Make the system disk read-only
(Redirected from writable system disk: belongs to floppy group
{{toc}}
The problem
In short: the system USB disk and partition block devices (e.g.
/dev/sdb*
) are writable by the default Live user, because they belong
to the floppy
group.
This was fixed in Tails 0.12 (see
config/chroot_local_includes/lib/live/config/998-permissions
) but the
bug has since reappeared so the bug is now reopened. Our udev
packages
hasn’t been updated since, but perhaps the udev
init script runs (or
re-runs?) after live-config
wheras it previously only ran before?
Roadmap
This is being discussed in the Help needed with branch bugfix/writable_boot_media thread on tails-dev.
- Fix write access to boot medium via udisks.
- Improve the
the boot device has safe access rights
step infeatures/usb_install.feature
of the automated test suite to take this kind of write access into account. - We’ve got a solution based on bilibop implemented in
bugfix/safer-persistence
, but it relies onUDISKS_SYSTEM_INTERNAL
that exists in Wheezy, but not in Squeeze. So, let’s wait for Tails to be based on Wheezy. - Research potential consequences on:
##* tails-persistence-setup
##* incremental updates
- Improve the
Done
- Fix write access to boot medium at the block device level (Debian
bug #645466:
- Review and merge
feature/bilibop
. - Re-enable the
the boot device has safe access rights
step infeatures/usb_install.feature
of the automated test suite.
- Review and merge
We’ll use bilibop: it’s potential usefulness for Tails was discussed on the ITP and RFS bugs.
Our feature/bilibop
branch installs bilibop-udev (0.4.11~quidame). It
works fine and makes the "the boot device has safe access rights"
test pass.
This part is pending for Tails 0.19.
Older notes
This is being discussed in the Help needed with branch bugfix/writable_boot_media thread on tails-dev.
Another solution, was considered: home-made udev rules. See branch
bugfix/writable_boot_media
for a new fix using udev
.
First review done, a bit more code is needed.
Subtasks
Original created by @tails on 5518 (Redmine)