Use Case 3: Directory-Level GuardPoints

Protect structured or unstructured data stored in data files. The data files are organized inside one or multiple directories within a file system namespace, such as ext4 or XFS, where the entire file system namespace is guarded with one policy as a Directory GuardPoint. In this use case, the file system resides in a device guarded as an in-Place Data Transformation GuardPoint. Similar to use case 1, Linux policies supporting this use case can also specify the second key rule with an empty resource set for rekey.

All Data in file system Device Encrypted through an in-Place Data Transformation GuardPoint

The second policy protecting the device is the same policy as use case 2.

Example

Below is an example of this use case where a file system created in a guarded device and mounted on /xfs is protected under a policy that denies root access to the files under /xfs/dir1:

As depicted above, the root user is denied access to read/write the files associated with the resource set representing files under /xfs/dir1 subdirectory.