Crumb
c/programming · by winterschon@mastodon.bsd.cafe · 1y

💡 Idea for a debugging script 💡

💡 Idea for a debugging script 💡

This might already exist for FreeBSD, and if so.. let me know!

    1. keeps record of OS core/default settings: loader.conf, rc.conf, sysctl.conf, devfs.rules, login.conf etc
    1. keeps record of file checksum on those OS core files (similar to the app, tripwire)
    1. mode which shows divergence on current state vs known-default state in configs (1) and checksums (2)
      -4) mode which tracks the files and their change-sets over time, similar to a zfs snapshot but at a single file-level

#freebsd #scripting #programming

2 points · 5 comments · view on lemmy.world

5 Comments

david_chisnall@infosec.exchange · 2 pts · 1y (7 replies)

@winterschon@bsd.cafe I think 1-3 are covered by freebsd-update IDS. 4 would be nice to add.

In my ideal world, we'd separate out the bits in /etc that users touch from the ones that are provided by the system and allow /etc to be a separate ZFS dataset. Unfortunately, the lack of this separation means /etc doesn't get mounted if you try because the scripts that mount all of the non-root ZFS datasets are in /etc.

fwaggle@moodoo.org · 1 pts · 1y (4 replies)

@david_chisnall@infosec.exchange @winterschon@bsd.cafe I might be thinking wrong but I'm fairly sure if you took a bunch of snapshots at regular intervals you can use zfs diff between them to track file level changes?

It tells you a file has changed, then you did the files that have changed to see the actual changes?

winterschon@mastodon.bsd.cafe · 1 pts · 1y (2 replies)
[ removed ]
david_chisnall@infosec.exchange · 1 pts · 1y (1 reply)

@winterschon@bsd.cafe @fwaggle@moodoo.org There really isn’t a reason to use UFS unless your machine has less than 64 MiB of RAM. We should remove it from the installer. If you’re not building an appliance image (in which case you won’t use the installer), UFS is almost certainly the wrong tool for the job.

winterschon@mastodon.bsd.cafe · 1 pts · 1y
[ removed ]
david_chisnall@infosec.exchange · 1 pts · 1y

@fwaggle@moodoo.org @winterschon@bsd.cafe Yes, the problem is that this will give changes for the entire boot environment (see problem previously mentioned) when you actually just want config file changes and rollback.

winterschon@mastodon.bsd.cafe · 1 pts · 1y (1 reply)
[ removed ]
david_chisnall@infosec.exchange · 1 pts · 1y

@winterschon@bsd.cafe Oh, does that boot now? It didn’t last time I tried: without /etc mounted, you can’t mount other filesystems. I guess the kernel is doing slightly more for ZFS mounts on boot than it used to (doesn’t work for non-ZFS systems because fstab is in /etc, it used to also not work for ZFS, I think, because something in rc.d was needed to mount additional filesystems).