Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

For better compatibility and performance in games I'm thinking about installing Windows additionally to Linux. I have security concerns about this, though.

Note: "Windows" in the remaining text includes not only the OS but also any software running on it. Regardless of whether it comes included or is additionally installed, whether it is started intentionally or unintentionally (virus, malware).

Is there an easy way to achieve the following requirements:

  • Windows MUST NOT be able to kill my linux partition or my data disk
    • neither single files (virus infection) nor overwriting the whole disk
  • Windows MUST NOT be able to read data disk (-> extra protection against spyware)
  • Linux may or may not have access to the windows partition
  • both Linux and Windows should have full access to the graphics card
    • this rules out desktop VM solutions
    • for gaming I want the manufacturer's windows graphics card driver

Regarding Windows to be unable to destroy my linux install: this is not just the usual paranoia, that has happened to me in the past. So I don't accept "no ext4 driver" as an argument. Once bitten, twice shy. And even if destruction targeted at specific (linux) files is nearly impossible, there should be no way to shred the whole partition. I may accept the risk of malware breaking out of a barrier (e.g. VM) around the whole windows box, though.

Currently I have a system disk (SSD) and a data disk (HDD), both SATA. I expect I have to add another disk. If i don't: even better. My CPU is a Intel Core i5, with VT-x and VT-d available, though untested.

Ideas I've had so far:

  • deactivate or hide other HDs until reboot at low level
    • possible? can the boot loader (grub) do this for me?
  • tiny VM layer: load windows in a VM that provides access to almost all hardware, except the HDs
    • any ready made software solution for this? Preferably free.
    • as I said: the main problem seems to be to provide full access to the graphics card
  • hardware switch to cut power to disks
    • commercial products expensive and lots of warnings against cheap home built solutions
    • preferably all three hard disks with one switch (one push)
  • mobile racks - won't wear of daily swapping be a problem?
share|improve this question
    
Simple solution would be to wait for the Windows 8 To Go and use that. Just format your internal drives in a way they cannot be read by Windows. –  Ramhound Mar 30 '12 at 12:14
    
And what prevents Windows 8 or any malicious software running on it to reformat the whole disks, deleting my data and linux installation in the process? –  user1252434 Mar 30 '12 at 12:17
add comment

5 Answers 5

up vote 1 down vote accepted

After upvoting kotekzot's answer and jet's comment here is the ultimate solution: buy a plain-old front-rack. Sorry, since shopping recommendations are forbidden I won't suggest you a specific brand.

Simply mount the system disk in the rack and swap at necessity. Since these things are cheap, you should consider buying two twin racks, because every model requires you to mount the disk in its unique enclosure that can be extracted at any time. So if you have a single rack and two enclosures you can swap disks at any time. Obviously be aware that if there are any other disks mounted on your desktop the OS has full access (super user principle) to all of them.

To run Windows in a way that it cannot access Linux partitions even after being infected by the worst malware ever, an alternate would be virtualizing, but obviously you won't get direct access to video card and gaming performance.

share|improve this answer
1  
I thought about that. I assume "front rack" is what I found to be named "mobile rack" in English: cases to convert regular HDDs into removable drives. About virtualizing: I've read Xen has made some progress in passing through a secondary graphics card. Though still far from what I'm looking for, it is technically possible. In my case a minimum host OS does not actually need the graphics card itself and could just pass the primary one through to the guest. –  user1252434 Mar 31 '12 at 15:41
    
@user1252434 exactly the kind of case that I meant –  djechelon Mar 31 '12 at 19:24
    
I've accepted your answer. It's not the level of convenience I had hoped for but it has the level of protection I want and is a fair compromise on comfort. –  user1252434 Apr 3 '12 at 7:15
add comment

the kernel will always have raw access to the disk controllers and so to the disks.
And so be able to damage the other OS by destroying partitions.
While some disabling in the bios might hide the disks from the OS (this was possible on old ATA controllers but i doubt this is possible on SATA).

so the short answer is no it is not possible on the level you want.

share|improve this answer
add comment

if you have easy physical access to the hardware, unplugging the data cables from the HDDs you don't wish to be accessible would be the simplest and most reliable solution. I am not aware of any virtualisation products that would suit your needs, and disabling a drive in the bootloader doesn't guarantee it will be unavailable to the OS. You could try disabling them in BIOS, but again, no guarantees it will stick.

share|improve this answer
    
Unplugging the disks is certainly secure enough. I am hoping for a solution, where I don't need to open my box twice a day, though. ;) –  user1252434 Mar 30 '12 at 12:01
    
See if you can disable a drive in BIOS and get it to stick when you boot to an OS. –  kotekzot Mar 30 '12 at 12:03
    
I can try that later, I'm currently not at the PC in question. However, I cannot test windows behaviour, as I don't currently own one. –  user1252434 Mar 30 '12 at 12:15
2  
if you have eSATA port you can plug "Linux" disk there –  jet Mar 30 '12 at 12:28
add comment

I was just reading about something like this.

The key statement from that article:

If you have multiple operating systems installed on your machine, each one thinks that it has control of your computer.

Don't put your Windows partition into /etc/fstab and format your Linux partitions with a file format Windows can't read (any extN will do). That should take care of the most common things that could go wrong.

If something on either installation is able to accidentally mess with your partition data, then you're using your system incorrectly.

share|improve this answer
    
Admittedly, when I had my linux partition (ext2!) destroyed after using windows way back in the past, it probably wasn't even windows' fault. However, I HAVE experienced, that these things DO happen. Re "accidentally": windows won't be able to read the partition table of my data disk. I'm afraid it might ask me to partition it which I might accidentally accept. Less "accidentally" I am also afraid of getting infected by malicious software, that overwrites my data at partition level, circumventing windows' filesystem code. –  user1252434 Mar 30 '12 at 12:32
add comment

Disable the device itself, I dont think many viruses would think anyone has driver disabled one of the drives.
Un-Mount the device, Hidden the partiton, all seem like viable options on either system, until virus makers get wind of it as a thing to do , then they will make arrangement to adjust thier crapware.

"carts" cartraging a drive in a bay enclosure , the connections on some of them are robust, connecting and disconneting a SATA (over and over again) on the actual drive, would not be so robust, but most cart systems the re-connecting is done between the frame and the cart, those parts being cheaper to replace than the drive.

I have tried the power off method with PATA, and it didnt work well at all, I have not yet tried it with SATA, but it brings back memories of the whole system freaking out when the power to the drive stopped. And removing only the 12V (the motor power) the system would still see the HD controller board, and lockups at startup or during run. Need to try that again.

Security and Protection? Because virus can do things even with all the secuity and protection, the "type" that would be desired would be some strange lesser used stuff, not a common system protection method, that would be a known. Anything done manually by a user might be more secure than known security.

After the main and important data drive is disconnected, that would still leave, having a Image backup of the sacrificial System drive and MBR, so it can be returned to a previous state. Having a couple of images as things are added, for that virus type that takes its time , slyly hiding in wait for a few days so it is not noticed. Having those backup images on a removed drive, or passed over to another computer (or even the cloud).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.