up vote 4 down vote favorite
2
share [g+] share [fb]

How to prevent data leak from /tmp without ramfs or tmpfs?

System files unencrypted is OK. My concern is that data coming from my encrypted home, internet browsing, etc, eventually touches the disk unencrypted because is written to /tmp by some applications.

Constraints:

  • Full disk encryption is not a solution because unattended boot is important for me.

  • tmpfs or ramfs are not solutions because I am short of RAM and sometimes my /tmp gets huge.

(I don't use swap. Short RAM is less bad than an old HD screaming while the user is desperate to actually use the computer.)

So, is there a simple way to configure automatic mounting of /tmp during boot in a way that files are written to the disk withoug leaving recoverable data after the computer is turned off?

Like ecryptfs with a random key for instance...

I'm using Ubuntu 10.10.

link|improve this question
You might want to look at setting up an encrypted LVM. – user78584 Apr 27 '11 at 15:04
Thanks for answering. Could you be more precise? I would like /tmp to have a new random key every time the computer boots, or something like that. Whether there is a primary or logical partition, or just a stacked filesystem, doesn't matter for me. Just that it doens't ask for input from the user and doesn't use swap. – user39559 Apr 27 '11 at 15:40
Why do you think you can't boot unattended with full disk encryption? – Mark Johnson Nov 12 '11 at 4:47
You need to provide a password to decrypt the disk, don't you? Otherwise, if it boots and loads the whole system without my intervention, how could system data be protected from my adversary and not from myself? I am unaware of such setup, please le me know if it is possible. – user39559 Nov 14 '11 at 15:57
feedback

3 Answers

up vote 1 down vote

May or may not work, but... you could try setting /tmp to not be writable by users, and set export TMPDIR="$HOME/tmp" (assuming $HOME is encrypted) somewhere that will be used in the env of all sessions (like, /etc/profile, perhaps?). I think many things should respect the TMPDIR environment variable, but all of them won't necessarily honor it.

link|improve this answer
feedback
up vote 0 down vote

You could try to run firefox in a selinux sandbox which will not only prevent /tmp from other users but will also prevent your home files from firefox :-)

Not sure how useful would that be on Ubuntu but after some customization works fine on my Fedora (15).

link|improve this answer
Sorry, I'm not worried about other users. My concern is that data gets written to the disk, in which case it can be recovered by someone having physical access to my computer. – user39559 Dec 2 '11 at 20:37
sandbox creates /tmp by default in tmpfs, but it has an option to create /tmp anywhere you want - for example in your encrypted home. – Martian Dec 4 '11 at 8:57
I see... thanks! But I would like it to be automatic, that all the applications behave the same except that what they write to /tmp doesn't reach my disk. It's not only for Firefox and it should be automatic, nor relying on the user remembering to call sandbox each time they launch an application. – user39559 Dec 5 '11 at 13:13
feedback
up vote 0 down vote

all the applications behave the same except that what they write to /tmp doesn't reach my disk

In order for data in /tmp to not reach the disk, you need to put it in RAM (ramfs or tmpfs). On the other hand, as those are not options for you, you have two more choices (with data on disk):

  1. Change the default shortcuts or create aliases to the commands you fear that can leak information, like for example:

    alias vi='sandbox -M -H sehome/ -T tmp/ vi'

    So the user (or you) shouldn't remember to run a sandbox every time the app is launched.

  2. Automatically empty /tmp when there are no more locked files in it (a cron job that could run every 1 to 30 minutes) or on logout. This is my personal choice:

http://www.linuxquestions.org/questions/linux-general-1/script-to-empty-tmp-folder-415361/

Add this line to your ~/bash_logout file. rm -rf /tmp/* 2>& /dev/null

Or, you could fiddle around using /dev/zero and dd to actually wipe the data from your /tmp

link|improve this answer
Thank you. But yet, I'm looking for something that works with all applications, without the need of an exaustive list of aliases. As for the auto-empty, in this case the data actually did touch the disk, even if it will be cleared afterwards (which depends on the storage technology etc etc). – user39559 Mar 2 at 18:48
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.