I have a process which I would like to have access to an encrypted file system. This is very easy to do with EncFS, but this requires a user mounting the encrypted file system, therefore giving any user who has access to the mounting user access to the data, e.g. root.
Is it possible to have the process mount the file system so that only it has access to the data? If not, is there another way to prevent those who do not know the passphrase from accessing the data?
What Gilles said is correct, you can't prevent root from accessing the mount. It may not be able to access the mount directly (without the fuse allow_other option), but it can always switch to that user.
However, what you can do is lazy unmount the mount after the process has changed it's current working directory into the mount point. Once the process is inside the mount point, you can do a lazy unmount. This will prevent any new processes from being able to access the mount point, but processes which were running inside it will continue to have access.
encfs /enc/source /enc/target
( cd /enc/target && some_long_running_process) &
fusermount -uz /enc/target
some_long_running_process, and any children processes it spawns off will have full access to the mount point. But if anything not a child of that process tries to access the mount, it'll just get an empty directory.
Note that there is a brief window where the mount point is available, in which something else can change directory into it, but the window is very small if scripted.
Also note, there are still a few ways root could gain access to the mount point, but they're not simple, and are very hackish.
Well according to this Q&A titled: encfs with expect access denied it sounds like even root can not access EncFS if a particular user did the mounting.
excerpt
But it looks like you used your regular user to mount the encrypted directory, and then you are trying to see the mounted files with root using sudo. That will not work, and is the whole point of encfs.
In your example the directory cr is the storage used by encfs. The content of this is no big secret, it's encrypted data. You are mounting this data on mn, so that you can see its contents in a human-readable way, as files under mn.
Only the user that mounts cr will be able to read what's inside mn. Not even root can.
But to the more savvy user, there is nothing keeping root from just doing a su - <user> and becoming that user, so that they can access the mounted EncFS share.
As has been said many times on this site, there is nothing you can do to stop root from accessing anything that's local to the system. That's just how the system works. The same can be said for the Administrator on a Windows System.
Only the mounting user can access the encfs filesystem. Even processes running as root get a “permission denied” error; of course, they can switch to the mounting user and then access the data.
It is impossible to make data inaccessible to root. By definition, root is all-powerful and has access to everything. You can no more prevent root from accessing files than you can prevent God/Santa/your parents/…¹ from knowing what you did yesterday night. If you don't trust a user, don't give them the privilege to run commands as root.
¹ Pick whichever is applicable.
