This is an encryption topic I've been confused by for a while now. From what I understand of LUKS, once the LUKS volume is opened with a passphrase and the resulting device mapper device is mounted, it can be read from and written to until the point that it is closed/unmounted, while the actual on-disk format of the data is in an encrypted form.
Let's say a server break-in was to occur while the LUKS volume is opened and mounted, whereby the root account's password was compromised and broken into by SSH. The attacker will now have full read/write access to the device.
Compare this to a file-based encryption system, such as eCryptfs. If a breach on the root account was to occur and I have sensitive data stored in, say, /home/secure - which is encrypted using eCryptfs - the attacker will not have access to this, since the /home/secure directory is not simply "unlocked" with a passphrase, as in the case of LUKS.
Have I completely misunderstood something here? I feel I have done my research from the wealth of information out there on LUKS, but I haven't found any discussion on the implications of a break-in when a LUKS volume is mounted. Thanks for any insights or clarifications given!