Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My home directory is encrypted with ecryptfs. I booted and logged in straight into root. Root see my home directory before I log in, but it shouldn't, and it wasn't that transparent.

However, when I check /home, the myusername/.ecryptfs folder is there normally, and so is the .Private. So, it seems that encryption is there.


  • No changed passwords between the dates, so that isn't it.

  • It can be a coincidence, but I noticed that this happened after I used a common trick to dismiss the keyring asking for wifi password on login (the one you change the default keyring and leave wifi password as clear text).

My question is:

  • How can I make it hidden to root again without changing my user password?
share|improve this question
You should probably ask this as two questions. The first one is quite easy (boot from a live CD, boot in test mode). The second is quite complex. – Javier Rivera Aug 31 '11 at 14:20
Live CD, good idea, of course. Thank you. Do you happen to know the answer to the second, more complex part? – Strapakowsky Sep 1 '11 at 4:53
Suppressed the first question, the other was the important one. – Strapakowsky Sep 1 '11 at 5:44
No, sorry but I don't have enough experience to deal with it. I use encrypted folders, not whole partitions. – Javier Rivera Sep 1 '11 at 6:44
up vote 4 down vote accepted

eCryptfs does not protect your data from root. eCryptfs is only sufficient to protect your data at rest on the physical media.

After you've logged into the system as your user, your decrypted data is only protected by Discretionary Access Controls (DAC). This is generally enough to protect you against other non-root users on the system, but not root.

Also, are you absolutely sure that never entered your non-root user's password on this system after booting? Because the situation you describe is impossible -- root would never be able to see your decrypted data if you haven't logged in yet. This is how eCryptfs protects you against LiveCD attacks.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.