-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Ed W schrieb: > Hi, does anyone have any examples to share of using aufs (ideally plus > squashfs) as their root filesystem? > > I'm building an embedded box which will have a very simple package > manager with versioning using squashfs "packages", which are then all > loaded together at boot time. Just wanted to see how others built their > initrd/linuxrc, etc and how they managed their boot process?
I will be using squashfs + aufs for our upcoming version 3.0 of Gibraltar firewall. For security reasons, aufs is not used as root filesystem (the squashfs is mounted as root), but multiple aufs mounts are used for partial overlays where write access is necessary (/etc and /var by default and sub-tree of /lib, /usr, /bin, and /sbin when patches are applied at run-time). This makes it harder for potential (scripted) attackers as most parts of the root tree are read-only. In terms of run-time patching, the current script creates tmpfs/aufs specifically for those directories where changes are being made (and the patch packages are gpg-signed). However, I have also been thinking of a patch/package format that could be "loaded" more efficiently during bootup. We might want to defined a pseudo-standard here... (I already have a fairly extensible tgz/gpg based format that might be sufficient for patches and addon-type packages). The initramfs scripts I am using are those of Debian Lenny/testing with a few additions (e.g. to support atomic updates of the root squashfs image during bootup as a means of safe firmware upgrade) in the form of hook scripts. These are all GPLed, although not yet pushed into the main Debian archive (I will upload the package once we release our version 3.0). The "live" script from the live-initramfs Debian package already ships a few minor changes to make this work (the upstream author was kind enough to include my patches). If you would like to know more details, feel free to ask (via PM or this mailing list). best regards, Rene -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iEYEARECAAYFAkp/BxEACgkQq7SPDcPCS96LtACg3iXiRj1lDyIWeCHqdiIHgc34 x5EAnRwQeUUD71bS71HLDEYhnlVQwh5R =MGGW -----END PGP SIGNATURE----- ------------------------------------------------------------------------------ Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day trial. Simplify your report design, integration and deployment - and focus on what you do best, core application coding. Discover what's new with Crystal Reports now. http://p.sf.net/sfu/bobj-july
