John Fremlin's blog: vii-secure-autorun: secure encrypted autorun for Linux

Media center computers are ideally without keyboard. However sometimes they need a software patch. Servers need neither input devices nor screen. How to run commands on them if they lose their Internet connexion? And how to do so securely?

Here I present vii-secure-autorun, a system for running commands from removable media like USB drives and DVDs, with the guarantee that only code from trusted sources can affect the machine. With these udev rules it will attempt to mount and check the signature on any ext2 filesystem labeled vii-secure-auto

ACTION=="add", ENV{ID_FS_LABEL}=="vii-secure-auto", ENV{ID_FS_TYPE}=="ext2", ENV{UDISKS_PRESENTATION_HIDE}:="1", RUN+="/etc/vii-secure-autorun/vii-secure-autorun signed-execute-dev $env{DEVNAME}"

Of course, by simply automounting the removable filesystem it may be possible to exploit bugs in the filesystem drivers and so on, so caveat emptor.

vii-secure-autorun signed-execute-dev /dev/sda1 — mount the device and execute the code on it, umount it, etc.

gpg --export | vii-secure-autorun import-keys — add keys to the trusted keychain

vii-secure-autorun package-sign directory — make a tarball of the files in the directory and sign it; the file that will be executed on unpacking is vii-secure-autorun-exec

Hope it's useful, it is to me!