Arch Linux

freetoken

Member

Registered: 2014-09-16

Posts: 4

[Solved] Decrypt files securely inside lxc container.

Hi, this is my first question, I've been using Arch for 5 years now, thanks for all your hard work!

I'm trying to setup an lxc container to securely view encrypted files(gpg keys encrypted with cryptsetup and a loopback device), I've done so already using cryptsetup, the only issue is that after I decrypt the device from inside the container, it is available from the host as /dev/mapper/name and I can mount it and view it's contents.

Is there any way to set cgroups to deny host and allow lxc container to access this device, maybe I can change /dev permissions so only root on host can access? I would prefer that not even root on host can access it but I know I'm asking too much, I can do this with qemu or other VMs but there is a lot of overhead.

If you happen to know of any way I can access files from inside lxc container but block access to host even if it is after mounting the device, I would like to hear you out.
I'm running an archlinux host and archlinux lxc container with grsecurity-pax enabled.

Feel free to ask any questions if it's not clear .
Thank you for your time, and kudos for your great work with this distro.

Last edited by freetoken (2014-09-18 07:57:46)

freetoken

Member

Registered: 2014-09-16

Posts: 4

Re: [Solved] Decrypt files securely inside lxc container.

Alternatively is there any way to make the ssh daemon not show the device, cgroups maybe?.

Thanks

freetoken

Member

Registered: 2014-09-16

Posts: 4

Re: [Solved] Decrypt files securely inside lxc container.

Progress!

 $ ls -la /dev/mapper/name
 lrwxrwxrwx 1 root root 7 Sep 16 09:21 /dev/mapper/name -> ../dm-0
 $ ls -la /dev/dm-0
 brw-rw---- 1 root disk 254, 0 Sep 16 09:21 /dev/dm-0
 $ rm /dev/mapper/name
 $ rm /dev/dm-0

voila!

The device is still there but it's not visible and user would need to have root permissions to run mknod and restore dm-0.
Also very interesting read about cgroups for anyone interested: https://www.kernel.org/doc/Documentatio … groups.txt

I'm wondering if there is any damage from doing this, since the data is backed up I guess I don't care too much and will test it for a while.

If anyone has any ideas or knows some cool feature I'm missing let me know.

Will mark as solved in 24 hours after more testing and in case something unexpected happens.