QV lockdown implemented
About a week ago, I posted about the return of Quirky Linux:
https://bkhome.org/news/202403/quirky-has-returned.html
...well, not exactly; this is a somewhat different beast. I have named it "Quirky Void", or just "QV". Which may also be the Latin words "Quantum Vīs", meaning "as much as you want".
Those using EasyOS will know about Lockdown modes. The most stringent is bootup and run in RAM, with all drives disabled. Lockdown is described here:
https://easyos.org/user/ultra-secure-web-browsing.html
QV does not use a layered filesystem, nor Squashfs files; it is a traditional installation. With a significant difference that QV can install into a folder in a partition. In Puppyland, we refer to that as a "Frugal installation".
The ability of QV to install into a folder inside a partition is important; it is possible to lock the user inside that folder, unable to see outside. Hence Lockdown can be achieved.
Like EasyOS, QV has a little menu in the initrd. Here is the QV menu:
...notice item-1. Previously, item-1 had "Turn ON lockdown, disable access drive partitions", which I chose. By choosing item-1 again, I can toggle Lockdown off.
Oh, one thing. The menu had a message "Hit the SPACEBAR to
disable 15-second timeout", because it will timeout then bootup
will happen. But if you want more time to read the menu items,
just hit the SPACEBAR and you will get the menu as shown above.
So, it is currently in Lockdown-mode; I just press the ENTER key and after bootup:
...the important thing to see in that photo is only one partition icon is displayed. That is the working-partition. In fact, you can't even mount that and access outside the '@qv' folder. In the previous blog post, there is this image, showing the folder hierarchy in the USB-stick:
The 'init' script in the initrd has booted into the '@qv' folder. 'data', '@files' and '@home' are bind-mounted on '/data', '/files/ and 'home' inside '@qv', so they are accessable. But that's it, cannot access anything else in /mnt/sdc2, nor any other partitions.
You are still running as the root user, administrator, but it is "crippled root". Here is some of the code in the 'init' script in the initrd:
The ability to prevent mounting of partitions relies upon
dropping "cap_sys_mount". Linux Capabilities allows selective
dropping of the administrator's capabilities. Unfortunately, the
designers created "cap_sys_admin" which, when dropped, takes away
just about all of administrator's capabilities, making it hardly
more than a normal user -- cap_sys_admin also drops ability to
mount partitions. It really should have been broken into smaller
pieces.
So, I have a patch, that separates out the ability to mount from cap_sys_admin; named cap_sys_mount. I can then just drop ability to mount, while keeping all of the rest of cap_sys_admin capabilities. The patch for the 6.8.1 kernel can be found here:
https://distro.ibiblio.org/easyos/source/kernel/6.8.x/6.8.1-20240325/
That cap_sys_mount patch origin is described here:
https://bkhome.org/news/202012/kernel-510-lockdown-success.html
...I have modified the original patch a bit, and it also required a fix for the 6.8.1 kernel.
QV now has Lockdown, and I kept it very simple. There are no
types of Lockdown; just the one. EasyOS has the ability to plugin
a USB drive and can save to that; however, QV doesn't need that,
as it already saves direct to the working-partition. Plugging in a
USB drive won't work in QV; it cannot be mounted, even though the
partition icon(s) will appear.
Note also, like EasyOS, when in Lockdown mode, the 'init' script in the initrd will detect any HDD (rotating platter drive) and power it down. So it will be turned off, which is an extra security mechanism.
In Lockdown mode, swap partitions are also disabled. However, you can create a swap file in '/data', and that will be automatically used. Name it "pupswap.swp".
QV's Lockdown mode is pretty good. You can do everything that you would normally do, except not access any other partitions. You have all the space in the working-partition, so use a big enough partition for any foreseeable requirements. Probably if running off a USB-stick, at least 16GB would be OK, preferably 32GB.
However, there may be some applications that will want to perform
a mount operation. That will fail. Haven't tried Flatpaks yet. A
Flatpak app runs as a user (same name as the executable), but it
can bump its Linux Capabilites and acquire some root abilities.
The ability to do this is required by Flatpaks, and back then I
was very reluctant to enable that feature in the kernel. I forget
the particular kernel config that allows capability-jump. However,
in the case of QV, the ability to mount is removed while still in
the initrd, so it is gone and cannot be bumped up to by a Flatpak
app.
Tags: quirky
Considering heim joints for wheel knuckles
Yesterday I considered ball joints on the wheel knuckles:
https://bkhome.org/news/202403/considering-ball-joints-for-wheel-knuckles.html
At the workshop today, I constructed another design, using two heim joints top and bottom:
The orientation of the heim joints has the advantage of allowing any amount of vertical displacement of the wheel relative to trike frame.
The downside is weight. It has the original m12 bolt, inserted through a steel tube with brass sleeve insert. I cut off the head of the bolt and welded it to the cube, as can be seen on the left of the photo. I didn't weigh yesterday's design when assembled, but estimating by weighing the parts, today's design is about 330g heavier. For both sides, that is 660g (0.73 Imperial pounds).
With the original trike suspension, that I had almost completed, I found that the weight had got much higher than desired. A bit of extra weight here and there; it adds up. In particular, the sprung part, the wheel knuckle, should be as light as possible. So, I am not going to take today's design any further.
I'll be back at the workshop after Easter, want to try one more
design variant. Oh yeah, Easter has rolled around again. Happy
Easter guys!
Tags: light
Considering ball joints for wheel knuckles
I posted about three different types of ball joints that I purchased for comparison:
https://bkhome.org/news/202403/heim-versus-ball-joint.html
Today I was at the workshop where retired guys get together and work on little projects. Lots of good equipment there. Thinking about what ball joints to use with the wheel knuckles.
Back in early January I was working on the wheel knuckles, intending to fit them to the cheap swing-arms that I purchased from China:
https://bkhome.org/news/202401/construction-of-wheel-knuckle-hinges-and-learning-to-weld.html
Various problems with those swing-arms. Sloppy pivots is the main problem, but also the design became very big and heavy; not really what I want for a trike. While my thumb has been healing, have rethinked the design; hence purchase of the ball joints for consideration.
The workshop has some old 40x40mm steel square tube, and I cut out some cubes. Actually that square tube is fencing post, available from Bunnings, but I found an old length to cut up. Here is the first consideration:
...the cubes are just balanced in place, to see how it will look. I won't rush into doing it this way, as it will be a one-way process; the cubes will have to be welded onto the wheel knuckle.
Any downsides? The main one will be limited vertical displacement, restricting how big a bump can be handled.
The spacing between the ball joints is ok. I looked at it with SolveSpace:
...notice that 390mm distance; that is the height of the trike frame above ground. That is intended to be the rest position, with someone sitting in the trike. The distance between the wheels on the ground is 650.99mm.
If the trike frame is pushed down, which would be the same as riding along and both wheels hitting a bump, this table shows how the wheel spacing (on the ground) varies:
Height |
Spacing |
390 |
650.99 |
380 |
651.93 |
370 |
652.28 |
360 |
652.05 |
350 |
651.23 |
340 |
649.85 |
...wheel scrubbing is at most 1.3mm (0.65mm per tyre); negligible. Snapshot from SolveSpace, at height of 340mm:
...looks good. The ball joints could handle a bit more vertical displacement; just looking at it in SolveSpace, it seems the height could go down to about 320mm, at which point the shock absorbers would also be reaching their limit -- 70mm vertical displacement, a little bit under 3 inches. That's a pretty big bump.
Next-up will consider the wheel knuckle with heim
joints.
Tags: light
Quirky has returned!
I created Quirky Linux in 2010 and the last release was in 2018. I then notified Distrowatch that the project was discontinued.
Quirky was a full installation, occupying an entire partition, the same as most Linux distributions. It did not support squashfs (SFS) files, nor did it use aufs or overlay fs layered filesystem. So it did not have "run in RAM with a save file"; what it did have was strategies to minimize flushes to the storage media, to help prolong the life of flash media.
There are some guys active on the Puppy Forum who would have fond memories of Quirky. Well, Quirky is back, though this is "Quirky on steroids". And very highly experimental.
Yes, the features are as described above; however, major new features are added. Quirky can be installed frugally, that is, be in one folder in a partition used for other purposes -- but it has to be a btrfs partition. There is a snapshot and potentially rollback/roll-forward capability, like we have in EasyOS and the pups. The filesystem has read-write compression. There is per-folder encryption.
Regarding the requirement for a btrfs partition, if you want to
install to an internal drive, you would probably have one if have
installed Fedora or OpenSuse. It is theoretically possible to
create a file in a ext4 partition and create a btrfs filesystem in
that file (maybe a sparse file) and mount it as subvolume; then
can boot into it.
The containers feature of EasyOS is gone. Instead, there will be more attention given to isolation of apps from each other by the method introduced in Easy; to run each app as its own user. This mechanism can be tightened further.
This new Quirky is built with Void Linux packages, and uses XBPS package management, with PKGget (PPM) as a GUI frontend. As introduced in easyVoid. I was struggling with easyVoid, as it uses SFSs and aufs layered filesystem, which is very incompatible with XBPS. It is this incompatibility that was causing me to implement hacks that I did not like, and turned my attention to bringing back Quirky.
A name for this new Quirky can be "QuirkyVoid", or just "QV". Here is the old logo:
...I never created an SVG for it; will put that on the to-do list.
The new build system is derived from woofV that builds easyVoid; the new name is "woofQV". I will be uploading it to github very soon.
woofQV is very simple. A series of scripts to run, and it creates a drive image file 'qv-<date>-amd64.img'. Just like with EasyOS, write it to a USB-stick and boot it. OK, I did that, and got a normal-looking desktop:
Works as you would expect. What is important though, is what is underneath. The filesystem is completely different. If I am running another distro and plugin the USB-stick and mount the working-partition, this is what is seen:
...the working-partition has a btrfs filesystem, and those folders named "@*" are what is called "subvolumes". This is a frugal-install, as all of this is inside folder 'quirkyvoid'. Folder '@qv' is the root-filesystem -- before clarifying that, explaining more about the drive-image file...
Just like EasyOS, the drive-image file has two partitions; an esp boot vfat partition, and a working-partition. Except the working-partition is no longer ext4. Here is the boot-partition:
...for various reasons, this has 'vmlinuz' and 'initrd'; not in the working-partition.
Here is code in the 'init' script in the initrd, before the switch_root operation:
...that SUBVOL variable is "quirkyvoid/@qv", which mounts the @qv folder onto /newroot folder. SUBDIR is "quirkyvoid/". Then /dev, /proc, etc are moved to /newroot, and a switch_root performed.
There are three "--bind" mounts, that mount the external folders 'data', '@home' and '@files' inside /newroot. So, after bootup, this is what "/" looks like:
...which looks similar to EasyOS. Except for that new 'data'
folder.
It is intended that 'files' and 'home' will be encrypted. This will require a password to be entered at bootup. Currently don't have that, as the 6.8.1 kernel with fscrypt patches doesn't work; booted to the shell prompt, then a second later the kernel crashed. I have reported this to the 'linux-btrfs' mail-list, with a screenshot of the crash.
QV has huge potential, but a lot of work to get it to a
reasonable working condition that can be released. A pre-alpha
maybe not to far away.
I will post more explanations in future blog posts. I'm a
beginner with btrfs, so refinement will happen. Those 'data',
'@home' and '@files' located outside of '@qv' is unusual, I gather
from reading so far; it seems that it is more usual to create
'@home' for example, nested inside '@qv' -- but intuitively it
seemed better to have '@home' outside and bind-mount it inside --
anyway, my way seems to be working.
Tags: quirky
btrfs-progs with fscrypt take-2
I posted yesterday about compiling Josef Bacik's fscrypt branch of 'btrfs-progs':
https://bkhome.org/news/202403/btrfs-progs-with-fscrypt-patches.html
There were some things that I didn't understand, and sent an inquiry email to Josef. Here is part of my email:
With ext4, "mkfs.ext4 -O encrypt,..." will enable fscrypt; however
"mkfs.btrfs -O list-all" does not show "encrypt" as an available
feature.
So that is my question, is it just the documentation that is lagging,
and "-O encrypt" will work?
And if so, how do I check? With ext4, can use "tune4fs -l ..." to list
features. I'm new to btrfs, not familiar with the tools.
And here is part of Josef's reply:
You need to make sure when you're configuring btrfs-progs you use
./configure --enable-experimental
so you get the encryption support. However you don't need that to
enable encryption. If you just use the normal fscrypt tools to enable
encryption it'll work properly, we don't do anything specific at mkfs
time like ext4 does, we do it all live.
Good. I have recompiled 'btrfs-progs' and updated the PET. Also
recompiled it statically in OE for use of the utilities in the
initrd.
Tags: quirky
btrfs-progs with fscrypt patches
Recent posts about btrfs:
https://bkhome.org/news/202403/kernel-681-with-btrfs-fscrypt.html
https://bkhome.org/news/202403/improved-support-for-btrfs.html
https://bkhome.org/news/202403/btrfs-progs-compiled-statically-in-oe.html
However, to support fscrypt, patches need to ba applied to 'btrfs-progs'. One of the main developers of btrfs is Josef Bacik, and he is the primary implementer of fscrypt support in btrfs. He has fscrypt patches for btrfs-progs:
https://github.com/josefbacik/btrfs-progs/tree/fscrypt
I have compiled his btrfs-progs in EasyOS Kirkstone and created a PET:
https://distro.ibiblio.org/easyos/amd64/packages/pet/pet_packages-kirkstone/
For the record, this is how I configured the source:
# ./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var --with-crypto=builtin \
--with-convert='' --disable-python --disable-libudev --disable-zoned --disable-convert \
--disable-documentation --disable-backtrace
I uploaded the source tarball to ibiblio:
https://distro.ibiblio.org/easyos/source/alphabetical/b/
Need static binaries for the initrd. Here is the build recipe:
https://github.com/bkauler/oe-qky-kirkstone/commit/e80f8a9bc3eb8241b03127d61379e55738b3092f
Tags: quirky
Kernel 6.8.1 with btrfs fscrypt
I posted about 52 patches available to implement fscrypt in btrfs:
https://bkhome.org/news/202403/linux-kernel-btrfs-supports-fscrypt.html
I have compiled the 6.8.1 kernel with btrfs builtin (not as a
module) and those 52 patches applied. The kernel also has both
overlay and aufs builtin.
For anyone who wants them, those patches are in a tarball, available here (inside build-kernel.tar.gz):
https://distro.ibiblio.org/easyos/source/kernel/6.8.x/6.8.1-20240316/
Here is how I applied the patches:
if [ -f 3rd-party/filesystem/btrfs-fscrypt.tar.gz ];then
echo "btrfs fscrypt patch..."
cp -a -f 3rd-party/filesystem/btrfs-fscrypt.tar.gz temp1/
cd temp1
tar -xf btrfs-fscrypt.tar.gz
cd ..
cd linux-${KERNVER}
Psorted="$(find ../temp1/btrfs-fscrypt -type f -name '*.patch' | sort -n | tr '\n' ' ')"
for aP in ${Psorted}
do
patch -p1 < ${aP}
done
cd ..
rm -f temp1/btrfs-fscrypt.tar.gz
rm -rf temp1/btrfs-fscrypt
fi
...excessive "cd" operations, but it works.
The kernel was compiled in EasyOS Kirkstone-series version 5.7 and the PET is here:
https://distro.ibiblio.org/easyos/amd64/packages/pet/pet_packages-kirkstone/
...there is no broadcom-sta module for it, as it failed to compile.
Note, it you are running EasyOS, there is a bit more involved
than just installing the PET. The PET is used in WoofQ when
building EasyOS. Developers can, however, open up the PET and
extract 'vmlinuz' and the modules, then manually change to use
that kernel (it is at /boot/vmlinuz).
Tags: quirky
Improved support for btrfs
I posted earlier today about compiling 'btrfs-progs' linked-statically, as I want to include the 'btrfs' utility in the initrd:
https://bkhome.org/news/202403/btrfs-progs-compiled-statically-in-oe.html
I will also have the 'btrfs-progs' package in the main filesystem.
using Gparted, I created a btrfs filesystem in a partition in a USB-stick, but the icon for the partition did not display on the desktop.
Hmmm... I have never worked with btrfs before, despite it being around for so many years, and the choice for root filesystem of some distros such as Fedora. I looked through the scripts and found out what was wrong. Fixes committed:
https://github.com/bkauler/woofq/commit/00505fe6ccfdd950d3d89d011afa2bbf9d868724
For anyone interested in reading more about btrfs:
https://btrfs.readthedocs.io/en/latest/
Tags: easy