Encrypt specific directory on raspberry pi

Question

After hard searching for a way to protect my python code on raspberry pi from strangers access, finally, I'm convinced with all answers I read "No Way to protect python code".

But I still searching to protect my python code but now I'm searching away from python capabilities.

I read there are several ways to encrypt a directory.

So suppose that I have the following directory (/home/pi/Desktop/MyApp)

and suppose that the following python files and directories are exists on this directory: Main.py, class1.py, class2.py, ConfigurationDir, etc...

and suppose that I'm already modified the crontab file (to automatically allow running my app on every boot) by appending the following line to it: @reboot python /home/pi/Desktop/MyApp/Main.py &

Is there a way to encrypt this directory but keep crontab able to automatically access and run Main.py???

next part of the question is related to the encryption method:

I'm a vb developer also, in vb I were using methods to read the cpu and hdd serial numbers and then if they are different from stored numbers this means that the user copied the application to another pc, and so the app will not work. So, Can I do the same with python and sd card, I mean that my python app check rpi cpu id or any similar unique value, and if it doesn't exists or doesn't equal the stored one then it will prevent viewing the files (This means that if someone take off the micro sd card and tried to put it on another pc he will have no access to the python app directory)

So, I need an encryption method based on raspberry pi hardware unique Id's, that prevent any one from viewing python code either by connecting screen, keyboard and mouse or by moving sd card to another pc. and at the same time, keep the crontab able to access and run the python app on every boot or reboot, without the need for any additional steps...

Answer 1

The main problem you will face is that RPi's unique ID (serial number) is too predictable to provide cryptographic protection. Even if you manage to prevent users from booting the RPi with their own SD card and attaching a keyboard to it, a dedicated user can still take out your SD card and brute force the encryption. Given how small the pool of serial number is (a few millions), any encryption will only take minutes to hours to crack.

Your best bet is to glue and/or solder the SD card to the RPi. That way, the person trying to get your python code will need at least some special equipment to get it, which will stop most regular users.

You could also compile your .py files into .pyc, but be aware that there is a wide selection of reverse engineering tools which can be used to produce source code from compiled files.

Answer 2

This question is NOT Pi specific.

If you want to write in Python, and allow users to execute it, they can read the code.

If you want to hide code you need to write in a language that can be compiled.

Answer 3

I've done something like this for my company. But keep in head that you can't perfectly secure your product if someone has a physical access to it. We can only make their hacker's life a pain, until they give up !

Presentation : First, I've made a C program, an homemade encrypter, that takes the Rpi serial and generate a password from it, with some unnecessary complications and obfuscations, in order to prevent basic reverse engineering. This program encrypts my sensitive folder with this password and copy the result in a obscure system place. Once done, both sensitive folder and encrypter are deleted.

I made another C program, the launcher, launched by a service at boot, running an infinite loop, that can generate the same password (with complications too), extract the folder to a temporary location, and launch it's content. And again every time the python program stops.

At the very first lines of my python program, I delete its own file in the temporary folder, so the code is only loaded in memory, no more as a file.

Benefits :
- it protects me from someone who just duplicate the SD card to use it on another RPi. (protection by serial in the launcher, via the password, and in the python program, via a simple comparaison)
- encrypted folder can't be bruteforced, unless it's location has been found by reverse engineering of the launcher (in this case, the password generation algorithm may have been reversed too ^^), or by tedious system examination.
- due to the very short life of the decrypted file, nobody will notice them, nor catch them. At least without a good practice of linux and an access to the system !
- I use "compiled" python code (.pyc file) : if my encrypted folder is compromised, it will be still very hard to modify the python program, even for only removing the 2nd serial verification inside it :P

Drawbacks :
You can see that's not a perfect approach, and I suppose there is no perfect solution : it would be like trying to make a box locked from the inside.
Because of this, I had to rely on secret (password generator algorithm, file location), which is the last card we have in security, and won't resist to someone well determinated.

Notes
- I don't glue no more my SD card, for maintenance purpose.
- I apply basic security rules about permissions, network ...
- My system run with the root partition in read-only mode : this limits the risk of SD corruption, but also of poison taping or unrevelated exploits.
- My users don't have access to bash via keyboard (discard signals caught in python), nor network (ssh is still enabled, but passwords are secrets)
- I trace the use of my program via the homemade update management : this let me see if some RPI with unknown serials are asking for updates (and let me destroy them, by deleting files)

Results : Whatever may be the weak points, I used this system for a year, with a few dozens of Rpi sold, and still didn't notice any hacking attempts :)

Answer 4

No, there is no way of protecting your Python source code.

If crontab decrypts the directory the decryption keys will be accessible by anyone who can access the SD card.

What makes you think anyone will bother?

If it's a niche product the few buyers are unlikely to be interested in saving a few pounds.

If it has universal attraction there are thousands of hackers who will defeat any protection you put in place.

Basically, you are wasting your time.