fsprotect is a set of scripts, customized for debian systems that protect existing filesystems.
It uses the AUFS filesystem and some initramfs magic to protect the root filesystem. It also uses a simple init script to protect other filesystems as early as possible.
fsprotect is excellent for public computers like those in libraries, labs, etc. It will ease the life of all administrators with a couple of simple steps.
The benefits of using fsprotect are:
The drawbacks of using fsprotect:
fsprotect uses AUFS to combine two filesystems in one. AUFS does exactly that: It merges two existing filesystems in one and distributes changes among them.
For each protected filesystem, fsprotect combines the existing filesystem with a tmpfs, forcing all changes to be written to the tmpfs. This means that nothing is ever written to the disks and all changes are stored in the tmpfs. tmpfs is a memory based filesystem, similar to ramdisk but using VM instead of real memory, allowing its contents to be swapped out.
The whole protection procedure is achieved with the following steps (assuming you want to protect /test). They are performed by fsprotect; you don't have to do any of them:
mount -t tmpfs -o size=XXXX none /fsprotect/fs/test/tmp
mount -o bind /test /fsprotect/fs/test/orig
mount -t aufs -o dirs=/fsprotect/fs/test/tmp=rw:/fsprotect/test/orig=ro none /fsprotect/test/aufs
umount /test
mount -o bind /fsprotect/fs/test/aufs /test
umount /fsprotect/fs/test/aufs
mount -o remount,ro /fsprotect/fs/test/orig
The actual steps are somehow more complicated to take care of filesystems inside other filesystems.
The protection of the root filesystem is a very special case since all other filesystems are mounted beneath it. For fsprotect to succeed, the above procedure needs to be run before the root filesystem is moved to /. To achieve this, fsprotect uses an initramfs script that runs very early in the boot process, after the root filesystem is mounted but before is is moved to /. It then exchanges the existing filesystem with an aufs and lets the boot procedure continue.
The protection of non-root filesystems is somehow easier. For each filesystem, fsprotect runs the above procedure exchanging the existing filesystem with an aufs.
fsprotect is available as a debian package. It depends on aufs, so you'll need that too.
To install fsprotect do:
# apt-get update
# apt-get install fsprotect
After that:
You may also want to password protect the grub bootloader or forbid any changes to it.
Stefanos Harhalakis v13@v13.gr
fsprotect is ditributed under the GPLv3 license