Manual for creating customized root fs

Last modified: $Date: 2006-11-24 22:37:54 +0900 (Fri, 24 Nov 2006) $ JST


This manual describes how to create a customized root fs that contains minimum files.

1. Preparation

Do operations until just before Updating Exception Policy described in TOMOYO Linux Install manual (Simplified version).
But you need to modify /root/security/exception_policy.txt as follows after creating /root/security/exception_policy.txt at Creating Exception Policy.

Ignore error messages related to temporary files that have no fixed filenames.

2. Creating image file

2.1 Extracting file list

From now on, you can use normal kernels.

Extract a list of filenames from /root/security/domain_policy.txt .

grep -v '<kernel>' ~/security/domain_policy.txt | grep / | awk ' { print $2; print $3; } ' | grep -v ^/proc/ | grep -v ^/sys/ | grep -v ^/root/ccstools/ | grep -v /root/security/ | sort | uniq > ~/filelist.tmp

Exclude unnecessary filenames (such as log files, PID files, temporary files).

grep -v /tmp/ ~/filelist.tmp | grep -v /var/log/ | grep -v /var/run/ | grep -v /var/tmp/ > ~/filelist.txt

Check that ~/filelist.txt doesn't contain unnecessary filenames.
The locale file ( /usr/lib/locale/locale-archive ) is very large, you may remove if the capacity limit exists.

2.2 Getting link information

Get the list of hard links and symbolic links.

find / -type l -print0 | /root/ccstools/dumpsymlink > ~/symlink.txt
find / -links +1 -print0 | /root/ccstools/dumplink > ~/link.txt

2.3 Mounting destination

Create temporal directory for copying files. Mount the loopback image file on the directory.
In this manual, the loopback image file /tmp/rootfs is mounted on the directory /data.tmp/ .
If you want to create root fs as initramfs, you needn't to mount, for initramfs is created by cpio.

mkdir -p /data.tmp
mount -o loop /tmp/rootfs /data.tmp/

2.4 Copying files

Create necessary directories and copy files.

You needn't to create sys and selinux directories if you are using kernel 2.4 series.

The pathname representation rule for ~/filelist.txt and cpio differs, but in most cases it's OK,
for pathnames in ~/filelist.txt seldom contains non-printable characters (such as white space, carriage return).

cd /data.tmp/
mkdir -pm 755 sys selinux
mkdir -pm 755 proc dev dev/shm dev/pts var/log var/run var/tmp var/run/netreport
mkdir -pm 1777 tmp
mkdir -pm 111 var/empty/sshd
mknod dev/console c 5 1
mknod dev/null c 1 3
mknod dev/zero c 1 5
cpio -pdm . < ~/filelist.txt
find var/log/ -type f -print0 | xargs -0 rm
find var/lock/ -type f -print0 | xargs -0 rm
find var/run/ -type f -print0 | xargs -0 rm

2.5 Reflecting link information

Create minimum and necessary hard links and symbolic links.
Since the hard link and the symbolic link might depend each other, repeat creating for several times.

for i in 1 2 3 4 5
do
/root/ccstools/makelink /data.tmp/ < ~/link.txt
/root/ccstools/makesymlink /data.tmp/ < ~/symlink.txt
done

2.6 Unmounting destination

Unmount the directory. Compress using gzip if you need.

cd
umount -d /data.tmp/

If you want to create as initramfs, do the following.

cd /data.tmp/
find -print0 | cpio -o0 -H newc | gzip -9 > /tmp/initrd.img

Return to index