

chown -R user ~/Private
chmod -R 700 ~/Private

There is also a FAQ entry: http://ecryptfs.sourceforge.net/ecryptfs-faq.html#no-ecryptfsac

Improve this answer
1
  • An other approch to encrypt /home is LUKS, now (2017+++) recommanded and default choice of Debian. I personnaly don't understand how it can fit a multi user acces need, which is very common on laptops, furthermore when there is the «guest» account. But keep in mind that if you have the device in front of you, you can change and access the root password. So which choices left if you can't rely on root… maybe LUKS, yes.
    – Sandburg
    Oct 20, 2019 at 11:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .