This is a page where a developer of ecryptfs explains the difference between ecryptfs and dm-crypt: https://stackoverflow.com/questions/18230784/what-is-difference-between-linux-kernel-subsystem-dm-crypt-and-ecryptfs/18234635#18234635. However, this left me with a question, if ecryptfs only encrypts the /home partition, what stops a malicious hacker from modifying the / or /boot partition to maybe sniff the encryption password or modify a program, etc...

In short, how can I be sure that not only is my computer's data not able to be read by an unauthorized person, but also how can I be sure that nothing on my computer is modified without me knowing about it?

Also, where does this end because at some point, the booting code must be unencrypted in order for the processor to understand it? (Unless you use some sort of hardware decryption) But by definition, anything unencrypted can be modified?

(As a side point, I can see a way of determining integrity of the boot sequence by keeping a hash of the unencrypted part of the booting code in the encrypted part and on decryption comparing a the precomputed hash to a hash of the unencrypted part of the boot sequence at runtime. However, this doesn't solve the problem of having unencrypted areas, just a way to know after the fact if something was modified)


The short answer is "very little" stops a hacker from modifying /boot - really only time, undetected physical access and the ability to recompile initrd with a key logger.

Nothing stops a malicious hacker modifying an ecryptfs based / or /boot if they have physical system access - but see later - thats not what this is about.

"/" can be protected using full disk encryption like LUKS (but not, to my knowledge, per file encryption)- As the system is initially booted from /boot initrd can request the passphrase needed to unlock the volume prior to mounting /

I think you are overestimating the ability of full disk encryption - I put to you that it is designed to stop protect people against non-persistant threats, like a laptop being stolen, or when you want to RMA a hard drive with personal information - in both cases the data is of no further use to you, but you want to stop an unknown third party from accessing it - and, very often, file based encryption of your documents is adequate - who cares if they have an unencrypted copy of the system binaries - they are open source anyway.

You can't protect your system from unauthorised people with local access to it - so the solution to this is to prevent physical access. You can go some way towards ensuring things are not modified without your knowledge by checksumming your all your systems files and doing compares with an offline backup - this is not fullproof as you need to make sure you are running an unmodified checksum program - and one which makes collision hashes practically impossible to recreate. [ You may be able to simplify this if you seperate your filesystems and make some of them readonly, then keep a single hash for the each readonly partition ]. This whole process is cumbersome though.

When using full disk encryption "/" You would typically not use the computer as "root" except for upgrades etc - this provides a fair degree of

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.