I’m trying to model & implement a transparent file-based per-process encryption solution for linux. I want each process have its own files encrypted. I want to block firefox from reading my gpg private key for example (let’s say my priv key is not encrypted by default)
Currently is as follows:
- Hook the syscall wrappers (through a library injected with
LD_PRELOAD
globally) for file access (open, openat, read, write, creat, close) and check if the path to be access is covered by the encryption (for example ~/.mozilla). if the path is not called, regular function is called. - Ask the key manager (a privileged daemon) for keys through a unix socket
- Encrypt (on write/append/create) or decrypt (on read) the data
My questions are:
- I’m using recvmsg/sendmsg to find the pid that asked for a key. Can an adversary tamper with it?
- I’m using
/proc/*something*/exe
to find the path of the pid’s executable. is that safe (can a process fake it?) - The key manager gives the same key to processes with the same exec path and uid. is there a better way to model it?