fsprotect

fsprotect is a neat tool made up of various scripts that help protect your filesystems, especially if you're using Debian systems. It’s designed to keep everything safe and sound on public computers, like the ones you find in libraries or labs.

Why Use fsprotect?

This software works by using AUFS (Another Union File System) and some special initramfs tricks to guard your root filesystem. Plus, it has an easy-to-follow init script that kicks in to protect other filesystems right from the get-go!

Benefits of fsprotect

• Your filesystems stay protected, and nothing gets written directly to the disk.


• Protected filesystems mount as read-only. This is great because it means they won’t get messed up even if the computer shuts down unexpectedly.


• It’s super user-friendly! Just add an "fsprotect" parameter to your kernel for the root filesystem and list any other filesystems you want to protect in /etc/default/fsprotect.


• In some cases, it can actually speed up filesystem access!

Drawbacks of fsprotect

• You can only make changes up to a limit you set (in bytes).


• Adequate swap space is a must since tmpfs (temporary filesystem) is heavily utilized.

How Does fsprotect Work?

The magic happens when fsprotect uses AUFS to blend two filesystems into one. Essentially, it takes an existing filesystem and combines it with a tmpfs, which means all changes are stored in memory instead of written directly to disk.

The Protection Steps

If you want to protect something like /test, here's how it goes down:

1. Create a directory called /fsprotect, and inside that, make three more: /fsprotect/test/orig, /fsprotect/test/tmp, and /fsprotect/test/aufs.


2. Mount tmpfs: mount -t tmpfs -o size=XXXX none /fsprotect/test/tmp.


3. Bind mount: mount -o bind /test /fsprotect/test/orig.


4. Create the aufs layer: mount -t aufs -o dirs=/fsprotect/test/tmp=rw:/fsprotect/test/orig=ro none /fsprotect/test/aufs.


5. Unmount /test: umount /test.


6. Add aufs back on: mount -o bind /fsprotect/test/aufs /test.


7. You can unmount again: umount /fsprotect/test/aufs.


8. The last step is remounting read-only: mount -o remount,ro /fsprotect/test/orig.

This process protects not just non-root filesystems but also does a special job on root ones since they sit underneath everything else. For this reason, fsprotect uses an initramfs script that runs early during boot-up. It swaps out the existing filesystem with an aufs before moving