Sponsored Content
Full Discussion: Linux kernel Security
Special Forums Cybersecurity Linux kernel Security Post 302469951 by zenergi on Monday 8th of November 2010 06:23:45 PM
Old 11-08-2010
I try not to compile all the drivers into the kernel depending on the amount of drivers it could end up making the kernel slower.

Not to mention if you have any proprietary drivers that have to be loaded as modules.

One thing you can look at is LIDS (Google it).

However i haven't used it since back with the 2.2.* kernel and don't know how much the project has progressed.

In point form:

* Recompile kernel with everything you will need.
* separate boot partition on read-only media.
* encrypt and mount root read only.
 
DRACUT.CONF(5)							      dracut							    DRACUT.CONF(5)

NAME
dracut.conf - configuration file(s) for dracut SYNOPSIS
/etc/dracut.conf /etc/dracut.conf.d/*.conf DESCRIPTION
dracut.conf is loaded during the initialisation phase of dracut. Command line parameter will overwrite any values set here. dracut.conf.d/*.conf files are read in alphanumerical order and will overwrite parameters set in /etc/dracut.conf. Each line specifies an attribute and a value. A # indicates the beginning of a comment; following characters, up to the end of the line are not interpreted. dracutmodules+=" <dracut modules> " Specify a space-separated list of dracut modules to call when building the initramfs. Modules are located in /usr/lib/dracut/modules.d. omit_dracutmodules+=" <dracut modules> " Omit a space-separated list of dracut modules. add_dracutmodules+=" <dracut modules> " Add a space-separated list of dracut modules. drivers+=" <kernel modules> " Specify a space-separated list of kernel modules to exclusively include in the initramfs. The kernel modules have to be specified without the ".ko" suffix. add_drivers+=" <kernel modules> " Specify a space-separated list of kernel modules to add to the initramfs. The kernel modules have to be specified without the ".ko" suffix. omit_drivers+=" <kernel modules> " Specify a space-separated list of kernel modules not to add to the initramfs. The kernel modules have to be specified without the ".ko" suffix. install_items+=" <kernel modules> " Specify a space-separated list of files, which are added to the initramfs image. filesystems+=" <filesystem names> " Specify a space-separated list of kernel filesystem modules to exclusively include in the generic initramfs. drivers_dir="<kernel modules directory>" Specify the directory, where to look for kernel modules fw_dir+=" :<dir>[:<dir> ...] " Specify additional directories, where to look for firmwares, separated by : install_items+=" <file>[ <file> ...] " Specify additional files to include in the initramfs, separated by spaces. do_strip="{yes|no}" Strip binaries in the initramfs (default=yes) hostonly="{yes|no}" Host-Only mode: Install only what is needed for booting the local host instead of a generic host and generate host-specific configuration. tmpdir="<temporary directory>" Specify temporary directory to use. Warning If chrooted to another root other than the real root device, use --fstab and provide a valid /etc/fstab. use_fstab="{yes|no}" Use /etc/fstab instead of /proc/self/mountinfo. add_fstab+=" <filename> " Add entries of <filename> to the initramfs /etc/fstab. mdadmconf="{yes|no}" Include local /etc/mdadm.conf (default=yes) lvmconf="{yes|no}" Include local /etc/lvm/lvm.conf (default=yes) fscks=" <fsck tools> " Add a space-separated list of fsck tools. If nothing is specified, the default is: "umount mount /sbin/fsck* xfs_db xfs_check xfs_repair e2fsck jfs_fsck reiserfsck btrfsck". The installation is opportunistic (non-existing tools are ignored). nofscks="{yes|no}" If specified, inhibit installation of any fsck tools. kernel_only="{yes|no}" Only install kernel drivers and firmware files. (default=no) no_kernel="{yes|no}" Do not install kernel drivers and firmware files (default=no) stdloglvl="{0-6}" Set logging to standard error level. sysloglvl="{0-6}" Set logging to syslog level. fileloglvl="{0-6}" Set logging to file level. logfile="<file>" Path to log file. show_modules="{yes|no}" Print included module's name to standard output during build. FILES
/etc/dracut.conf Old configuration file. You better use your own file in /etc/dracut/conf.d/. /etc/dracut/conf.d/ Any /etc/dracut/conf.d/*.conf file can overwrite the values in /etc/dracut.conf. The configuration files are read in alphanumerical order. AUTHOR
Harald Hoyer SEE ALSO
dracut(8) dracut.cmdline(7) dracut 11/08/2012 DRACUT.CONF(5)
All times are GMT -4. The time now is 03:51 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy