Encrypting user data on per-app basis?

[Alexander Larsson]

On Tue, Sep 3, 2019 at 4:47 AM Ryan Gonzalez <rymg19 at gmail.com> wrote:
>
> Apps already can't access each others data by default, even with --filesystem=home.
>
> On Mon, Sep 2, 2019, 5:59 AM Bastien Nocera <hadess at hadess.net> wrote:
>>
>> Hey,
>>
>> Would it be a good idea to encrypt each application's private store of
>> files and data in the user's home directory, when storing it on-disk?
>>
>> ext4 and some other filesystems allow per-directory encryption and
>> ~/.var/app/<app-id>/ could be marked to be encrypted pretty easily when
>> the directory is first created.
>>
>> This would avoid applications being able to access each other's data,
>> but I'm not certain whether decryption can be made so that the files
>> are only accessible within the namespace. I'm also not sure where we'd
>> store the keys in a way that didn't make it accessible to most apps.
>>
>> Any ideas?

Also, technically this is very hard to do atm, as the keyring used for
storing the decrypt key is not namespaced. Various approaches are
being talked about in the upstream kernel community to handle them,
some which allow per-container separate encryption and some which
don't (falling back to regular persmissions to handle separation of
containers). Its unclear what the future will allow us here.

-- 
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
 Alexander Larsson                                Red Hat, Inc
       alexl at redhat.com         alexander.larsson at gmail.com