Note: AlexP has answered the question perfectly in his comment on this post, waiting for him to post an answer so that I can mark it as solved. There are other some complementary useful info in the comment regarding what is actually being encrypted/decrypted.

I'm wondering if the root users home folder is encrypted with regular home folder encryption, and if so how does it work? Since home folder encryption encrypts/decrypts on login, is booting the system considered a root users login?

Reason to why I wonder is because I want to protect my virtual machines with encryption in an logged out state (for my normal user) and also protect them from copying in an logged in state, this I know can also be done with user permissions.

So: When user is logged in I can run the VM with sudo, the VMs cant be copied by an adversary if they get my computer logged in, and if I log out they are encrypted. The simplest solution to me right now seems to move the files from the root home to user home.

Sorry if this is a stupid question and I've missed something obvious. Best regards.

  • 1
    No it's not. Root should not have anything interesting in their home directory. And remember that on-the-fly encryption only protects data at rest. – AlexP Dec 26 '16 at 16:27
  • Thank you, this is a great answer so I really think you should post it so I can mark it:) The data at rest here meaning that if Virtualbox is running in the background, the data could potentially (disregarding permissions) be copied? If one process is using the data, i.e. virtualbox, is all the data in the home folder exposed or just the data being used. – elmak Dec 26 '16 at 17:10
  • Just the data being used or having been used. The other data are not decrypted. It is also important to check that the swap is encrypted, otherwise information can leak that way. – sudodus Dec 26 '16 at 18:29
  • Thank you both, very helpful and useful info. Best regards, elmak. – elmak Dec 26 '16 at 19:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.