If I only encrypt the home directory, what are some common ways for information to leak out to the unencrypted part of the file system? Aside from the obvious problems likeswap spacefiles in /tmpare there any common Linux programs leaking information (those which are nearly certainly part of a normal installation)?For example something like locate: it leaks all file names to /var/lib/mlocate/mlocate.db and is even part of a minimal Debian or Arch Linux installation.
Information leaks out of encrypted file system
files;security;encryption;directory structure
Aside from home directories, there are three directory hierarchies with writable data: /etc, /tmp and /var./etc contains system configuration files, most of which are typically not sensitive. But there can be sensitive data there, e.g. wifi passwords./tmp can potentially contain sensitive data; just about any program might put temporary files there. This is easily dealt with by making it an in-memory filesystem (tmpfs). This way, if its content ever ends up on disk, it'll be in swap, which has to be encrypted if you care about encrypting anything./var has many subdirectories. In particular:/var/tmp is like /tmp, but it's supposed to be on-disk. Few programs write there, but when it's used at all, it's usually for large files. It's difficult to predict who's going to need it, so it should be encrypted./var/mail (or /var/spool/mail) may end up containing sensitive data, or it may not. It depends how you use local mail and whether error messages from cron job may contain sensitive data./var/spool/cups or /var/spool/lp (or a few other variations) contain temporary files during printing. If you ever print confidential documents, this should be encrypted as well.Other directories in /var/spool may contain sensitive data, such as outgoing emails.Sensitive information can end up in system logs in /var/log.As you noted, if you have sensitive file names, they may end up in /var/cache/locate or /var/lib/mlocate or variations on that theme.If you want peace of mind, just encrypt everything except /boot. Nowadays most computers are powerful enough that the cost of encryption on the CPU is negligible, and most distributions support whole-disk encryption easily.