When a jail is encryted at rest using 'encfs' we detect that and ask for
a password upon starting the jail.
This sounded like a neat little idea which ended up taking nearly 4 days
to do...
EncFS needs to be running as root, as it is a FUSE system and it will
actually stop root from reading/writing files if it is running as a
user. It also is very picky about not running in a namespace, it manages
to hang indefinitely otherwise where a shutdown can't complete because
the process doesn't want to die :-)
So, it runs as root, takes the password via a pipe and we have a
watchdog proces to kill it when the jail is shut down.
The defaults are not 'secure', as they would be annoying to the max.
This is an isolation runner, removing a lot of attack vectors, for sure
but the name would give the wrong impression with defaults like we have
now.
This avoids the problem that install fails if the file hasn't changed
and its installed version was changed to be owned by root externally to
cmake.
Additionally, call the helper app 'secure'.
I like 'secure firefox' to read.
tomFlowee