Securing and Optimizing Linux: RedHat Edition -A Hands on Guide | ||
---|---|---|
Prev | Chapter 7. Configuring and Building a Secure, Optimized Kernel | Next |
Copy the file /usr/src/linux/arch/i386/boot/bzImage from the kernel source tree to the /boot directory, and give it an appropriate new name.
[root@deep ] /linux#cp /usr/src/linux/arch/i386/boot/bzImage /boot/vmlinuz-kernel.version.number |
Copy the file /usr/src/linux/System.map from the kernel source tree to the /boot directory, and give it an appropriate new name.
[root@deep ] /linux#cp /usr/src/linux/System.map /boot/System.map-kernel.version.number |
Move into the /boot directory and rebuild the links to vmlinuz and System.map with the following commands:
[root@deep ] /linux#cd /boot [root@deep ] /boot#ln -fs vmlinuz-kernel.version.number vmlinuz [root@deep ] /boot#ln -fs System.map-kernel.version.number System.map |
Remove obsolete and unnecessary files under the /boot directory to make space:
[root@deep ] /boot#rm -f module-info [root@deep ] /boot#rm -f initrd-2.2.xx.img |
Create a new Linux kernel directory that will handle all header files related to Linux kernel for future compilation of other programs on your system. Recall, we had created two symlinks under the /usr/include directory that point to the Linux kernel to be able to compile it without receiving error and also be able to compile future programs. The /usr/include directory is where all header files of your Linux system are kept for reference and dependencies when you compile and install new programs. The asm, and linux links are used when program need to know some functions from compile-time specific to the kernel installed on your system. Programs call other headers in the include directory when they must know specific information, dependencies, etc. of your system.
[root@deep] /#mkdir -p /usr/src/linux-2.2.14/include [root@deep] /#cp -r /usr/src/linux/include/asm-generic /usr/src/linux-2.2.14/include [root@deep] /#cp -r /usr/src/linux/include/asm-i386 /usr/src/linux-2.2.14/include [root@deep] /#cp -r /usr/src/linux/include/linux /usr/src/linux-2.2.14/include [root@deep] /#cp -r /usr/src/linux/include/net /usr/src/linux-2.2.14/include [root@deep] /#cp -r /usr/src/linux/include/video /usr/src/linux-2.2.14/include [root@deep] /#cp -r /usr/src/linux/include/scsi /usr/src/linux-2.2.14/include [root@deep] /#rm -rf /usr/src/linux [root@deep] /#cd /usr/src [root@deep ] /src#ln -s /usr/src/linux-2.2.14 linux |
: This step will allow us to gain space on our hard drive and will reduce the risk of security. The Linux kernel source directory handles a of lot files and is about 75 MB in size when uncompressed. With the procedure described above, our Linux kernel directory began approximately 3 MB in size so we save 72 MB for the same functionalities.
Finally, you need to edit the /etc/lilo.conf file to make your new kernel one of the boot time options:
Edit the lilo.conf file - vi /etc/lilo.conf and make the appropriated change on the line that read image=/boot/.
[root@deep] /#vi /etc/lilo.conf |
boot=/dev/sda
map=/boot/map
install=/boot/boot.b
prompt
timeout=00
restricted
password=somepasswd
image=/boot/vmlinuz-kernel.version.number #add your new kernel name file here.
label=linux
root=/dev/sda6
read-only
: Don't forget to remove the line that read initrd=/boot/initrd-2.2.12-20.img in the lilo.conf file, since this line is not necessary now monolithic kernel doesn't need an initrd file.
Once the name of the new kernel version has been put in the lilo.conf file as shown above, we update our lilo.conf file for the change to take effect with the following command:
[root@deep] /#/sbin/lilo -v |
LILO version 21, [Copyright 1992-1998 Werner Almesberger
Reading boot sector from /dev/sda
Merging with /boot/boot.b
Boot image: /boot/vmlinuz-2.2.14
Added linux *
/boot/boot.0800 exits no backup copy made.
Writing boot sector.
: If you say NO to the configuration option Unix98 PTY support CONFIG_UNIX98_PTYS during your kernel configuration, you must edit the /etc/fstab file and remove the line that read:
none /dev/pts devpts gid=5,mode=620 0 0