Hacker News Reader

Comment by pjc50 | Hacker News Reader

While you can just make it launch a program instead of /sbin/init, you may be surprised at the results, because it won't mount any of your filesystems, setup the network, etc. So you want systemd/sysvinit (according to taste) to run first, which will take the normal amount of time to boot.

The cleaner way of doing this is through "inittab". Normally this starts a program called "getty" on the console which provides the login prompt etc. That's what you want to override. It will also restart your program every time it quits.

(Less normal options include "put your program in the initrd", which is viable if it's very small and does all the setup itself, or "write something that runs directly from the UEFI loader")

View on HN

Or just stick with a lightweight init like OpenRC. It's used in Alpine and as such also in Docker containers. It stands out in how little, really, it does.

Also, you can use /etc/passwd to set the shell for every user. If you set this to a non-shell application, you essentially limit this user's session to only ever running that program. So a very lightweight, but networked system could set up sshd in innittab and then create a user with your single-user application set as the shell, and maybe an admin user that actually has access to a proper shell as a back-up.

There actually was a blog post I read not too long ago about a sysadmin who detailed the security challenges of running an open SSH server in which passwd set the shell to a game. There was a little bit more to it to get it completely secure. Unfortunately can't find it right now.

Another less normal option would simply be to make /sbin/init a shell script.

Instead of trying to detect hardware, network, and all, you could just hardcode everything. If you're working with a standardized set of hardware, that would most likely be simpler than anything else.

This sounds interresting. Do you know any guides on this?

I don't know of a guide, off-hand. I saw it done before in postmarketOS [0], which is what made me think of it.

Note that pmOS does it to call an actual init system, but it could be done as an init in and of itself.

0: https://gitlab.com/postmarketOS/pmaports/tree/master/main/po...

Reply on news.ycombinator.com