Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Is it possible to prevent a root user (user space) from running dmsetup table --showkeys to dump the LUKS master key?
I know of the TRESOR patch which essentially prevents the key from persisting in memory, and for all purposes makes the key unreadable from anything but RING0. Does/can the dmsetup command override this?
(Contextually: if an attacker gets root on a machine, it'd be nice to prevent/make it harder for them to dump this key in case of physical attack)
No, not that I'd know of. You could maybe remove the dmsetup binary from the system and only keep it in the initial ram disk, which would be enough to set up the encrypted volumes when the machine booted, and then chroot the initial ramdisk out of reach in the booted system, but this would only be a stopgap measure. You might be able to improve on it with apparmor profiles a bit, but not make it watertight (especially not against a simple download of the binary from the network).
That said, Luks is designed to keep data confidential only when it is at rest. If you're trying to avoid having the luks key stolen while the container is in use, that will most likely turn out to be hopeless.
To expand on that a bit: Even if the dmsetup binary could be coaxed into not outputting the key, root would still have access to /proc/, which would allow him access to system memory, to the encryption and decryption etc. The only way to keep the key fairly safe would be to prevent the kernel itself having access to the key, and that's obviously not possible with just software.
