It looks like i found a way to allow only single application to access files in USB storage. This script must be run with sudo.
#!/bin/bash # create namespace unshare -m<<EOF # mount device in namespace mount -U "UUID-here" "/home/$SUDO_USER/hidden" # run unprivileged application sudo -u "$SUDO_USER" application # unmount device umount "/home/$SUDO_USER/hidden" EOF
Obviously automounter must not mount this device.
Is it possible for other applications (except 0day exploits) run by user to read files from namespace?