Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to isolate certain folders from all programs except one, without creating a new user? A bit like a reverse sandbox. Specifically I want to protect the .bitcoin folder from being accessed except by the bitcoin client.

I'm thinking that perhaps something utilizing LSM could handle it.

share|improve this question
You would need per process security such as is provided by selinux's type enforcement. – Dan D. Feb 20 '13 at 23:39

I'm thinking that won't work either.

The only thing that comes to mind is a multi-step process involving encryption:

Use encfs to encrypt a directory

Then write a script that

a) mounts the encrpyed directory
b) runs bitcoin
c) unmounts folder after bitcoin exits.

Then only run bitcoin by calling this script.

This doesn't actually keep other programs from reading those files when mounted, but does ensure that when you don't have the encrypted folder mounted, nothing will be able to read those files (in a way what makes sense. they could still delete them or otherwise corrupt them). I believe encfs does ensure that other users, including root cannot access the mounted partition (that's a feature of fuse based file-systems), so that's not an issue.

More reliable would be a bitcoin client that did the encryption directly.

Or, perhaps, moving the bitcoin application into the encrypted folder so you simply couldn't run it unless the folder was mounted.

You could also fiddle with chattr +/-i to the encrypted folder (setting -i before mounting it, and +i after unmounting it) to keep other programs from modifying the files and it's not mounted.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.