I have the need for a company laptop (Dell e6540) that contains our java application on it to go out for evaluation purposes. For this reason I would like to make sure that the HDD is protected from customers (or anyone else) being able to take our java app off of the laptop and view the source. We have taken many necessary precautions and hardened the OS putting it into a custom "kiosk-like" mode.
My last obstacle is to get the key for disk encryption stored on the TPM of the Dell Laptop. This way I can have an encrypted disk without giving a customer the password/key. This has proven to be a nightmare so far under Ubuntu 12. All of the documents I find are at least 4-5 years old. The interaction of using LUKS with TPM-LUKS and Trousers is unstable on the newer linux versions (at best)
The requirements are Disk Encryption (either partition or FDE) without having to give the password to the users. Is anyone aware of a solution on Linux? This is seamless on Windows using BitLocker. I have offered up SecureDoc as a solution but they do not see their product as a good fit.
It uses luks encrypted volume which is widely supported and store the password/key within the TPM (NVRAM).
The key can be sealed (Trusted Computing terminology) against the proper boot sequence (BIOS, PCI ROMs, MBR, Boot Loader, etc). In other words, the key is derived from the running environment. If something change, the key won't be the same hence decryption of the volume doesn't work.
This is a security question because you really want a DRM solution. Let's ignore the fact that if they try they'll beat anything you use. ;) You just want to make it a pain to steal your stuff to deter casual attackers. Here's a ground-up solution for you:
Disable USB, networking, etc in BIOS to prevent injections or leaks via these. Just leave enough devices on to let them interact with the app locally. If it is a networked app, simulate that with an onboard client+server & disable networking hardware anyway. And password-lock changes to BIOS.
If having hard time with open stuff, use an easy-to-use commercial FDE product such as BestCrypt or PGP Whole Disk Encryption. Both support TPM's.
System should autoboot into limited privilege account that only can demo the software. You seem to have this part covered.
Use a RAMdisk or a low privilege temp folder for any persistent storage app needs during demo's.