{"id":116748,"date":"2024-06-24T18:05:52","date_gmt":"2024-06-24T16:05:52","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/atomarnye-varianty-fedora-linux-namereny-perevesti-na-fs-somposefs"},"modified":"2024-06-24T18:05:52","modified_gmt":"2024-06-24T16:05:52","slug":"atomarnye-varianty-fedora-linux-namereny-perevesti-na-fs-somposefs","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/atomarnye-varianty-fedora-linux-namereny-perevesti-na-fs-somposefs","title":{"rendered":"Atomic variants of Fedora Linux plan to switch to the Composefs filesystem.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
The Fedora project developers intend to switch the atomic updates of the distribution by default to the Composefs file system. If the proposal is approved by the FESCo (Fedora Engineering Steering Committee), which is responsible for the technical aspects of Fedora distribution development, Composefs will start being implemented in Fedora Silverblue (GNOME), Fedora Kinoite (KDE), Fedora CoreOS, Fedora IoT, Fedora Sway Atomic, and Fedora Budgie Atomic builds. <\/p>\n
This change will allow these builds to use a root partition operating in read-only mode, as well as eventually utilize integrity verification tools for the system partition, enabling the detection of problems during operation. The \/etc and \/var partitions will continue to be mounted with write access.<\/p>\n
Currently, the operation is organized by mounting the \/usr partition in read-only mode, while the root partition is mounted in a write-permitting mode, and making changes is prohibited at the permission level («chattr +i »). Integrity checks are performed during the partition update, which does not allow for detecting damages and changes made during operation without initiating a full data verification using the «ostree fsck» command.<\/p>\n
The Composefs file system is implemented as an extension on top of the already existing OverlayFS and EROFS file systems in the kernel, optimized for effective shared storage of content from multiple mounted disk images. The functionality of EROFS (Extendable Read-Only File System) meets the requirements of Composefs starting from Linux kernel version 5.15, and OverlayFS \u2014 starting from kernel 6.5. Composefs allows the creation of layered file systems, where arbitrary read-only file system trees are overlaid on top of the standard Linux file systems, serving as the lower layer. <\/p>\n
Composefs is distinguished from other similar file systems by its support for sharing the content of different disk images and features for verifying the authenticity of readable data. Composefs employs a content-addressed storage model, in which the primary identifier is not the file name but a hash of the file's content. This model ensures deduplication and allows only one copy of identical files to be stored across different mounted partitions. <\/p>\n
System images typically contain many standard files, and when using Composefs, each of these files will be shared among all mounted images without resorting to tricks like hard links. This means that shared files are not only stored as a single copy on the disk but are also handled with one entry in the page cache, allowing for savings in both disk and RAM usage.<\/p>\n
To save disk space, data and metadata in Composefs are separated, and a binary index containing all filesystem metadata, file names, access rights, and other information is specified during mounting. Metadata indexes are created for each FS image and stored in a separate file in EROFS format (the EROFS image is mounted in loopback mode, containing only metadata). The actual files of all mounted images are stored in a common base directory within a regular filesystem (ext4, xfs, btrfs) and are linked to the image using the extended attribute rusted.overlay.redirect, based on which OverlayFS locates the necessary files by their content hash.<\/p>\n
To verify the content of individual files and the entire image in a shared storage environment, the fs-verity mechanism is used, which checks the compliance of the hashes specified in the binary index with the actual content \u2014 if an attacker modifies a file in the base directory or data is corrupted due to a failure, such verification will detect discrepancies. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"