Reply To: How to create isolated, underprevileged but standard user accounts?

[anilkagiMember]

What is the difference between, a Read-Only-Root and No-persistence-Frugal-Instal

Hello everybody,

I just read more and realized some of my misconceptions.

I know you guys went through a lot of irritation because of my stupid arguments and plans. Especially you, Olsztyn. I am sorry for that. Thank you all a lot, for bearing with me. Please forgive me for my ignorance and help me out of this.

After reading further, I am wondering if there is any difference between Read-Only-Root and No-persistence-Frugal-Install?

Hello @Sybok & @Olsztyn,

sybok wrote:

READ-ONLY ROOT:
Also, it seems that Debian (and hence I guess that also antiX) allows to mount parts of the filesystem, e.g. root as read-only, see this link at wiki.debian.org.

olsztyn wrote:

I personally consider Frugal form of antiX far superior to traditional install in many respects, such as …., stateless and security, …..

After reading further I found that;

Read-only file systems are useful in situations in which you want the environment to revert to a pristine state at each boot

So both, a Read-Only-Root and a No-persistence-Frugal-Instal are the same, as far as reverting to a pristine state at each boot, is concerned. If this all about the Read-Only-Root system and nothing more, then I suppose, the frugal install is better, since here we don’t make systemic changes, whereas we make problematic systemic changes in Read-Only-Root. I quote from the link given by Sybok;

If you want a readonly root then you can select that there and the installer will create the fstab corretcly for you. This gives you a system that <strong>almost works</strong>.

You will have to correct /etc/mtab, ifupdown and, if you have no /tmp partition, add tmpfs to /etc/fstab to get a clean boot. Do that at the shell prompt at the second console (Ctrl-Alt-F2) in the installer or first before any other fixes from above and reboot. Before you fix ifupdown you will have no networking so don't go this way when installing remote.

After the second boot you might get an error from exim4 that the panic log isn't empty. This is because the network didn't come up on the first boot (you fixed ifupdown now, right?). Check that it is just that, remove the file (see <file:///usr/share/doc/exim4/README.Debian.html>, section 2.5.1. “The daily cron job”, esp. logrotate -f /etc/logrotate.d/exim4-paniclog) and restart exim4.

However (I suppose, I don’t know for sure), this is not all about the Read-Only-Root system, and the frugal install has its own drawbacks. That is;

In a no-persistence-frugal install, if the system is infected with a malware, the malware can make changes to the system during the session. Of course its effects will be gone after next boot. However the malware can make changes to the system during the session, and make the system to malfunction, during that session. This does not happen to a Read-Only-Root system. No malware can bring any change to the system even during the session, since it is read only.

This is my current perception, but I am not sure whether I am right in thinking so.

Please kindly throw some light on this matter.

Thank you