replacing initramfs-tools with dracut

If we want to implement a live boot option for Whonix we maybe need to change the default tool for generating the initramfs from the current initramfs-tools to dracut. Therefore, also some minor changes to the build scripts are required.

Dracut is mostly used by everything Fedora based (RedHat, CentOS, Qubes) and OpenSuse. Initramfs-tools is used by Debian and derivatives by default.
I couldn’t find any important differences between both, which doesn’t mean they don’t exist. Dracut is also in the Debian repos and seems to be well maintained.

The current patches for live boot are based on the dracut version in testing. Compared to the version from stable/stretch the major difference for us is the lack of overlayfs support which is present in testing. However, live systems are still possible with device mapper which should be the default imho.
For differences between overlayfs and devicemapper see here .
In contrast, initramfs-tools from debian supports overlayfs but not device-mapper. But in principle it should also be possible to have such a live system with initramfs-tools.

I currently don’t expect any major issues from changing initramfs-tools to dracut though including the patches it might be more tricky.
We have several options:

Use the version from stable/stretch and patch it so we can use live systems with device mapper.
Pro: Would have the lowest risk of breaking something.
Con: Somewhat lower functionality/flexibility since no overlayfs.

Wait for the testing package to be backported and then use this + our patches.
Pro: Would have overlayfs support. Low risk of breaking something.
Con: There is a backport from the current version for jessie. Not sure if there will be one for the version we need. Maybe ask the maintainer of the package.

Use the package from testing + add our patches.
Pro: Would have overlayfs support. We don’t have to wait for a backport.
Con: We need to watch out for upstream changes. Need to ensure the right version is used or adapt the patch. Higher risk that something might break.
I’m not sure if it is possible to install a package from testing during an upgrade where the testing package is an exact version and is listed as “Depends” in the control file. This is relevant if we want to go from Whonix 13 to Whonix 14 + dracut.

Maintain our own dracut from testing with patches already included
Pro: Would have overlayfs support. We don’t have to wait for a backport.
We don’t need an extra live patch package.
Con: We probably still need to look out for changes when some package which dracut depends on gets changed. Maybe higher maintenence burden.

Take a look at initramfs-tools again and try to implement our live mode there.
Pro: Fewer changes. Initramfs-tools is debian default.
Con: Only overlayfs support. Probably also some patches required.

The patches deal only with the live system. If something breaks due to a new upstream package then only the live system should break. Normal boot should still work.
At the moment I mostly dealt with option 3 and 1 going to look at 5 again. Dracut itself depends only on a few packages and I don’t know if anything would break if it suddenly would pull in dependencies with a higher version number than currently installed.

1 Like

Any reasons against moving to dracut? @HulaHoop

Thumbs up to Dracut. Its the modern, standardized successor to intramfs-tools

1 Like

Alright, please change the Whonix default to dracut by submitting a pull request. @Algernon

In Kernel Hardening I was wondering:

Or pass on dracut too and wait until minitrd is available from packages.debian.org?

I wouldn’t hold my breath for minitrd unless the author tells you he’s going to put it in Debian for sure.



Oh, and one last question before closing: instead of implementing these features in your own distro’s initrd, may I suggest just using Dracut instead? It’s all already implemented there!


[Imprint] [Privacy Policy] [Cookie Policy] [Terms of Use] [E-Sign Consent] [DMCA] [Investors] [Priority Support] [Professional Support]