In this lesson, you will learn how to design filesystem architectures that enforce strict isolation between tenants, ensuring that one user’s data remains invisible and unreachable by another.
The Problem of Visibility
In a multi-tenant environment, the biggest challenge isn't just preventing unauthorized writes; it is preventing "information leakage." If Tenant A can list the directories or read the metadata of Tenant B, they have already gained intelligence about your infrastructure (e.g., file naming conventions, storage structure, or software versions). To secure a multi-tenant filesystem, you must move beyond simple permissions and adopt structural isolation.
The Chroot and Namespace Strategy
While we have explored chroot and Namespaces, applying them to multi-tenancy requires a "Root-per-Tenant" strategy. Instead of placing all data under /home or /srv, you map each tenant to their own isolated root directory.
By using Mount Namespaces, you can ensure that the / seen by Tenant A is physically different from the / seen by Tenant B. When Tenant A executes an ls / command, they only see their own isolated mount point.
# Concept: Isolating a process into a unique mount namespace
unshare --mount --fork --propagation private
# Inside this process, mount the tenant-specific directory as root
mount --bind /var/lib/tenants/tenantA /
Preventing Side-Channel Discovery
Even with namespacing, you must harden the environment against discovery. If the kernel logs or /proc filesystem remains shared, a tenant might infer the existence of other users. You must mount a fresh, private /proc instance within the tenant's namespace to hide global system processes and sensitive kernel information.
Furthermore, combine this with SELinux categories. By assigning a unique MCS (Multi-Category Security) label to each tenant’s files, the kernel’s mandatory access controls will act as a "final wall." Even if a tenant manages to break out of their directory, the kernel will refuse to allow access because the process's category label does not match the file's label.
By layering process-level isolation (Namespaces) with data-level mandatory access control (SELinux), you ensure that users are effectively "blind" to the presence of their peers.
Key Takeaway: Secure multi-tenancy is achieved by combining mount namespaces to hide directory structures and SELinux categories to enforce mandatory data-access isolation.