12-12-05 11:02 PM
phil-news-nospam@ipal.net wrote:
>
> I've been wondering why it we still have /bin and /usr/bin kept separate?
> Likewise /lib separate from /usr/lib and /sbin separate from /usr/sbin.
> It seems like a legacy thing to me when the intent was to have a small set
> of tools that could maintain the system in single user mode before /usr is
> mounted. But with huge disk capacities of today, is that even needed?
Solaris has been known to replace /bin and /lib with symbolic links,
so it is easy to view the difference as legacy. The strict need for
separation is in the past. There's more to life than needs based on
old hardware types.
> There's plenty of space for a separate partition with a duplicate system.
> And CDROMs can hold a complete rescue systems that surpass the capabilitie
s
> of an entire installed system of just a decade ago. I no longer use singl
e
> user mode for anything and so I can't see any need for structuring things
> specifically to make single user mode workable.
Ah, now there's where your bias comes in.
> Do we really need single
> user mode for newer systems, as opposed to a complete, and totally separat
e,
> maintenance system (either on another partition or separate media)?
A small booting system exists. Whether it's only used for stuff like
jumpstart/kickstart/ignite. It makes little sense for a separate
system
to be used when a pared-down version can be used. Of course, the
only time that's needed in any strict sense is boot time.
There's more than "need", though. There can be other advantages. I
like to side-step the actual history of the name of /usr and teach
that it has newer meaning. USR for Unix System Reserved or even
better Unix System Readonly. There is plenty of use to having the
filesystem that contains the bulk of the installation to be read-only.
Whether that means logically RO from strict permissions, virtually
RO from being mounted RO except to do installs, or physically RO
once installation is finished isn't as relevant as the idea that it can
be treated as read-only.
Someday over the rainbow, viruses will attack UNIX. At that time
the more systems that have the more layers of protection the better.
Isolating the least changing parts of the installation, and the most
crucial parts of the installation and making them RO is yet another
layer of defense in depth. The stricter the level or RO-ness the
less suseptible to attack.
Whether there's a separate / and /usr isn't a big deal to me. Making
/usr as locked down as feasible is. Try going to the extreme of
making / and /usr together and to making it RO in hardware and
see what happens - /etc is a problem. Files in /etc need to change
with some frequency. Separate / and /usr works. Having /etc as a
separate mount doesn't because of assumptions built into the
system. How to find /etc/vfstab or /etc/filesystems>
[ Post a follow-up to this message ]
| 
