0

I've been looking into overlayroot as a strategy to help secure my projects that are 'under wraps'.

Installing overlayroot on a Linux system allows one to make their hard drive read only and run their Linux OS entirely in RAM.

I have installed overlayroot and always boot in tmpfs mode. I have created two encrypted partitions, using dm-crypt, one for online and one for offline use. I use my online for research and social networking. I use my offline for proprietary work. I always reboot if I need to switch from online to offline activity. If I've been online or will go online, I will reboot before I open my offline drive.

Is the use of overlayroot a more secure way to use the Internet? Yes or no, please explain what vulnerabilities are handled or not handled to support your answer.

2
  • Are you really asking about initramfs which is usually only used to get a minimal system up to mount the real root file system or are you actually want to run a more comfortable system but within the RAM, i.e. what typical live distributions do? Jan 7 '17 at 21:15
  • The full system in ram. Thanks for pointing that out. I didn't know the difference. I will adjust the question. Jan 8 '17 at 14:46
3

Running a system from RAM only like you propose makes it harder to permanently infect the user account the browser is running on because user only infections will be removed on the next restart.

But, you propose overlayfs which means that most of the data are still stored on some permanent storage and only few data like browser history or cookies are stored in RAM and thus reset on next start. This means that if an attacker finds both a browser exploit to get user access and then a privilege escalation to get system access then the attacker could still write directly to the disk installed in the system (bypassing overlayfs) and thus make the infection permanent.

Insofar your approach is more secure than the normal setup but it still has its problems. Using a physically read-only media like a DVD as the base file system like many live distributions do would be more secure but would still make it possible to make permanent changes to BIOS/UEFI and other permanent and read-write storage on the system.

But of course none of these approaches help against session hijacking or identity theft or similar attacks possible due to bugs in the web applications used. And they also protect you against CSRF or other web based attacks which infect the local router in the network since no local permanent storage is needed for these attacks.

1
  • From the question I think OP is more concerned about the proprietary data on the hard drive. In this scenario I think QubeOS can provide much more security in terms of separate containers for each application.
    – void_in
    Jan 8 '17 at 14:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.