Hello
I am trying to create a folder locking application .
In which if folder is locked.Only way to open that folder i by entering the password even root should not be able to open it.
Is it Possible

Any Guidance is Appreciated

Hi there,

not by using the standard Unix mechanisms. It's part of the design that the root user is granted access to any file.
If you want to lock out any user regardless of their privileges (including root), you might consider encryption instead of just denying access. That way, anybody may access the file, but it's just garbage without knowing the decryption key.

[X] Doc CPU

I don't think you can reach true security if your enemy is All Mighty Root Itself.

Even if you use encryption (openssl, cryptsetup, etc), All Mighty Root is the Owner of the Machine. He can install keyloggers to track your activities, perform "undelete" techniques on temporal folders and carry out many actions than will allow Him to discover what are you daring to do in His Holy Machine.

In short: if All Mighty Root is a skilled professional administrator, He will own your data if so is His will. If He is not, you can take the risks if and use encryption. I recommend dm-crypt plus an easy script to mount or umount it. At the end, it depends on your threat model and your adversaries.

Hi there,

if you're that paranoid, you'll never have anything near security unless you're root yourself.

But usually, the root user (administrator) should be considered a trustworthy person. If you don't have that confidence, you should look for someone else or run your own server. However, that requires a lot of knowledge and experience. A machine that is connected to the internet and operated by an unskilled admin is a potential threat to other services.

[X] Doc CPU

It depends. Sometimes I use systems which belong to an All Mighty Root who is a bastard, and I take precautions because of that. The fact that He is All Mighty does not turn Him into a good Owner.

By using a system that belongs to a Root who is not you, you are giving Him some trust. I just posted my paranoid message because I was assuming that karanace has reasons not to trust the Root Who Rules the System with His Limitless Powers.

If we are talking about a multiuser computer owned by an average family, I guess that most of the times He Who Rules the Operating System is not a real danger for the users even with His Supreme Wisdom and Domination capabilities. However, there are many reasons why information can leak into the hands of Root, not because He is spying on you, but because He is doing Maintenance. If He is using a packet sniffer to trouble shot a network, or reviewing the logs, or fixing a misconfiguration caused by an user by entering in his $HOME folder, there is a chance that He will discover information you preferred to be secret.

Root has full access to the kernel. The kernel has full access to everything. Therefore root has full access to anything.

Short answer: no

You could do things like encrypting the file, making it useless to root. But this is not secure as it is still vulnerable to the evil maid attack, where root+kernel are the evil maid. If you decrypt the data on the same machine, the evil maid's planted software can capture either the encryption passphrase, or the decrypted data.

If it's a file server or backup server and the data is already encrypted when it comes in, root isn't going to know what to do with it. It might give it back unchanged. It might mangle it but could detect that. It might throw it away, but you'd figure that out, too.

Hi there,

yes, and that's the important difference between the rights management in Linux and Windows. In Windows, the root user (or Administrator, for that matter) is subordinated to the kernel. There's the "Administrator" account that can do almost anything, and there's the "SYSTEM" account that can lock out even the Administrator.
That's why tools like the "PowerPrompt" have their reason to exist - a console that runs with the privileges of "SYSTEM", not only "Administrator".

[X] Doc CPU

Short answer: encrypt it. Use a vetted program / cipher, and a strong key.

Longer answer: if root is untrusted, that's probably not enough. Get a FIPS 140-2 Level 3 certified USB drive. Keep your sensitive files on that.

You still have to trust the platform(s) you plug the secure drive into, or else don't key it in. You have to know what you trust, and also know if anything you don't trust might be in the mix.

Have you checked your keyboard cable today?

If that's the direction we're going, then try this:

http://tinfoilhat.shmoo.com/

(Specifically designed to avert hardware keystroke logging.)

Correct. Even if your Hardware Encrypted files aren't leaked during decryption, if you process them with an application (Libreoffice, vim, whatever), this application could be leaking information to temporal folders. The usability of this data may vary. Even if you delete the temporal files, Root can perform an undelete action on the affected filesystem and recover some information.

You don't even need to modify the kernel or change the initramfs (if any). [...]

EDIT: I had described a basic way for Root to intercept a password, but I am not sure if that complied with the rules of this forum. Just think that Root + Bourne Shell abilities = Your password belongs to Him!

Root == MitM, Evil Maid, etc

First option is for you use PeaZip which is a cross-platform archiver. you could lock your data safely and leave it any where on network safely.
You can also delete your stuff securely without any chances of recovery using multi pass delete option. PeaZip comes in two formats, (a) installable on Desktop (windows, GNU/Linux..). (b) Portable installed on a Pen drive.
Suit your self.

There is another alternative, use Truecrypt to safe guard your data. It hides the data and makes it difficult for anyone to guess existence of data on PC.