On Mon, Jul 20 2009, Ron Johnson wrote:
> On 2009-07-20 21:29, Manoj Srivastava wrote:
>> On Sun, Jul 19 2009, Ron Johnson wrote:
>>
>>> On 2009-07-08 20:23, Miles Bader wrote:
>>> [snip]
>>>> Hmm, my / is 290MB, though /tmp, /var, /boot, and /usr are all separate
>>>> partitions.
>>> *Why*? IOW, what benefit do you derive in 2009 (as opposed to 1989,
>>> when disks weren't always large enough to hold it all) from splitting
>>> these out?
>>
>> Security?
>>
>> /dev/sdb2 / ext3
>> noatime,errors=remount-ro 0 1
>
> Why device names instead of labels or UUIDs?
*Shrug*. Been a while, and it has been working form me for
years. Why change?
>> /dev/sda1 /boot ext3
>> noatime,rw,defaults,noauto 0 2
>
> noauto?????
Who the hell wants the braindead initramfs mucking around with a
working boot system? It also ensures that I have to be actively
thinking about modifying my boot process before changes happen.
>> /dev/mapper/anzu_main-usr_lv /usr ext3
>> noatime,ro,defaults 0 2
>
> I understand why this is ro; why then is /boot rw?
Cause it is never mounted.
>> /dev/mapper/anzu_main-home_lv /home ext3
>> noatime,rw,nosuid,nodev 0 2
>
> What does nodev mean? (My google fu must be lacking.) Is "Do not
> interpret character or block special devices on the file system." just
> extra security so that a rogue app doesn't try to create a device file
> anywhere but /dev?
So no one can create a device or a block char file elsewhere in
the file system, yes.
>> /dev/mapper/anzu_main-ulocal_lv /usr/local ext3
>> noatime,rw,nosuid,nodev 0 2
>> /dev/mapper/anzu_main-var_lv /var ext3
>> noatime,rw,nosuid 0 2
>> /dev/mapper/anzu_main-spool_lv /var/spool ext3
>> noatime,rw,nosuid,nodev 0 2
>
> Seems to me that this whole exercise is to ensure that /dev is in it's
> own partition.
Layered security is always better than waiting for the silver
bullet all secure mechanism. It is all about increasing the work factor
for Mallory.
manoj
--
All is well that ends well. John Heywood
Manoj Srivastava <sriva...@acm.org> <http://www.golden-gryphon.com/>
1024D/BF24424C print 4966 F272 D093 B493 410B 924B 21BA DABB BF24 424C
--
To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
