https://github.com/chrisduerr/homesec
Tools for running applications with isolated filesystems
https://github.com/chrisduerr/homesec
Last synced: about 1 year ago
JSON representation
Tools for running applications with isolated filesystems
- Host: GitHub
- URL: https://github.com/chrisduerr/homesec
- Owner: chrisduerr
- License: gpl-3.0
- Created: 2024-11-16T22:32:32.000Z (over 1 year ago)
- Default Branch: master
- Last Pushed: 2024-11-26T05:02:10.000Z (over 1 year ago)
- Last Synced: 2025-04-10T23:04:48.583Z (about 1 year ago)
- Language: Rust
- Size: 54.7 KB
- Stars: 5
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# Homesec
Homesec is a small Linux utility which uses user namespaces to isolate an
executable. It allows either discarding or encrypting all files an application
writes to the disk, while providing an escape hatch to manually persist files to
the real filesystem.
# Dependencies
To make use of the encrypted home directories, you must have [gocryptfs]
installed and in your `$PATH`.
[gocryptfs]: https://github.com/rfjakob/gocryptfs
# Usage
```text
Usage: homesec [-e] [-i ] [args...]
Run applications with an isolated filesystem.
Positional Arguments:
cmd command which will be executed
Options:
-e, --ephemeral use tmpfs as home directory
-i, --id persistent storage identifier (default: command's name)
--help display usage information
```
Inside the read-only root filesystem, you can get access to the original
writable filesystem at `/tmp/write-root`.
To execute `bash` without persisting any data, run:
```sh
homesec -e bash
```
To share the same encrypted home between multiple applications, run:
```sh
homesec -i shared bash
homesec -i shared sh
```
The encrypted directories are in the format `.homesec` and can be found at
`${XDG_DATA_HOME:-$HOME/.local/share}/homesec`.