I get requests from customers where they have an application dump files into the FS on linux and want those files to be automatically encrypted. Not in the sense of an enrypted FS, but in a way that no one, even root, can read these files. The data is also stored in an encrypted database (I know, that will also require some sort of "secure" key storage - but this is assumed to be safe. I know this is probably not true - but nothing I can change). For debugging purposes the data is also stored as plain files - and these must be secured as they contain sensitive data.
As far as my understanding goes, this is not really possible. A daemon watching the FS could pick up unencrypted files and encrypt them with a public key, where the private counter part is stored in a password vault. Of course, no automatic reading would be possible, but that would be ok. However, there will be a short moment where files are unencrypted.
Does anyone know a good solution for this problem? My take is that the application should take care of the encryption, but wanted to make sure I did not miss anything.
The application is custom made, so yes, it can be altered.