Mailing List Archive

Peter:
> I'm thinking of separating /usr onto its own partition so that I can have it
> mounted read-only except while updating it. I'd prefer not to have to make an
> init thingy, not having needed one up to now. Besides, some machines have
> things like early-ucode or amd-uc.
>
> I've found a few guides on the Web, but I'm still confused. Is there a simple
> guide to doing this? I know of at least one subscriber here who's done it. :)

I'm using separate /usr, it was the default historically and I just
continued useing it, partly because it is unconvenient to repartion
long running remote systems.

There are a few things to look out for.
If you are not using initrd/initramfs, you need all drivers to access
/ to be compiled in. Easiest is if don't use devices with dynamic
minors. Once / is mounted you have all drivers available
in /lib/modules, then the next possible hurdle is to survive long
enought till /usr is mounted. For that you a suitable mount command
which does not depend on /usr, i.e. it or any programs previous it
in the bootup cannot depend on libs in /usr. The easiest way to
accomplish that is to use busybox.

It is also possible to use sys-fs/static-dev, if you want to opt
to not use udev.

Regards,
/Karl Hammar

>-----Original Message-----
>From: Peter Humphrey <peter@prh.myzen.co.uk>
>Sent: Wednesday, September 14, 2022 8:51 AM
>To: gentoo-user@lists.gentoo.org
>Subject: [gentoo-user] Separate /usr partition
>
>CAUTION: This is an EXTERNAL email. Do not click links or open attachments unless you recognize the sender and know the content is safe.
>
>Hello list,
>
>I'm thinking of separating /usr onto its own partition so that I can have it mounted read-only except while updating it. I'd prefer not to have to make an init thingy, not having needed one up to now. Besides, some machines have things like early-ucode or amd-uc.
>
>I've found a few guides on the Web, but I'm still confused. Is there a simple guide to doing this? I know of at least one subscriber here who's done it. :)
>
>--
>Regards,
>Peter.

Everything necessary to boot the system and mount drives is supposed to be in /etc /lib* and /sbin So a separate /usr is theoretically just a matter of putting your /usr device into fstab.

If something you need for booting with separate /usr is missing that would be a FSH bug and is probably worth reporting unless you're doing something truly arcane with your system.

LMP

On Wed, Sep 14, 2022 at 12:17 PM Laurence Perkins <lperkins@openeye.net> wrote:
>
> If something you need for booting with separate /usr is missing that would be a FSH bug and is probably worth reporting unless you're doing something truly arcane with your system.
>

You can always ask upstream but just about everybody is moving away
from this. A Gentoo update is in the works that will require anybody
using systemd to move everything in / to /usr (it isn't difficult to
switch). (/bin would become a symlink to /usr/bin and so on).
Probably won't be mandatory for non-systemd users but pretty soon
upstreams are going to start assuming that there is no difference
between /usr/lib and /lib and so on. Gentoo maintainers could
potentially patch that behavior but it currently isn't required to
accept bugs that break booting if /usr isn't already mounted.

Simplest solution is to use an initramfs, which is basically what 99%
of linux users use (just talking about conventional distros here, but
I'm guessing Android uses one).

Depending on your config things may still work using /usr in the
traditional way, but if it doesn't work there is no guarantee that
anybody will help you fix that.

--
Rich

Peter Humphrey wrote:
> Hello list,
>
> I'm thinking of separating /usr onto its own partition so that I can have it
> mounted read-only except while updating it. I'd prefer not to have to make an
> init thingy, not having needed one up to now. Besides, some machines have
> things like early-ucode or amd-uc.
>
> I've found a few guides on the Web, but I'm still confused. Is there a simple
> guide to doing this? I know of at least one subscriber here who's done it. :)
>


I read the other replies but want to add this.  I use grub for my boot
loader.  I use dracut to build the init thingy.  It's really easy and I
only had a bad init thingy once very early on, could have been my fault
and most likely was.  Since then, updating a kernel takes a lot longer
than building the init thingy and updating grub.  To be honest, if the
linux link is pointing to the right kernel, one could likely script the
dracut and grub update part.  My point is, if you want to be sure you
can boot without resorting to some rescue options, I'm sure any of us
would help walk you through this.  I actually have notes and I think it
was Neil that shared his command and it is just plain easy.  So far,
Neil's command has not failed me once.  I do mine by hand.  I name my
own kernels and the init thingy as well.  Others have what is most
likely a even easier and less time consuming method.

You may can do it the way you are wanting to but for how long is the
question.  Odds are high that at some point, you will have a system that
won't boot because something that's needed isn't there.  I think Rich
points that out pretty good. 

Just something to think on from a guy that really hates the init
thingy.  ;-)

Dale

:-)  :-) 

Dale:
...
[ re separate /usr, initramfs/initrd ]
> You may can do it the way you are wanting to but for how long is the
> question.  Odds are high that at some point, you will have a system that
> won't boot because something that's needed isn't there.
...

initrd/initramfs is there to make life easier for the distribution.
It is needed when your / is on a device with dynamic minor numbers.
Otherwise, you don't gain much from it.

Separate /usr is a complication mostly for laptop systems where strange
things are needed during boot.
It is also a complications for programs depending on libs in /usr. E.g.
$ ldd /bin/getsubids | grep /usr
libsubid.so.4 => /usr/lib64/libsubid.so.4 (0x00007f2ea07ad000)
libcrypt.so.2 => //usr/lib64/libcrypt.so.2 (0x00007f2ea0578000)
So if getsubids is needed for boot, you either have to move thoose libs
to /lib or use a merged /usr.

The best way to avoid the problems above i make you system simple,
but that seems to against the no prevalent misconception that things
have to be complex.

Regards,
/Karl Hammar

On Wed, 14 Sep 2022 16:50:45 +0100, Peter Humphrey wrote:

> I'm thinking of separating /usr onto its own partition so that I can
> have it mounted read-only except while updating it. I'd prefer not to
> have to make an init thingy, not having needed one up to now. Besides,
> some machines have things like early-ucode or amd-uc.

Most of this has already been answered, except for your final point. You
can load more than one initrd at boot, so you can still apply microcode
updates. For example, with systemd-boot

title Desktop
version 5.15.59-gentoo
linux /vmlinuz-5.15.59-gentoo
options root=LABEL=blah blah
initrd /amd-uc.img
initrd /initramfs-5.15.59-gentoo.img

I use dracut to create the initrd, which is so straighforward even Dale
can't break it ;-)


--
Neil Bothwick

What is a "free" gift ? Aren't all gifts free?

On Wednesday, 14 September 2022 23:09:59 BST Neil Bothwick wrote:
> On Wed, 14 Sep 2022 16:50:45 +0100, Peter Humphrey wrote:
> > I'm thinking of separating /usr onto its own partition so that I can
> > have it mounted read-only except while updating it. I'd prefer not to
> > have to make an init thingy, not having needed one up to now. Besides,
> > some machines have things like early-ucode or amd-uc.
>
> Most of this has already been answered, except for your final point. You
> can load more than one initrd at boot, so you can still apply microcode
> updates. For example, with systemd-boot
>
> title Desktop
> version 5.15.59-gentoo
> linux /vmlinuz-5.15.59-gentoo
> options root=LABEL=blah blah
> initrd /amd-uc.img
> initrd /initramfs-5.15.59-gentoo.img
>
> I use dracut to create the initrd, which is so straighforward even Dale
> can't break it ;-)

:)

That seems to be the way to go then - even dinosaurs die out in the end.
Perhaps Dale will show us the command he referred to.

Thank you all for your help.

--
Regards,
Peter.

Peter Humphrey wrote:
> On Wednesday, 14 September 2022 23:09:59 BST Neil Bothwick wrote:
>> On Wed, 14 Sep 2022 16:50:45 +0100, Peter Humphrey wrote:
>>> I'm thinking of separating /usr onto its own partition so that I can
>>> have it mounted read-only except while updating it. I'd prefer not to
>>> have to make an init thingy, not having needed one up to now. Besides,
>>> some machines have things like early-ucode or amd-uc.
>> Most of this has already been answered, except for your final point. You
>> can load more than one initrd at boot, so you can still apply microcode
>> updates. For example, with systemd-boot
>>
>> title Desktop
>> version 5.15.59-gentoo
>> linux /vmlinuz-5.15.59-gentoo
>> options root=LABEL=blah blah
>> initrd /amd-uc.img
>> initrd /initramfs-5.15.59-gentoo.img
>>
>> I use dracut to create the initrd, which is so straighforward even Dale
>> can't break it ;-)
> :)
>
> That seems to be the way to go then - even dinosaurs die out in the end.
> Perhaps Dale will show us the command he referred to.
>
> Thank you all for your help.
>


As I said, I do all mine by hand.  I don't use make install etc.  After
I build my kernel, I copy it and name it something like this, from /boot.


root@fireball / # ls -al /boot/kernel*
-rw-r--r-- 1 root root 11638944 Nov 30  2021 /boot/kernel-5.10.46-2
-rw-r--r-- 1 root root 11863664 Feb 18  2022 /boot/kernel-5.14.15-2
-rw-r--r-- 1 root root 11881040 Aug  6 18:00 /boot/kernel-5.14.15-3
-rw-r--r-- 1 root root 12128016 Jun 30 20:00 /boot/kernel-5.18.7-1
-rw-r--r-- 1 root root 11167744 Nov 30  2021 /boot/kernel-5.6.7-1
root@fireball / #

I basically put the version and at times a dash number on the end. 
Sometimes "-1" may work but I add a driver or something and the next is
-2, the next -3 etc.  For -3 above, I added a driver for a new network
card as a example.  Sometimes I clean out older dashed versions.  Point
is, it needs to start with kernel and go from there.  You may have a
different way of naming them.  I think grub just looks for it to start
with kernel. 

Once I get that done, I then build the init thingy.  This is Neil's
command that he posted.  From my understanding, the kernel symlink needs
to point to the correct kernel version. 

dracut --kver=$(cat include/config/kernel.release)

That gives a init thingy with a somewhat generic name.  I then rename it
to match the kernel, looks something like this from /boot.


root@fireball / # ls -al /boot/initramfs*
-rw------- 1 root root 9310818 Nov 30  2021 /boot/initramfs-5.10.46-2.img
-rw------- 1 root root 9093386 Nov 13  2021 /boot/initramfs-5.14.15-2.img
-rw------- 1 root root 9485412 Aug  6 18:01 /boot/initramfs-5.14.15-3.img
-rw------- 1 root root 9117155 Jun 30 22:57 /boot/initramfs-5.18.7-1.img
-rw------- 1 root root 9310789 Nov 30  2021 /boot/initramfs-5.6.7-1.img
root@fireball / #

Once you get the two things to match, kernel and initramfs, then when
you update grub, it will match them together and create the needed
entries.  I think at one point, I had one init for each kernel version
without the dash part.  I can't recall how I did that tho.  To update
grub, I use this command. 


grub-mkconfig -o /boot/grub2/grub.cfg

I actually put it in a file in /root and just run it.  I just named it
grub-update.  That way I don't have to remember the option part. ;-) 
When it runs, just make sure it sees the kernel and a matching
initramfs.  It usually lists them in order. 

I don't update kernels that often.  If you do it more often, others will
have more automated ways to do things.  They may use make install and
other things that makes it a lot faster.  I do it this way because it is
not something I have to do often and I always get a good result.  Plus,
I keep the ones I know work well. 

It's been a while but I think Neil may have a more automated process. 
Heck, if he shares his step by step, I may convert.  LOL 

I don't think I left anything out.  :/

Dale

:-)  :-) 

On Thursday, 15 September 2022 11:00:25 BST Dale wrote:

> ... I then build the init thingy. This is Neil's command that he posted.
> From my understanding, the kernel symlink needs to point to the correct
> kernel version.
>
> dracut --kver=$(cat include/config/kernel.release)

That's the bit I was hoping for. Thanks Dale.

I don't use grub-2; the very thought of it makes me shudder. I could
contemplate grub-1, but it can't handle EFI.

--
Regards,
Peter.

Peter Humphrey wrote:
> On Thursday, 15 September 2022 11:00:25 BST Dale wrote:
>
>> ... I then build the init thingy. This is Neil's command that he posted.
>> From my understanding, the kernel symlink needs to point to the correct
>> kernel version.
>>
>> dracut --kver=$(cat include/config/kernel.release)
> That's the bit I was hoping for. Thanks Dale.
>
> I don't use grub-2; the very thought of it makes me shudder. I could
> contemplate grub-1, but it can't handle EFI.
>

I switched to grub2 a while back.  I've thought of using something else
but I don't have efi and most of the others are targeted at efi.  If I
build a new rig, I'll likely use something else.  I'll likely poke Neil
until he reveals what he uses or something.  ROFL 

I'm sure you can reorder things to suite the bootloader you use. 

Glad to help.  I certainly get my share of help here.  :-D

Dale

:-)  :-) 

P. S.  To all, after my drive move, I copied files that were in sticky
mode pending drive moves and now I'm back at 80% again.  So, as soon as
budget allows, I get to do this again.  This time I have notes tho.   I
know how to do it.  ;-) 

On Thu, 15 Sep 2022 06:15:07 -0500, Dale wrote:

> I switched to grub2 a while back.  I've thought of using something else
> but I don't have efi and most of the others are targeted at efi.  If I
> build a new rig, I'll likely use something else.  I'll likely poke Neil
> until he reveals what he uses or something.  ROFL 

I use systemd-boot wherever possible, only falling back to GRUB if the
BIOS is non-EFI.


--
Neil Bothwick

"God created the world in six days. On the seventh day he also decided
to create England... just to try out his Practical Joke Weather Machine."

On Thu, 15 Sep 2022 05:00:25 -0500, Dale wrote:

> As I said, I do all mine by hand.  I don't use make install etc.  After
> I build my kernel, I copy it and name it something like this, from
> /boot.

[snip]
> Once I get that done, I then build the init thingy.  This is Neil's
> command that he posted.  From my understanding, the kernel symlink needs
> to point to the correct kernel version. 
>
> dracut --kver=$(cat include/config/kernel.release)

This should be run from within the kernel source directory. It picks up
the version from the source so the symlink is irrelevant.

> That gives a init thingy with a somewhat generic name.  I then rename it
> to match the kernel, looks something like this from /boot.

If you use make install to install the kernel, dracut gives the initramfs
a matching name.

--
Neil Bothwick

Time is the best teacher; unfortunately it kills all its students.

>-----Original Message-----
>From: Neil Bothwick <neil@digimed.co.uk>
>Sent: Thursday, September 15, 2022 10:35 AM
>To: gentoo-user@lists.gentoo.org
>Subject: Re: [gentoo-user] Separate /usr partition
>
>On Thu, 15 Sep 2022 05:00:25 -0500, Dale wrote:
>
>> As I said, I do all mine by hand. I don't use make install etc.
>> After I build my kernel, I copy it and name it something like this,
>> from /boot.
>
>[snip]
>> Once I get that done, I then build the init thingy. This is Neil's
>> command that he posted. From my understanding, the kernel symlink
>> needs to point to the correct kernel version.
>>
>> dracut --kver=$(cat include/config/kernel.release)
>
>This should be run from within the kernel source directory. It picks up the version from the source so the symlink is irrelevant.
>
>> That gives a init thingy with a somewhat generic name. I then rename
>> it to match the kernel, looks something like this from /boot.
>
>If you use make install to install the kernel, dracut gives the initramfs a matching name.
>
>--
>Neil Bothwick
>
>Time is the best teacher; unfortunately it kills all its students.
>
Note also that the "init thingy" is nothing more than a little filesystem which contains everything you'd need to make sure was on your root partition if you were attempting to boot without one.

Building one yourself is generally pretty trivial if you don't like what dracut/genkernel produce. Utilities, kernel modules, and a script to set up your main system and switch to it.

At the other end of the spectrum, if you have enough memory, you can just put your whole root filesystem into it and run from there... Did that once for a secure processing system. Everything up through X11 and a web browser all in the initramfs.

LMP

On Thu, 15 Sep 2022 18:15:38 +0000, Laurence Perkins wrote:

> Note also that the "init thingy" is nothing more than a little
> filesystem which contains everything you'd need to make sure was on
> your root partition if you were attempting to boot without one.
>
> Building one yourself is generally pretty trivial if you don't like
> what dracut/genkernel produce. Utilities, kernel modules, and a script
> to set up your main system and switch to it.

I used to do that before I started using dracut, but dracut is less work
to maintain. One nice benefit of doing it yourself is that you can embed
the initramfs in the kernel image, meaning you only have one file to
manage and once a kernel works it will always work, which may not be the
case if you rebuild a separate initramfs.


--
Neil Bothwick

For every action, there is an equal and opposite malfunction.

On Thursday, 15 September 2022 09:57:44 BST I wrote:
> On Wednesday, 14 September 2022 23:09:59 BST Neil Bothwick wrote:
> > On Wed, 14 Sep 2022 16:50:45 +0100, Peter Humphrey wrote:
> > > I'm thinking of separating /usr onto its own partition so that I can
> > > have it mounted read-only except while updating it. I'd prefer not to
> > > have to make an init thingy, not having needed one up to now. Besides,
> > > some machines have things like early-ucode or amd-uc.
> >
> > Most of this has already been answered, except for your final point. You
> > can load more than one initrd at boot, so you can still apply microcode
> > updates. For example, with systemd-boot
> >
> > title Desktop
> > version 5.15.59-gentoo
> > linux /vmlinuz-5.15.59-gentoo
> > options root=LABEL=blah blah
> > initrd /amd-uc.img
> > initrd /initramfs-5.15.59-gentoo.img
> >
> > I use dracut to create the initrd, which is so straighforward even Dale
> > can't break it ;-)
> :
> :)
>
> That seems to be the way to go then - even dinosaurs die out in the end.
> Perhaps Dale will show us the command he referred to.

Well, it's taken a few hours, but I have it working. Just a few wrinkles to
clear up:

1. dracut: 90crypt: Could not find any command of '/lib/systemd/systemd-
cryptsetup cryptsetup'!

...and similar for bluetooth.

What do I have to include in /etc/dracut.conf.d/mine.conf to silence these? I
already omit the relevant modules:

$ grep -e crypt -e blue /etc/dracut.conf.d/mine.conf
omit_dracutmodules+=" bluetoothd "
omit_dracutmodules+=" systemd-cryptsetup "
omit_dracutmodules+=" cryptsetup "

2. dracut: No KEYMAP configured.

$ grep i18n /etc/dracut.conf.d/mine.conf
i18n_vars="/etc/conf.d/keymaps:KEYMAP /etc/conf.d/keymaps:WINDOWKEYS /
etc/conf.d/consolefont:FONT"

Notice that only KEYMAP is complained about. The FONT in consolefont points to
/usr as well as KEYMAP.

--
Regards,
Peter.

Peter Humphrey wrote:
> On Thursday, 15 September 2022 09:57:44 BST I wrote:
>> On Wednesday, 14 September 2022 23:09:59 BST Neil Bothwick wrote:
>>> On Wed, 14 Sep 2022 16:50:45 +0100, Peter Humphrey wrote:
>>>> I'm thinking of separating /usr onto its own partition so that I can
>>>> have it mounted read-only except while updating it. I'd prefer not to
>>>> have to make an init thingy, not having needed one up to now. Besides,
>>>> some machines have things like early-ucode or amd-uc.
>>> Most of this has already been answered, except for your final point. You
>>> can load more than one initrd at boot, so you can still apply microcode
>>> updates. For example, with systemd-boot
>>>
>>> title Desktop
>>> version 5.15.59-gentoo
>>> linux /vmlinuz-5.15.59-gentoo
>>> options root=LABEL=blah blah
>>> initrd /amd-uc.img
>>> initrd /initramfs-5.15.59-gentoo.img
>>>
>>> I use dracut to create the initrd, which is so straighforward even Dale
>>> can't break it ;-)
>> :
>> :)
>>
>> That seems to be the way to go then - even dinosaurs die out in the end.
>> Perhaps Dale will show us the command he referred to.
> Well, it's taken a few hours, but I have it working. Just a few wrinkles to
> clear up:
>
> 1. dracut: 90crypt: Could not find any command of '/lib/systemd/systemd-
> cryptsetup cryptsetup'!
>
> ...and similar for bluetooth.
>
> What do I have to include in /etc/dracut.conf.d/mine.conf to silence these? I
> already omit the relevant modules:
>
> $ grep -e crypt -e blue /etc/dracut.conf.d/mine.conf
> omit_dracutmodules+=" bluetoothd "
> omit_dracutmodules+=" systemd-cryptsetup "
> omit_dracutmodules+=" cryptsetup "
>
> 2. dracut: No KEYMAP configured.
>
> $ grep i18n /etc/dracut.conf.d/mine.conf
> i18n_vars="/etc/conf.d/keymaps:KEYMAP /etc/conf.d/keymaps:WINDOWKEYS /
> etc/conf.d/consolefont:FONT"
>
> Notice that only KEYMAP is complained about. The FONT in consolefont points to
> /usr as well as KEYMAP.
>


On the ones you want to omit, is there supposed to be a space in there? 
Should it be like this instead:


omit_dracutmodules+="bluetoothd"
omit_dracutmodules+="systemd-cryptsetup"
omit_dracutmodules+="cryptsetup"


It may not matter but then again, it just might.  Worth a try I'd guess. 

Hope that helps. 

Dale

:-)  :-) 

P. S.  Finally, someone broke it.  ROFLMBO 

On Friday, 16 September 2022 16:25:31 BST Dale wrote:

> On the ones you want to omit, is there supposed to be a space in there?
> Should it be like this instead:
>
> omit_dracutmodules+="bluetoothd"
> omit_dracutmodules+="systemd-cryptsetup"
> omit_dracutmodules+="cryptsetup"
>
> It may not matter but then again, it just might. Worth a try I'd guess.

The wiki says "note the leading and trailing spaces", so no.

> :-) :-)
>
> P. S. Finally, someone broke it. ROFLMBO

Anything you can do, I can do better! :-) :-) :-)

--
Regards,
Peter.

On Fri, Sep 16, 2022 at 11:16 AM Peter Humphrey <peter@prh.myzen.co.uk> wrote:
>
>
> 1. dracut: 90crypt: Could not find any command of '/lib/systemd/systemd-
> cryptsetup cryptsetup'!
>
> ...and similar for bluetooth.
>
> What do I have to include in /etc/dracut.conf.d/mine.conf to silence these? I
> already omit the relevant modules:
>
> $ grep -e crypt -e blue /etc/dracut.conf.d/mine.conf
> omit_dracutmodules+=" bluetoothd "
> omit_dracutmodules+=" systemd-cryptsetup "
> omit_dracutmodules+=" cryptsetup "
>

There are no modules by any of those names, so these config settings
are a no-op.

systemd-cryptsetup is called by the crypt module
There is also a bluetooth module.

Modules are located in /usr/lib/dracut/modules.d.

I suspect the output of dracut mentions the names of the modules it is
loading as well, or probably has a verbosity flag to have it talk more
about what it is doing.

For the most part modules tend to be automagic. Each one figures out
if you're using it, and installs stuff if needed, and if not it
no-ops. So if it can't find cryptsetup then it won't go trying to put
support for it in the initramfs. I do get though that people prefer
to have commands avoid output in a successful state, so omitting those
modules should do the trick.

Dracut modules are pretty simple in their operation. They all have a
module-setup.sh script which is run by dracut and which does any
logic, tells dracut what to install in the initramfs, and which
registers scripts to run during various phases of boot. I haven't
looked at them in ages but I did write up this article on how they
work: https://rich0gentoo.wordpress.com/2012/01/21/a-quick-dracut-module/

--
Rich

On Friday, 16 September 2022 18:57:42 BST Rich Freeman wrote:

> systemd-cryptsetup is called by the crypt module
> There is also a bluetooth module.

Just what I needed - thanks Rich.

I just didn't have the names right.

--
Regards,
Peter.