How To: Build A Read-Only Linux System

Posted on January 27, 2009 by Forest
Filed Under General, Linux

There seem to be a lot of people out there looking to run a custom application
on a Linux-based platform running on a solid-state storage device. From time to
time, we receive questions from customers looking to make their Linux platforms
read-only in order to maximize the longevity of their flash devices. I thought
I’d take the opportunity to create a blog post describing one way to do this.

There are a couple of different approaches to making a Linux system read-only.
Unfortunately, it is usually not as simple as using a conventional filesystem
mounted with the read-only option. Many programs assume that at least some
parts of the system are writable. In some cases, these programs will fail to
run correctly if this turns out not to be the case.

I’ll outline here what I think is the best approach for most applications. It is
similar to that taken by the current generation of live CD distributions.

Live CDs typically have read-only access to a root filesystem, which is often
compressed into a single file to be mounted later using a loopback device.
Knoppix broke new ground with its use of the cloop filesystem for this purpose.
More recent live distributions take this a step further by using a union
filesystem to make the root filesystem writable. This approach is quite useful
for our purposes, as well.

[rhelv5-announce] Red Hat Enterprise Linux 5.3 GA Announcement

    * From: rhelv5-announce redhat com
    * To: rhelv5-announce redhat com
    * Subject: [rhelv5-announce] Red Hat Enterprise Linux 5.3 GA Announcement
    * Date: Tue, 20 Jan 2009 15:57:15 -0500

Red Hat is pleased to announce the availability of 5.3
(kernel-2.6.18-128.el5) for the Red Hat Enterprise Linux 5
family of products including:

 - Red Hat Enterprise Linux 5 Advanced Platform for x86,
   AMD64/Intel(r) 64, Itanium Processor Family, System p
   and System z
 - Red Hat Enterprise Linux 5 Server for x86,
   AMD64/Intel(r) 64, Itanium Processor Family, System p
   and System z
 - Red Hat Enterprise Linux 5 Desktop for x86 and
   AMD64/Intel(r)


Enhancements
------------

A technical overview that describes the major enhancements
can be found at:

 http://www.redhat.com/rhel/server/resource_center/

The following list summarizes numerous improvements to this
release:

* Virtualization Enhancements
 + Support for up to 126 CPUs in the x86_64 Xen-based
   Hypervisor (up to 32 CPUs per virtual server)
 + Support for up to 1TB memory per host on x86_64
   (up to 80GB per virtual server)
 + Increased number of dynamic IRQs for x86_64 to allow for
   more guests on large systems
 + Support for more than 16 disk devices per guest
 + Added Virtio drivers for use of Red Hat Enterprise Linux 5
   as a guest on KVM-based hypervisors
 + Automatically determine correct parameters for large memory
   machines.  The domain 0 is automatically restricted to 32GB,
   but the hypervisor sees the full amount of memory in the
   machine
 + Support for Intel Extended Page Tables (EPT) which delivers
   higher performance in Fully Virtualized environments
 + Support for 2MB backing page tables on x86_64
 + Support for more than 4 NICs per guest
 + Blktap statistics added
 + Fixes made to properly reserve kdump memory for Xen and
   to provide crash with needed address
 + Fixed timer problems after migration
 + Added Intel VT-i2 support for new ia64 processor
 + Fixed lengthy network outage after live migrations
 + Xen log file rotation
 + Xenstore database moved to tmpfs
 + Xen paravirtualized drivers included for fully-virtualized
   (FV) Red Hat Enterprise Linux 5 guest kernels. Thus the
   xenpv-kmod package no longer needs to be added to Red Hat
   Enterprise Linux 5 FV kernels for paravirtualized (Xen)
   disk and network support
 + Support for vmcoreinfo for IA64 Xen

* Cluster Improvements
 + Cluster mirror support (2-leg mirrors only)
 + GFS2 parallel cluster file system is supported (previously
   a Technology Preview)
 + Fencing improvements:
   - Added SSH support to the DRAC, Blade Center, iLO, and
     Egenera fencing agents
   - Added support for WTI RSM8R4 and WTI MPC-8H power
     controllers to the WTI fencing agent

* Desktop Enhancements
 + NetworkManager 0.7
   - Mobile broadband for select hardware
   - Static IP support
   - Networking before login
   - Much faster connection times
   - Connection sharing/multiple active connections
 + Laptop support
   - Backported keyboard quirks
 + Updated graphics drivers
   - ATI Radeon r400, r500, and r600 chipsets are fully
     supported for mode setting (previously a Technology
     Preview)
   - ATI Radeon r400 and r500 now support 2D acceleration
     (previously a Technology Preview)
   - Intel G4x/GM4x (Cantiga and EagleLake) support mode
     setting and 2D acceleration
   - Intel GMA950, 2D only
   - Expanded Matrox G200 coverage

* System Services Enhancements
 + Rebased cups (print server), now with full Kerberos support
 + Rebased ksh, lm-sensors, net-snmp, OpenIPMI, openldap,
   openmotif, python-urlgrabber, rpm, tog-pegasus, vnc, yum,
   yum-utils

* Developer Platform
 + OpenJDK
   - First fully open and compatible JDK included in RHEL
   - Based on OpenJDK (http://openjdk.java.net/) and the
     IcedTea GNU/Linux project (http://icedtea.classpath.org/)
   - Tested against the Java SE 1.6 Technical Compatibility
     Kit with zero failures
   - java-1.6.0-openjdk is only available for the x86 and
     x86_64 architectures

* Tool Enhancements
 + SystemTap
   - Initial implementation of user space tracing (user static
     markers and stack unwinding coming soon)
   - Remote script compiling (secure version coming soon)
   - New Beginner's Guide
   - Improved tapset organization and documentation
 + GDB Debugger
   - Rebased, now based on version 6.8 (previously based on
     version 6.5)
   - Multiple location breakpoints for C++ templates,
     constructors, inlined functions, etc.

* Encryption Enhancements
 + Root and swap encryption support in the installer
   - Hibernate / resume support with encrypted disks

* Installer Enhancements
 + 802.1q VLAN tagging support for kickstart
 + iSCSI installation and boot support
 + PCMCIA CompactFlash devices
 + dmraid RAID0, RAID1, and RAID5 support
 + Ability to install Xen and KVM guests
 + Automatic recognition of correctly-labeled driver update
   devices
 + Installation via DVD using SCSI on System z
 + Ability to identify physical NIC by flashing LEDs
 + 10Gbps Ethernet driver support through niu driver
 + Cisco 10G Ethernet support through enic driver
 + Cisco FCoE HBA support through fnic driver
 + Updated DHCPv6 (Client, Server and Relay Agent) support for
   RFC3315, RFC3646 and RFC3736
 + Emulex FCoE HBA support through lpfc driver
 + QLogic FCoE HBA support through qla2xxx driver

* Security Enhancements
 + Authentication and Identity
   - pkinit clients can now be configured to use keys for
     client certificates which may not contain
     Kerberos-specific extensions
   - pkinit interoperability fixes
   - krb5 now applies the correct file context to database
     lock files
   - krb5 servers no longer log everything twice by default
   - nss_ldap now configured with support for paged results
     extension
 + SELinux enablement of new NetworkManager and audit
   functionality
 + Improved Audit and Logging
   - TTY input audit support

* Windows Interoperability
 + Rebased samba from 3.0.28 to 3.0.32 which supports Windows
   Vista and 2008 and various fixes for DC functionality
   (interoperability with Citrix and Domain trusts)

* Kernel Improvements
 + New features include:
   - Added private futexes support
   - Added preempt-notifiers implementation
   - Included tracepoint/markers infrastructure
   - Added response oriented wake up behavior to scheduler
   - Fixed gettimeofday for HPET, PMTimer, TSC
   - Updated NMI infrastructure to latest
   - Enabled deep C-states for idle efficiency for Intel
     Tylersburg chipset
   - Added extend MCE banks support for Intel Dunnington,
     Nehalem processors
   - Added ACPI T-state support (processor throttling control)
   - Added AMD IOMMU driver support
   - Enhanced Partition Statistics
   - Enabled CIFS' DFS support and update CIFS to latest
   - Updated autofs4 to the latest
   - Increased stack size for ia32 application
   - Added kprobe-booster and return probe-booster support
   - Added PCI domain support
   - Added RAID 4/5/10 in dmraid
 + Hardware support enhancements:
   - Drivers added:
       ath5k, enic, fnic, hp-ilo, inet_lro, iwl5000, neic,
       niu, r8169, rt2x00, rtl818x, uvcvideo, virtio
   - Drivers updated:
       3w-9xxx, 3w-xxxx, aacraid, aic94xx, alsa, arcmsr,
       bcm43xx, bnx2, bnx2x, cciss, chelsio, cpufreq, cxgb3,
       e1000, e1000e, fusion, hpilo, ibmvscsi, igb, ieee80211,
       ipw2x00, iwl4965, iwlwifi, ixgbe, lpfc, mac80211,
       megaraid_sas, mptscsi, myri10ge, netxen-nic, OpenIB,
       powernow_k8, qla2xxx, qla3xxx, qla4xxx, qla84xx, sata,
       sata_svw, tg3, zd1211rw


Technology Previews
-------------------

Technology Preview features are included in Red Hat Enterprise
Linux to provide the features with wide exposure with the goal
of supporting these features in a future release of Red Hat
Enterprise Linux.  Technology Preview features are not supported
under Red Hat Enterprise Linux 5.3 subscription services and may
not be functionally complete.  Red Hat welcomes customer
feedback and suggestions for Technology Previews.  Advisories
will be provided for high-severity security issues in Technology
Preview features.

The following Technology Preview features are new or enhanced in
Red Hat Enterprise Linux 5.3.  See the Red Hat Enterprise Linux
5.3 Release Notes for more information.

 - AIGLX including X server and updated Mesa package
 - Compiz composition manager
 - dm-multipath install
 - Dogtail gui
 - Limited eCryptfs support
   + Added eCryptfs support to kernel
   + Added authentication in crypto library to kernel
 - ext4 file system / e4fsprogs
 - Firewire
 - FreeIPMI Intelligent Platform Management System
 - GCC 4.3
   + Compiler based on gcc 4.3
   + OpenMP 3.0 conformance
 - Indic languages: Assamese, Kannada, Sinhalese, Telugu
 - Kerberos security for CIFS
 - Kernel DFS support for CIFS
 - ktune: a service that sets several kernel tuning parameters
   to values suitable for specific system profiles
 - Remote audit logging via unencrypted connection
 - Software FCoE on standard NICs
 - Support for 32-bit paravirtualized (PV) guests on
   64-bit AMD64/Intel(r) 64 hosts
 - SystemTap utrace support for user space tracing
 - Trusted Computing Group (TCG) / Trusted Platform Module
   (TPM) Support
   + Included the TCG stack
   + Included the Trousers TSS stack
   + Added trust computing/trust platform module in kernel and
     tpm-tools
   + boot-loader support will be considered for inclusion in a
     future release
 - VMware ESX cluster fencing agent


GPL Version 3 Licensed Components
---------------------------------

The following packages in Red Hat Enterprise Linux 5.3 are
licensed under GNU General Public License Version 3 (GPLv3):

 * gcc43-4.3.2-7.el5
 * gcc43-c++-4.3.2-7.el5
 * gcc43-gfortran-4.3.2-7.el5
 * gdb-6.8-23.el5


Anaconda Upgrades
-----------------

While anaconda's "upgrade" option will perform an upgrade from
Red Hat Enterprise Linux 4.7 or 5.2 to Red Hat Enterprise Linux
5.3, there is no guarantee that the upgrade will preserve all
of a system's settings, services, and custom configurations.
For this reason, Red Hat recommends that you perform a fresh
installation rather than an upgrade.

Prior to Red Hat Enterprise Linux 5.3, the kernel modules
providing support for GFS2 were delivered separately.  As of
this release, the GFS2 kernel modules are now delivered integral
to the kernel RPM.  Due to Bug 465883, systems which had RPMs
providing the GFS2 kernel modules installed will incorrectly
load the older modules after updating to the Red Hat Enterprise
Linux 5.3 kernel.  To ensure correct operation of GFS2, manually
remove the previous GFS2 Technology Preview kernel module RPMs
prior to installing the new kernel.  For example, on i386:

# rpm -e kmod-gfs2.i686 kmod-gfs2-PAE.i686 kmod-gfs2-xen.i686


Enjoy the Red Hat Enterprise Linux 5.3 release.


Sincerely,

The Red Hat Enterprise Linux Team

----------------------------------------------------------------------

Accessing the Software
----------------------

Red Hat Enterprise Linux 5.3 is available to existing
Red Hat Enterprise Linux subscribers via RHN.  The
channels will automatically appear in your account.
Installable binary and source ISO images are available
via Red Hat Network at:

 https://rhn.redhat.com/network/software/download_isos_full.pxt

You will be required to log in using a valid RHN account
with active entitlements.

Red Hat Enterprise Linux 5.3 errata are available at:

 https://rhn.redhat.com/


Documentation
-------------

Release notes for this release are available on the
Red Hat Enterprise Linux 5 site at:

 http://www.redhat.com/docs/manuals/enterprise/

The Release Notes are also on your Red Hat Enterprise
Linux 5 installed system in the redhat-release-notes
package.


Bug Reporting
-------------

Red Hat Enterprise Linux customers using the Technical
Account Manager (TAM) Service should raise all issues and
questions with this release using your current Issue Tracker
account.  If you're interested in the Technical Account
Manager Service, visit:

 https://www.redhat.com/support/offerings/technical.html

All other customers can raise questions and issues through
the normal Red Hat support channels.  Details can be found
at:

  https://www.redhat.com/support/process/

Defects can be reported using Red Hat's Bugzilla.  To report
and query for defects in this release, you need a Bugzilla
account with access to the "Red Hat Enterprise Linux 5"
product.

Please be advised that Bugzilla is not a support tool and
there is no Service Level Agreement (SLA) for defects
reported.  Red Hat therefore strongly urges customers to
report production issues to their respective Red Hat support
contact instead of Bugzilla.

To report a bug via Bugzilla:

1. Login to the Bugzilla home page at http://bugzilla.redhat.com.
  If you don't have an existing account, simply create one by
  going to this page:

  https://bugzilla.redhat.com/createaccount.cgi

2. On the Bugzilla home page, choose the "New" tab.  Proceed to
  Step 3, "Choosing Your Product" by clicking that button at
  the bottom of the page.

3. Choose Product "Red Hat Enterprise Linux 5".

4. Choose Version "5.3".

5. Choose the component against which you wish to report a
  problem, such as kernel, glibc, etc.  If you do not know
  the component or want to file a bug against the general
  product, choose "distribution" as the component.

6. Choose the platform, such as: "All", "x86_64", etc.

7. Provide the information about the problem you're
  reporting by entering information in the appropriate
  fields.  In the Summary field, provide a clear and
  descriptive abstract of the issue.  In the Description
  field, provide the full package versions of any
  components you are experiencing problems using.

8. Check to make sure that all information is accurate and
  click the "Commit" button to submit your problem report.

Mailing Lists
-------------

Red Hat has a public mailing list for communication during
this and all future Red Hat Enterprise Linux 5 programs.

* rhelv5-announce redhat com

   A low-volume, moderated, announcement-only mailing
   list.  Red Hat will use this list to communicate
   one-way information about RHEL 5 programs, such as
   notifications when releases are available or
   solicitations for feedback.  Subscribe at:

     https://www.redhat.com/mailman/listinfo/rhelv5-announce

* rhelv5-list redhat com

   A public general discussion mailing list for users
   of Red Hat Enterprise Linux 5 releases.  Subscribe
   at:

     https://www.redhat.com/mailman/listinfo/rhelv5-list