Immutable USB stick

lgrant

lgrant

I would like to make an immutable USB-based FreeBSD installation, kind of like the Linux-based Parted Magic, where I can know that whatever happens while testing a machine will not affect the USB stick.

I have not tried this before, so I am trying to make sure I understand the steps involved. Here is what I think I need:

1) Make root read-only
2) Make /var and /tmp memory filesystems
3) Make /home and /root memory filesystems
4) Have a startup script that copies /home for the user ID I am and using, as well as /root,
to the memory filesystem versions.

Am I getting close?

Thank you for the assistance.
 
Or you could use securelevels. The security(7) man page provides a brief description. You can google freebsd securelevel to find some howtos. Basically enable the immutable flag on any file/directory you might want protected. Set the securelevel to 1 in order to disable anyone from disabling the immutable flag. Securelevel 2 will disable direct access to disks. Securelevel 3 disables any changes to your existing firewall rules. Changes, like upgrades, need to be performed in single user state before the securelevel is enabled.

I don't know anyone who uses securelevels as this severely restricts maintainability.
 
You must log in or register to reply here.
Back
Top