Dracut and root filesystem UUIDs
Apologies if this is the incorrect mailing list to discuss this issue..
Does anyone know if there is a way to configure dracut such that it will not attempt to mount USB mass-storage devices at boot time, but will still allow mounting of such devices once a system (in our case ScientifcLinux6) is fully booted?
Why do we want to do this? We run several large teaching labs running SL6 desktops. We mount filesystems by UUID. We are concerned that our students could install a USB memory stick, at boot time, with a filesystem with the same UUID as the "official" root filesystem so fooling dracut into mounting a trojan filesystem.
Thanks, in advance, for any ideas..
Alastair Scobie
Signature · 9 lines
Alastair Scobie Head of Computing, School of Informatics, University of Edinburgh 10 Crichton Street, Edinburgh, Scotland, EH8 9AB Mail: [email protected] Voice: 0131 650 5178 The University of Edinburgh is a charitable body, registered in Scotland, with registration number SC005336.
A message that is not in the archive (sent off-list or not yet received): [email protected]
Quoted 13 lines · Alastair Scobie
Apologies if this is the incorrect mailing list to discuss this issue..
Does anyone know if there is a way to configure dracut such that it will not attempt to mount USB mass-storage devices at boot time, but will still allow mounting of such devices once a system (in our case ScientifcLinux6) is fully booted?
Why do we want to do this? We run several large teaching labs running SL6 desktops. We mount filesystems by UUID. We are concerned that our students could install a USB memory stick, at boot time, with a filesystem with the same UUID as the "official" root filesystem so fooling dracut into mounting a trojan filesystem.
Quoted 5 lines
Thanks, in advance, for any ideas..
Alastair Scobie
specifying "root=UUID=<uuid> rd.shell=0" will do exactly what you want. Then you also want to secure grub (or any other bootloader) with a password.
A message that is not in the archive (sent off-list or not yet received): [email protected]
Quoted 14 lines · Harald Hoyer
Quoted 13 lines · Alastair Scobie
Apologies if this is the incorrect mailing list to discuss this issue..
Does anyone know if there is a way to configure dracut such that it will not attempt to mount USB mass-storage devices at boot time, but will still allow mounting of such devices once a system (in our case ScientifcLinux6) is fully booted?
Why do we want to do this? We run several large teaching labs running SL6 desktops. We mount filesystems by UUID. We are concerned that our students could install a USB memory stick, at boot time, with a filesystem with the same UUID as the "official" root filesystem so fooling dracut into mounting a trojan filesystem.
Quoted 8 lines
Quoted 5 lines
Thanks, in advance, for any ideas..
Alastair Scobie
specifying "root=UUID=<uuid> rd.shell=0" will do exactly what you want. Then you also want to secure grub (or any other bootloader) with a password.
Ah, sorry, only read half of it. You might want to blacklist the USB storage kernel driver then.
"rd.driver.blacklist=usb-storage"
or choose one of the by-path symlinks with e.g. "root=/dev/disk/by-path/pci-0000:00:1f.2-scsi-0:0:0:0-part1"
A message that is not in the archive (sent off-list or not yet received): [email protected]
Quoted 21 lines · Harald Hoyer
Quoted 20 lines · Harald Hoyer
Quoted 18 lines · Alastair Scobie
Apologies if this is the incorrect mailing list to discuss this issue..
Does anyone know if there is a way to configure dracut such that it will not attempt to mount USB mass-storage devices at boot time, but will still allow mounting of such devices once a system (in our case ScientifcLinux6) is fully booted?
Why do we want to do this? We run several large teaching labs running SL6 desktops. We mount filesystems by UUID. We are concerned that our students could install a USB memory stick, at boot time, with a filesystem with the same UUID as the "official" root filesystem so fooling dracut into mounting a trojan filesystem.
Thanks, in advance, for any ideas..
Alastair Scobie
Quoted 7 lines
Quoted 2 lines
specifying "root=UUID=<uuid> rd.shell=0" will do exactly what you want. Then you also want to secure grub (or any other bootloader) with a password.
Ah, sorry, only read half of it. You might want to blacklist the USB storage kernel driver then.
"rd.driver.blacklist=usb-storage"
Would that blacklist apply only during dracut - would the usb-storage module still be loadable if a user inserted a USB stick after login? ...
Quoted 2 lines
or choose one of the by-path symlinks with e.g. "root=/dev/disk/by-path/pci-0000:00:1f.2-scsi-0:0:0:0-part1"
... otherwise, this looks like the best approach.
Thanks
Signature · 2 lines
The University of Edinburgh is a charitable body, registered in Scotland, with registration number SC005336.
A message that is not in the archive (sent off-list or not yet received): [email protected]
Quoted 25 lines · Alastair Scobie
Quoted 24 lines · Harald Hoyer
Quoted 22 lines · Harald Hoyer
Quoted 13 lines · Alastair Scobie
Apologies if this is the incorrect mailing list to discuss this issue..
Does anyone know if there is a way to configure dracut such that it will not attempt to mount USB mass-storage devices at boot time, but will still allow mounting of such devices once a system (in our case ScientifcLinux6) is fully booted?
Why do we want to do this? We run several large teaching labs running SL6 desktops. We mount filesystems by UUID. We are concerned that our students could install a USB memory stick, at boot time, with a filesystem with the same UUID as the "official" root filesystem so fooling dracut into mounting a trojan filesystem.
Quoted 5 lines
Thanks, in advance, for any ideas..
Alastair Scobie
specifying "root=UUID=<uuid> rd.shell=0" will do exactly what you want. Then you also want to secure grub (or any other bootloader) with a password.
Quoted 7 lines
Quoted 4 lines
Ah, sorry, only read half of it. You might want to blacklist the USB storage kernel driver then.
"rd.driver.blacklist=usb-storage"
Would that blacklist apply only during dracut - would the usb-storage module still be loadable if a user inserted a USB stick after login? ...
it would only be blacklisted during dracut
Quoted 12 lines
Quoted 3 lines
or choose one of the by-path symlinks with e.g. "root=/dev/disk/by-path/pci-0000:00:1f.2-scsi-0:0:0:0-part1"
... otherwise, this looks like the best approach.
Thanks