Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I am a bit unsure about how ubuntus encrypted home folder works compared to a truecrypt partition (which is what I have used before). When I am logged in, will other users on my computer be able to access the files in my encrypted home folder?

share|improve this question

2 Answers 2

up vote 4 down vote accepted

If you enable Ubuntu's Home Directory Encryption, your $HOME directory will have permissions 700 (rwx------) when its mounted, and permissions 500 (r-x------) when it's not mounted. This meaning that you are the only non-root user who will be able to read/write/browse your home directory when its mounted. And when it's not mounted, you'll be able to read/browse, but not modify the contents of your home directory. This is intended to prevent you from inadvertently writing unencrypted data to your home directory.

This is in contrast to the default Ubuntu Home Directory permissions, which are 755 (rwxr-xr-x). That permission allows any local user on the system to read and browse your home directory. This default was chosen for Ubuntu long, long ago in the interest of "sharing" and "openness".

These are called Discretionary Access Controls (DAC), and come from the earliest days of UNIX itself.

The root user (perhaps via sudo as you mentioned above), is privileged in a way that allows them access to any file or directory, regardless of the DAC permissions in place. That means that yes, while your home directory is mounted, the root user is able to browse your home directory.

However, when your home directory is not mounted, the root user would need your login passphrase (or, more specifically, your randomly generated mount passphrase) in order to mount and decrypt your data.

In general, the encrypted filesystem that we use (eCryptfs) is intended to protect your data at rest on the hard drive, rather than protect you from your own root user.

Full disclosure: I am the author of Ubuntu's Encrypted Home Directory feature, and the current maintainer of eCryptfs.

share|improve this answer
1  
Great! Thanks for the explanation of the thoughts behind the system. I have been wondering why the default permissions are 755. –  Leo Feb 24 '12 at 16:42

In principle they can, but the default permissions on the home directory (rwxr-x---) forbids that.

share|improve this answer
    
So, if the other users have root (sudo) access? –  ams Nov 25 '11 at 14:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.