Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

6
  • 1
    Theoretically, there are modern hardware extensions (SGX, SEV, etc) that work towards being able to provide an attested confidential computing environment. They don't exactly inspire confidence though. Commented Sep 22, 2024 at 11:05
  • 2
    Yeah, I thought about trying to bring up secure enclave stuff, but I don't think it's worthwhile here. Even leaving aside the fact that people keep finding ways to leak data (keys, memory, etc.) out of the enclave when they have full control of the machine, the effort required - SSHing your source directly into the enclave and then running the compiler on it there - would be a ton of effort to set up, and assumes you have a unique key that nobody else has (which I would normally assume, but is not necessarily the case in an "everybody can log in as root" scenario). Good mention, though. Commented Sep 22, 2024 at 11:11
  • What measures can be taken in a system with unrestricted root users to enhance security for source code? Even though complete protection may not be achievable, I want to make it more difficult for unauthorized access. Could you provide solutions that offer increasing levels of difficulty for retrieving the source code, along with inconveniences for potential attackers? Commented Sep 22, 2024 at 11:11
  • 3
    The source code must exist in plain text on the server (unless you just compile on the client like normal); compilers can't compile ciphertext. It doesn't have to exist in persistent storage (disk), but it does have to exist in RAM, and it does have to exist in the file system (even if only in /dev/mem and the pipes connecting your SSHD to your shell to your compiler). Commented Sep 22, 2024 at 11:16
  • 1
    @AkhilAkkapelli: You keep asking the same question, even though CBHacking has already given you several options and explained their limitations. Did you read and understand the answer? If not, what exactly don't you understand? And you still haven't explained why you think cross-compilation isn't an option. Commented Sep 22, 2024 at 23:42