Re: Running OS from CD

[David C Niemi <niemi () tux org>]

On Sat, 19 Dec 1998, Firewalls wrote:
> Has anyone succeeded in running a secured linux kernel from CD or other
> read only media? Are there any FAQs, or tips on this? I guess a flash
> disk is also a possibility. 
>
> I realize there's a performance penalty for this, but it seems that most
> of the executable code would wind up in RAM pretty quick (which I
> recognize isn't read only) but it sure seems a lot safer. 

The location of the kernel is only relevant to performance at boot time, as
unlike userland code it is not demand-paged (aside perhaps from
loadable/unloadable drivers/modules) and it is loaded into memory at boot.

It is fairly practical to run the entire root and /usr file systems from
read-only media, with /tmp and /var being definitely writeable and perhaps
/home and /opt also writeable.  I like the idea of all the writeable
partitions being mounted noexec,nosuid as well.  A few programs have to be
modified for all this to work, but surprisingly many services work just
fine or with minor adjustments (once you get used to such ideas as users
being unable to change their passwords under normal circumstances).

The ideal media for the read-only partitions would be a SCSI disk in an
enclosure with a read-write/read-only/off switch.  You could fit a
stripped-down root file system onto a floppy, but /usr is important too and
generally wants to be hundreds of MB (and I'd expect a CDROM to be too
slow for /usr).  There are probably other nifty fast media with hardware
write-protection (unfortunately Zip disks use a software mechanism).

---  David C Niemi ---niemi at tux.org---  Reston, Virginia, USA  ---
  But only the man who cares about something in itself, who loves
  it and does it *con amore*, will do it in all seriousness.  The
  highest achievement has always been that of such men, and not of
  the hacks who serve for pay.  -- Arthur Schopenhauer