第9章 System tips

目次

9.1. screenプログラム
9.1.1. The use scenario for screen(1)
9.1.2. Key bindings for the screen command
9.2. Data recording and presentation
9.2.1. ログデーモン
9.2.2. Log analyzer
9.2.3. Recording the shell activities cleanly
9.2.4. Customized display of text data
9.2.5. Customized display of time and date
9.2.6. Colorized shell echo
9.2.7. Colorized commands
9.2.8. Recording the graphic image of an X application
9.2.9. 設定ファイルの変更記録
9.3. Data storage tips
9.3.1. パーティション設定
9.3.2. Accessing partition using UUID
9.3.3. ファイルシステム設定
9.3.4. Filesystem creation and integrity check
9.3.5. Optimization of filesystem by mount options
9.3.6. Optimization of filesystem via superblock
9.3.7. ハードディスクの最適化
9.3.8. Using SMART to predict harddisk failure
9.3.9. Expand usable storage space via LVM
9.3.10. Expand usable storage space by mounting another partition
9.3.11. Expand usable storage space using symlink
9.3.12. Expand usable storage space using aufs
9.4. Data encryption tips
9.4.1. Removable disk encryption with dm-crypt/LUKS
9.4.2. Encrypted swap partition with dm-crypt
9.4.3. Automatically encrypting files with eCryptfs
9.4.4. Automatically mounting eCryptfs
9.5. Monitoring, controlling, and starting program activities
9.5.1. Time a process
9.5.2. スケジューリングのプライオリティー
9.5.3. psコマンド
9.5.4. topコマンド
9.5.5. List files opened by a process
9.5.6. Trace program activities
9.5.7. Identify processes using files or sockets
9.5.8. Repeating a command with a constant interval
9.5.9. Repeating a command looping over files
9.5.10. Starting a program from GUI
9.5.11. Customizing program to be started
9.5.12. Kill a process
9.5.13. Schedule tasks once
9.5.14. Schedule tasks regularly
9.5.15. Alt-SysRq
9.6. System maintenance tips
9.6.1. Who is logged on
9.6.2. Warn everyone
9.6.3. Hardware identification
9.6.4. ハードウエア設定
9.6.5. System and hardware time
9.6.6. ターミナルの設定
9.6.7. The sound infrastructure
9.6.8. Disable the screen saver
9.6.9. Disable the sound (beep)
9.6.10. 使用メモリ
9.6.11. System security and integrity check
9.7. カーネル
9.7.1. Linux kernel 2.6
9.7.2. Kernel headers
9.7.3. Kernel and module compile
9.7.4. Kernel source compile: Debian standard method
9.7.5. Module source compile: Debian standard method
9.7.6. Kernel source compile: classic method
9.7.7. Non-free hardware drivers
9.8. 仮想化システム
9.8.1. 仮想化ツール
9.8.2. Chrootシステム
9.8.3. Setting up login for chroot

Here, I will describe basic tips to configure and manage systems, mostly from the console.

9.1. screenプログラム

screen(1) is a very useful tool for people to access remote sites via unreliable or intermittent connections since it support interrupted network connections.

表9.1 List of programs to support interrupted network connections.

パッケージ popcon サイズ 説明
screen V:11, I:31 1036 terminal multiplexer with VT100/ANSI terminal emulation

9.1.1. The use scenario for screen(1)

screen(1) not only allows one terminal window to work with multiple processes, but also allows remote shell process to survive interrupted connections. Here is a typical use scenario of screen(1).

  1. You login to a remote machine.
  2. You start screen on a single console.
  3. You execute multiple programs in screen windows created with ^A c ("Control-A" followed by "c").
  4. You switch among the multiple screen windows by ^A n ("Control-A" followed by "n").
  5. Suddenly you need to leave your terminal, but you don't want to lose your active work by keeping the connection.
  6. You detach the screen session by any methods such as:

    • brutally unplugging your network connection,
    • typing ^A d ("Control-A" followed by "d") and manually logging out from the remote connection, or
    • typing ^A DD ("Control-A" followed by "DD") to have screen detach and log you out.
  7. You log in again to the same remote machine (even from a different terminal).
  8. You start screen as "screen -r".
  9. screen will magically reattach all previous screen windows with all actively running programs.
[ティップ] ティップ

You can save connection fees for metered network connections such as dial-up and packet ones, because you can leave a process active while disconnected, and then re-attach it later when you connect again.

9.1.2. Key bindings for the screen command

In a screen session, all keyboard inputs are sent to your current window except for the command keystroke, by default ^A ("Control-A"). All screen commands are entered by typing ^A plus a single key [plus any parameters]. Here are important ones to remember:

表9.2 screenキーバインディングのリスト。

キーバインディング 意味
^A ? show a help screen (display key bindings)
^A c create a new window and switch to it
^A n go to next window
^A p go to previous window
^A 0 go to window number 0
^A 1 go to window number 1
^A w show a list of windows
^A a send a Ctrl-A to current window as keyboard input
^A h write a hardcopy of current window to file
^A H begin/end logging current window to file
^A ^X lock the terminal (password protected)
^A d detach screen session from the terminal
^A DD detach screen session and log out

See screen(1) for details.

9.2. Data recording and presentation

9.2.1. ログデーモン

Many programs record their activities under the "/var/log/" directory.

  • The kernel log daemon: klogd(8)
  • The system log daemon: syslogd(8)

See 「システムメッセージ」 and 「カーネルメッセージ」.

9.2.2. Log analyzer

Here are notable log analyzers ("~Gsecurity::log-analyzer" in aptitude(8)).

表9.3 List of system log analyzers.

パッケージ popcon サイズ 説明
logwatch V:2, I:3 2312 log analyser with nice output written in Perl
fail2ban V:3, I:3 616 複数回の認証エラーを発生させるIPを使用禁止とする
analog V:1.4, I:17 4612 web server log analyzer
awstats V:1.7, I:3 5100 powerful and featureful web server log analyzer
sarg V:1.6, I:1.8 1448 squid analysis report generator
pflogsumm V:0.3, I:0.7 164 Postfix log entry summarizer
syslog-summary V:0.2, I:1.0 80 summarize the contents of a syslog log file
lire V:0.17, I:0.2 5056 full-featured log analyzer and report generator
fwlogwatch V:0.13, I:0.2 432 Firewall log analyzer
squidview V:0.11, I:0.6 260 monitors and analyses squid access.log files
visitors V:0.10, I:0.3 224 fast web server log analyzer
swatch V:0.08, I:0.2 112 Log file viewer with regexp matching, highlighting, & hooks
crm114 V:0.07, I:0.2 1164 The Controllable Regex Mutilator and Spam Filter (CRM114)
icmpinfo V:0.06, I:0.3 84 Interpret ICMP messages

[注意] 注意

CRM114 provides language infrastructure to write fuzzy filters with the TRE regex library. Its popular use is spam mail filter but it can be used as log analyzer.

9.2.3. Recording the shell activities cleanly

The simple use of script(1) (see 「シェル活動の記録」) to record shell activity produces a file with control characters. This can be avoided by using col(1):

$ script
Script started, file is typescript
  • do whatever …
  • Press Ctrl-D to exit script
$ col -bx <typescript >cleanedfile
$ vim cleanedfile

If you don't have script (for example, during the boot process in the initramfs), you can use following instead:

$ sh -i 2>&1 | tee typescript
[ティップ] ティップ

Some x-terminal-emulator such as gnome-terminal can record. You may wish to extend line buffer for scrollback.

[ティップ] ティップ

You may use screen(1) with "^A H" (see 「Key bindings for the screen command」) to perform recording of console.

[ティップ] ティップ

You may use emacs(1) with "M-x shell", "M-x eshell", or "M-x term" to perform recording of console. You may later use "C-x C-w" to write the buffer to a file.

9.2.4. Customized display of text data

Although pager tools such as more(1) and less(1) (see 「ページャ」) and custom tools for highlighting and formatting 「Highlighting and formatting plain text data」 can display text data nicely, general purpose editors (see 「テキストエディタ」) are most versatile and customizable.

[ティップ] ティップ

For vim(1) and its pager mode alias view(1), ":set hls" will enable highlighted search.

9.2.5. Customized display of time and date

The default display format of time and date by the "ls -l" command depends on the locale (see value 「タイムスタンプ」). The "$LANG" variable is referred first and it can be overridden by the "$LC_TIME" variable.

The actual default display format for each locale depends on the version of the standard C library (the libc6 package) used. I.e., different releases of Debian had different defaults.

If you really wish to customize this display format of time and date beyond the locale, you should set the time style value by the "--time-style" argument or by the "$TIME_STYLE" value (see ls(1), date(1), "info coreutils 'ls invocation'").

表9.4 Display examples of time and date for the "ls -l" command for lenny.

time style value locale display of time and date
iso any 01-19 00:15
long-iso any 2009-01-19 00:15
full-iso any 2009-01-19 00:15:16.000000000 +0900
locale C Jan 19 00:15
locale en_US.UTF-8 2009-01-19 00:15
locale es_ES.UTF-8 ene 19 00:15
+%d.%m.%y %H:%M any 19.01.09 00:15
+%d.%b.%y %H:%M Cまたはen_US.UTF-8 19.Jan.09 00:15
+%d.%b.%y %H:%M es_ES.UTF-8 19.ene.09 00:15

[ティップ] ティップ

You can eliminate typing long option on commandline using command alias, e.g. "alias ls='ls --time-style=+%d.%m.%y\ %H:%M'" (see 「コマンドエリアス」).

[ティップ] ティップ

ISO 8601 is followed for these iso-formats.

9.2.6. Colorized shell echo

Shell echo to most modern terminals can be colorized using ANSI escape code (see "/usr/share/doc/xterm/ctlseqs.txt.gz"). E.g.:

$ RED=$(printf "\x1b[31m")
$ NORMAL=$(printf "\x1b[0m")
$ REVERSE=$(printf "\x1b[7m")
$ echo "${RED}RED-TEXT${NORMAL} ${REVERSE}REVERSE-TEXT${NORMAL}"

9.2.7. Colorized commands

Colorized commands are handy for inspecting their output in the interactive environment. I include following in my "~/.bashrc".

if [ "$TERM" != "dumb" ]; then
    eval "`dircolors -b`"
    alias ls='ls --color=always'
    alias ll='ls --color=always -l'
    alias la='ls --color=always -A'
    alias less='less -R'
    alias ls='ls --color=always'
    alias grep='grep --color=always'
    alias egrep='egrep --color=always'
    alias fgrep='fgrep --color=always'
    alias zgrep='zgrep --color=always'
else
    alias ll='ls -l'
    alias la='ls -A'
fi

The use of alias limits color effects to the interactive command usage. It has advantage over exporting environment variable "export GREP_OPTIONS='--color=auto'" since color can be seen under pager programs such as less(1). If you wish to surpress color when piping to other programs, use "--color=auto" instead in the above example for "~/.bashrc".

[ティップ] ティップ

You can turn off these colorizing aliases in the interactive environment by invoking shell with "TERM=dumb bash".

9.2.8. Recording the graphic image of an X application

There are few ways to record the graphic image of an X application, including an xterm display.

表9.5 グラフィックイメージの操作ツールのリスト。

パッケージ popcon サイズ コマンド
xbase-clients V:13, I:56 184 xwd(1)
gimp V:14, I:50 13468 GUI menu
imagemagick V:15, I:32 304 import(1)
scrot V:0.2, I:1.2 80 scrot(1)

9.2.9. 設定ファイルの変更記録

DVCSシステムを使って設定ファイルの変更を記録する専用ツールがあります。

表9.6 List of packages to record configuration history in VCS.

パッケージ popcon サイズ 説明
etckeeper V:0.4, I:0.7 372 store configuration files and its metadata with Git (default), Mercurial, or Bazaar. (new)
changetrack V:0.06, I:0.08 152 store configuration files with RCS. (old)

I recommend to use the etckeeper package with git(1) which put entire "/etc" under VCS control. Its installation guide and tutorial are found in "/usr/share/doc/etckeeper/README.gz".

Essentially, running "sudo etckeeper init" initializes the git repository for "/etc" just like the process explained in 「Git for recording configuration history」) but with special hook scripts for more thorough setups.

As you change your configuration, you can use git(1) normally to record them. It will automatically record changes nicely every time you run package management commands, too.

[ティップ] ティップ

You can browse the change history of "/etc" by executing "sudo GIT_DIR=/etc/.git gitk" with clear view for new installed packages, removed packages, and version changes of packages.

9.3. Data storage tips

Booting your system with Linux live CDs or debian-installer CDs in rescue mode make it easy for you to reconfigure data storage on your boot device. See also 「バイナリデータ」.

9.3.1. パーティション設定

For partition configuration, although fdisk(8) has been considered standard, parted(8) deserves some attention. "Disk partitioning data", "partition table", "partition map", and "disk label" are all synonyms.

Most PCs use the classic Master Boot Record (MBR) scheme to hold disk partitioning data in the first sector, i.e., LBA sector 0 (512 bytes).

[注意] 注意

Some new PCs with Extensible Firmware Interface (EFI), including Intel-based Macs, use GUID Partition Table (GPT) scheme to hold disk partitioning data not in the first sector.

Although fdisk(8) has been standard for the disk partitioning tool, parted(8) is replacing it.

表9.7 ディスクパーティション管理パッケージのリスト

パッケージ Popcon サイズ 説明 GUIDパーティションテーブル
util-linux V:90, I:99 1848 Miscellaneous system utilities including fdisk(8) and cfdisk(8) 非サポート
parted V:1.0, I:8 164 The GNU Parted disk partition resizing program サポート
gparted V:4, I:42 3168 GNOME partition editor based on libparted サポート
qtparted V:0.17, I:1.2 764 KDE partition editor based on libparted サポート
gptsync V:0.01, I:0.15 72 Synchronize classic MBR partition table with the GPT one サポート

[注意] 注意

Although parted(8) claims to create and to resize filesystem too, it is safer to do such things using best maintained specialized tools such as mkfs(8) (mkfs.msdos(8), mkfs.ext2(8), mkfs.ext3(8), …) and resize2fs(8).

[注意] 注意

In order to switch between GPT and MBR, you need to erase first few blocks of disk contents directly (see 「Clear file contents」) and use "parted /dev/sdx mklabel gpt" or "parted /dev/sdx mklabel msdos" to set it. Please note "msdos" is use here for MBR.

9.3.2. Accessing partition using UUID

Although reconfiguration of your partition may yield different names for partitions, you can access them consistently. This is also helpful if you have multiple disks and your BIOS doesn't give them consistent device names.

  • mount(8) with "-U" options can mount a block device using UUID, instead of using its file name such as "/dev/sda3".
  • "/etc/fstab" (see fstab(5)) can use UUID.
  • Boot loaders (「2段目: ブートローダ」) may use UUID too.
[ティップ] ティップ

You can probe UUID of a block special device with vol_id(8).

9.3.3. ファイルシステム設定

For ext3 filesystem, the e2fsprogs package provides:

  • mkfs.ext3(8) to create new ext3 filesystem,
  • fsck.ext3(8) to check and to repair existing ext3 filesystem, and
  • tune2fs(8) to configure superblock of ext3 filesystem.

The mkfs(8) and fsck(8) commans are provided by the e2fsprogs package as front-ends to various filesystem dependent programs (mkfs.fstype and fsck.fstype). For ext3 filesystem, they are mkfs.ext3(8) and fsck.ext3(8) (they are hardlinked to mke2fs(8) and e2fsck(8)).

Similar commands are available for each filesystem supported by Linux.

表9.8 List of filesystem management packages

パッケージ popcon サイズ 説明
e2fsprogs V:66, I:99 1884 Utilities for the ext2/ext3/ext4 filesystems.
reiserfsprogs V:3, I:10 1200 Utilities for the Reiserfs filesystem.
dosfstools V:3, I:23 224 Utilities for the FAT filesystem. (Microsoft: MS-DOS, Windows)
xfsprogs V:2, I:10 3044 Utilities for the XFS filesystem. (SGI: IRIX)
ntfsprogs V:1.5, I:6 632 Utilities for the NTFS filesystem. (Microsoft: Windows NT, …)
jfsutils V:0.6, I:3 1116 Utilities for the JFS filesystem. (IBM: AIX, OS/2)
reiser4progs V:0.08, I:0.7 1292 Utilities for the Reiser4 filesystem.
hfsprogs V:0.04, I:0.5 324 HFSHFS Plusファイルシステムのためのユーティリティ。(Apple: Mac OS)
btrfs-tools V:0.01, I:0.13 968 Utilities for the btrfs filesystem.

[ティップ] ティップ

Ext3 filesystem is the default filesystem for the Linux system and strongly recommended to use it unless you have some specific reasons not to. After Linux kernel 2.6.28 (Debian squeeze), ext4 filesystem will be available and expected to be the default filesystem for the Linux system. btrfs filesystem is expected to be the next default filesystem after ext4 filesystem for the Linux system.

[警告] 警告

You might face some limtations with ext4 since it is new. For example, you must have Linux kernel 2.6.30 or later if you wish to resizean ext4 partition.

[ティップ] ティップ

Some tools allow access to filesystem without Linux kernel support (see 「Manipulating files without mounting disk」).

9.3.4. Filesystem creation and integrity check

The mkfs(8) command creates the filesystem on a Linux system. The fsck(8) command provides the filesystem integrity check and repair on a Linux system.

[注意] 注意

It is generally not safe to run fsck on mounted filesystems.

[ティップ] ティップ

Check files in "/var/log/fsck/" for the result of the fsck(8) command run from the boot script.

[ティップ] ティップ

Use "shutdown -F -r now" to force to run the fsck(8) command safely on all filesystems including root file system on reboot. See the shutdown(8) manpage for more.

9.3.5. Optimization of filesystem by mount options

Performance and characteristics of a filesystem can be optimized by mount options used on it (see fstab(5) and mount(8)). For example:

  • "defaults" option implies default options: "rw,suid,dev,exec,auto,nouser,async". (general)
  • "noatime" or "relatime" option is very effective for speeding up the read access. (general)
  • "user" option allows an ordinary user to mount the file system. This option implies "noexec,nosuid,nodev" option combination. (general, used for CD and floppy)
  • "noexec,nodev,nosuid" option combination is used to enhance security. (general)
  • "noauto" option limits mounting by explicit operation only. (general)
  • "data=journal" option for ext3fs can enhance data integrity against power failure with some loss of write speed.
[ティップ] ティップ

You need to provide kernel boot parameter "rootflags=data=journal" to deploy "data=journal" option for the root file system formatted with ext3fs.

9.3.6. Optimization of filesystem via superblock

Characteristics of a filesystem can be optimized via its superblock using the tune2fs(8) command. For example on "/dev/hda1":

  • Execution of "sudo tune2fs -l /dev/hda1" will display the contents of its filesystem superblock.
  • Execution of "sudo tune2fs -c 50 /dev/hda1" will change frequency of filesystem checks (fsck execution during boot-up) to every 50 boots.
  • Execution of "sudo tune2fs -j /dev/hda1" will add journaling capability to the filesystem, i.e. filesystem conversion from ext2 to ext3. (Do this on the unmounted filesystem.)
  • Execution of "sudo tune2fs -O extents,uninit_bg,dir_index /dev/hda1 && fsck -pf /dev/hda1" will convert it from ext3 to ext4. (Do this on the unmounted filesystem.)
[警告] 警告

Filesystem conversion for the boot device to the ext4 filesystem should be avoided until GRUB boot loader supports the ext4 filesystem well and installed Linux Kernel version is newer than 2.6.28.

[ティップ] ティップ

Despite its name, tune2fs(8) works not only on the ext2 filesystem but also on the ext3 and ext4 filesystems.

9.3.7. ハードディスクの最適化

[警告] 警告

Please check your hardware and read manpage of hdparam(8) before playing with harddisk configuration because this may be quite dangerous for the data integrity.

You can test disk access speed of a harddisk, e.g. "/dev/hda", by "hdparm -tT /dev/hda". For some harddisk connected with (E)IDE, you can speed it up with "hdparm -q -c3 -d1 -u1 -m16 /dev/hda" by enabling the "(E)IDE 32-bit I/O support", enabling the "using_dma flag", setting "interrupt-unmask flag", and setting the "multiple 16 sector I/O" (dangerous!).

You can test write cache feature of a harddisk, e.g. "/dev/sda", by "hdparm -W /dev/sda". You can disable its write cache feature with "hdparm -W 0 /dev/sda".

You may be able to read badly pressed CDROMs on modern high head CD-ROM drive by slowing it down with "setcd -x 2.

9.3.8. Using SMART to predict harddisk failure

You can monitor and log your harddisk which is compliant to SMART with the smartd(8) daemon.

  1. BIOSSMART機能を有効にします。
  2. Install the smartmontools package.
  3. Identify your harddisk drives by listing them with df(1).

    • Let's assume a harddisk drive to be monitored as "/dev/hda".
  4. Check the output of "smartctl -a /dev/hda" to see if SMART feature is actually enabled.

    • If not, enable it by "smartctl -s on -a /dev/hda".
  5. Enable smartd(8) daemon to run by:

    • uncomment "start_smartd=yes" in the "/etc/default/smartmontools" file.
    • restart the smartd(8) daemon by "sudo /etc/init.d/smartmontools restart".
[ティップ] ティップ

The smartd(8) daemon can be customized with the /etc/smartd.conf file including how to be notified of warnings.

9.3.9. Expand usable storage space via LVM

For partitions created on Logical Volume Manager (Linux) at install time, they can be resized easily by concatenating extents onto them or truncating extents from them over multiple storage devices without major system reconfiguration.

[注意] 注意

Deployment of the current LVM system may degrade guarantee against filesystem corruption offered by journaled file systems such as ext3fs unless their system performance is sacrificed by disabling write cache of harddisk.

9.3.10. Expand usable storage space by mounting another partition

If you have an empty partition (e.g., "/dev/sdx"), you can format it with mkfs.ext3(1) and mount(8) it to a directory where you need more space. (You need to copy original data contents.)

$ sudo mv work-dir old-dir
$ sudo mkfs.ext3 /dev/sdx
$ sudo mount -t ext3 /dev/sdx work-dir
$ sudo cp -a old-dir/* work-dir
$ sudo rm -rf old-dir

9.3.11. Expand usable storage space using symlink

If you have an empty directory (e.g., "/path/to/emp-dir") in another partition with usable space, you can create a symlink to the directory with ln(8).

$ sudo mv work-dir old-dir
$ sudo mkdir -p /path/to/emp-dir
$ sudo ln -sf /path/to/emp-dir work-dir
$ sudo cp -a old-dir/* work-dir
$ sudo rm -rf old-dir
[注意] 注意

Some software may not function well with "symlink to a directory".

9.3.12. Expand usable storage space using aufs

If you have usable space in another partition (e.g., "/path/to/"), you can create a directory in it and stack that on to a directory where you need space with aufs.

$ sudo mv work-dir old-dir
$ sudo mkdir -p /path/to/emp-dir
$ sudo mount -t aufs -o br:/path/to/emp-dir:old-dir none work-dir
[注意] 注意

Use of aufs for long term data storage is not good idea since it is under development and its design change may introduce issues.

[ティップ] ティップ

In order to use aufs, its utility package aufs-tools and kernel module package for aufs such as aufs-modules-2.6-amd64 need to be installed.

[ティップ] ティップ

aufs is used to provide writable root filesystem by many modern live CD projects.

9.4. Data encryption tips

With physical access to your PC, anyone can easily gain root privilege and access all the files on your PC (see 「rootパスワードのセキュリティ確保」). This means that login password system can not secure your private and sensitive data against possible theft of your PC. You must deploy data encryption technology to do it. Although GNU privacy guard (see 「Data security infrastructure」) can encrypt files, it takes some user efforts.

dm-crypt and eCryptfs facilitates automatic data encryption natively via Linux kernel modules with minimal user efforts.

表9.9 List of data encryption utilities.

パッケージ popcon サイズ 機能
cryptsetup V:3, I:4 904 Utilities for encrypted block device (dm-crypt / LUKS)
cryptmount V:0.09, I:0.5 304 Utilities forencrypted block device (dm-crypt / LUKS) with focus on mount/unmount by normal users
ecryptfs-utils V:0.09, I:0.2 444 Utilities for encrypted stacked filesystem (eCryptfs)

Dm-crypt is a cryptographic filesystem using device-mapper. Device-mapper maps one block device to another.

eCryptfs is another cryptographic filesystem using stacked filesystem. Stacked filesystem stacks itself on top of an existing directory of a mounted filesystem.

[注意] 注意

Data encryption costs CPU time etc. Please weigh its benefits and costs.

[注意] 注意

Entire Debian system can be installed on a encrypted disk by the debian installer (lenny or newer) using dm-crypt/LUKS and initramfs.

[ティップ] ティップ

See 「Data security infrastructure」 for user space encryption utility: GNU Privacy Guard.

9.4.1. Removable disk encryption with dm-crypt/LUKS

You can encrypt contents of removable mass storage devices, e.g. USB memory stick on "/dev/sdx", using dm-crypt/LUKS. You simply formatting it as:

# badblocks -c 10240 -s -w -t random -v /dev/sdx
# shred -v -n 1 /dev/sdx
# fdisk /dev/sdx
... "n" "p" "1" "return" "return" "w"
# cryptsetup luksFormat /dev/sdx1
...
# cryptsetup luksOpen /dev/sdx1 sdx1
...
# ls -l /dev/mapper/
total 0
crw-rw---- 1 root root  10, 60 2008-10-04 18:44 control
brw-rw---- 1 root disk 254,  0 2008-10-04 23:55 sdx1
# mkfs.vfat /dev/mapper/sdx1
...
# cryptsetup luksClose sdx1

Then, it can be mounted just like normal one on to "/media/<disk_label>", except for asking password (see 「Removable mass storage device」) under modern desktop environment, such as GNOME using gnome-mount(1). The difference is that every data written to it is encrypted. You may alternatively format media in different file format, e.g., ext3 with "mkfs.ext3 /dev/sdx1".

[注意] 注意

If you are really paranoid for the security of data, you may need to overwrite multiple times in the above example. This operation is very time consuming though.

9.4.2. Encrypted swap partition with dm-crypt

If your original "/etc/fstab" contains:

/dev/sda7 swap sw 0 0

then you can enable encrypted swap partition using dm-crypt by as

# aptitude install cryptsetup
# swapoff -a
# echo "cswap /dev/sda7 /dev/urandom swap" >> /etc/crypttab
# perl -i -p -e "s/\/dev\/sda7/\/dev\/mapper\/cswap/" /etc/fstab
# /etc/init.d/cryptdisks restart
 ...
# swapon -a

9.4.3. Automatically encrypting files with eCryptfs

You can encrypt files written under "~/Private/" automatically using eCryptfs and the ecryptfs-utils package.

  • run ecryptfs-setup-private(1) and set up "~/Private/" by following prompts.
  • activate "~/Private/" by running ecryptfs-mount-private(1).
  • move sensitive data files to "~/Private/" and make symlinks as needed.

    • candidates: "~/.fetchmailrc", "~/.ssh/identity", "~/.ssh/id_rsa", "~/.ssh/id_dsa" and other files with "go-rwx".
  • move sensitive data directories to a subdirectory in "~/Private/" and make symlinks as needed.

    • candidates: "~/.gnupg" and other directories with "go-rwx".
  • create symlink from "~/Desktop/Private/" to "~/Private/" for easier desktop operations.
  • deactivate "~/Private/" by running ecryptfs-umount-private(1).
  • activate "~/Private/" by issuing "ecryptfs-mount-private" as you need encrypted data.
[ティップ] ティップ

Since eCryptfs selectively encrypt only the sensitive files, its system cost is much less than using dm-crypt on the entire root or home device. It does not require any special on-disk storage allocation effort but cannot keep all filesystem metadata confidential.

9.4.4. Automatically mounting eCryptfs

If you use your login password for wrapping encryption keys, you can automate mounting eCryptfs via Pluggable Authentication Module by having a following line just before "pam_permit.so" in "/etc/pam.d/common-auth" as:

auth required pam_ecryptfs.so unwrap

and the last line in "/etc/pam.d/common-session" as:

session optional pam_ecryptfs.so unwrap

and the first active line in "/etc/pam.d/common-password" as:

password required pam_ecryptfs.so

This is quite convienient.

[警告] 警告

Configuration errors of PAM may lock you out of your own system. See 4章認証.

[注意] 注意

If you use your login password for wrapping encryption keys, your encrypted data are as secure as your user login password (see 「良好なパスワード」). Unless you are careful to set up a strong password, your data will be at risk when someone runs password cracking software after stealing your laptop (see 「rootパスワードのセキュリティ確保」).

9.5. Monitoring, controlling, and starting program activities

Program activities can be monitored and controlled using specialized tools.

表9.10 List of tools for monitoring and controlling program activities

パッケージ popcon サイズ 説明
time V:7, I:85 152 time(1) runs a program to report system resource usages with respect to time.
coreutils V:91, I:99 12868 nice(1) runs a program with modified scheduling priority.
bsdutils V:71, I:99 180 renice(1) modifies the scheduling priority of a running process.
powertop V:0.6, I:11 424 powertop(1) gives information about system power use on Intel-based laptops.
procps V:87, I:99 752 The "/proc" file system utilities: ps(1), top(1), kill(1), watch(1), …
psmisc V:52, I:87 536 The "/proc" file system utilities: killall(1), fuser(1), pstree(1)
cron V:91, I:99 324 The cron(8) daemon runs processes according to a schedule (in background).
at V:54, I:83 220 at(1) or batch(1) commands run a job at a specified time or below certain load level.
lsof V:16, I:91 444 lsof(8) lists open files by a running process using "-p" option.
strace V:7, I:63 420 strace(1) traces system calls and signals.
ltrace V:0.3, I:2 228 ltrace(1) traces library calls.
xtrace V:0.02, I:0.15 204 xtrace(1) traces communication between X11 client and server.

9.5.1. Time a process

コマンドが開始したプロセスによって使われた表示時間。

# time some_command >/dev/null
real    0m0.035s       # time on wall clock (elapsed real time)
user    0m0.000s       # time in user mode
sys     0m0.020s       # time in kernel mode

9.5.2. スケジューリングのプライオリティー

A nice value is used to control the scheduling priority for the process.

表9.11 List of nice values for the scheduling priority.

nice value スケジューリングのプライオリティー
19 lowest priority process (nice)
0 very high priority process for user.
-20 very high priority process for root. (not-nice)

# nice  -19 top                                      # very nice
# nice --20 wodim -v -eject speed=2 dev=0,0 disk.img # very fast

Sometimes an extreme nice value does more harm than good to the system. Use this command carefully.

9.5.3. psコマンド

The ps(1) command on the Debian support both BSD and SystemV features and helps to identify the process activity statically.

表9.12 List of ps command styles.

style typical command feature
BSD ps aux %CPU %MEMを表示
System V ps -efH PPIDを表示

For the zombie (defunct) children process, you can kill them by the parent process ID identified in the (PPID) field.

The pstree(1) command display a tree of processes.

9.5.4. topコマンド

top(1) on the Debian has rich features and helps to identify what process is acting funny dynamically.

表9.13 topのコマンドのリスト。

command key レスポンス
h or ? To show help.
f To set/reset display field.
o To reorder display field.
F To set sort key field.
k To kill a process.
r To renice a process.
q To quit the top command.

9.5.5. List files opened by a process

You can list all files opened by a process with a process ID (PID), e.g. 1 as:

$ sudo lsof -p 1

PID=1 is usually init program.

9.5.6. Trace program activities

You can trace program activity with strace(1), ltrace(1), or xtrace(1) for system calls and signals, library calls, or communication between X11 client and server. For example:

$ sudo strace ls
...

9.5.7. Identify processes using files or sockets

You can also identify processes using files or sockets by fuser(1). For example:

$ sudo fuser -v /var/log/mail.log
                     USER        PID ACCESS COMMAND
/var/log/mail.log:   root       2946 F.... syslogd

You see that file "/var/log/mail.log" is open for writing by the syslogd(8) command.

$ sudo fuser -v smtp/tcp
                     USER        PID ACCESS COMMAND
smtp/tcp:            Debian-exim   3379 F.... exim4

Now you know your system runs exim4(8) to handle TCP connections to SMTP port (25).

9.5.8. Repeating a command with a constant interval

watch(1) executes a program repeatedly with a constant interval while showing its output in fullscreen.

$ watch w

This will display who is logged on to the system updated every 2 seconds.

9.5.9. Repeating a command looping over files

There are several ways to repeat a command looping over files matching some condition, e.g. matching glob pattern "*.ext".

for x in *.ext; do if [ -f "$x"]; then command "$x" ; fi; done
  • find(1) and xargs(1) combination:
find . -type f -maxdepth 1 -name '*.ext' -print0 | xargs -0 -n 1 command
  • find(1) with "-exec" option with a command:
find . -type f -maxdepth 1 -name '*.ext' -exec command '{}' \;
  • find(1) with "-exec" option with a short shell script:
find . -type f -maxdepth 1 -name '*.ext' -exec sh -c "command '{}' && echo 'successful'" \;

The above examples are written to ensure proper handling of funny file names such as ones containing spaces. See 「Idioms for the selection of files」 for more advance uses of find(1).

9.5.10. Starting a program from GUI

You can set up to start a process from graphical user interface (GUI).

Under GNOME desktop environment, a program program can be started with proper argument by drag-and-drop of an icon to the launcher icon or by "Open with …" menu with right clicking. KDE can do the equivalent, too. Here is an example for GNOME to set up mc(1) started in gnome-terminal(1):

  • create an executable program "mc-term" as:
# cat >/usr/local/bin/mc-term <<EOF
#!/bin/sh
gnome-terminal -e "mc \$1"
EOF
# chmod 755 /usr/local/bin/mc-term
  • create a desktop launcher

    • right clicking desktop space to select "Create Launcher …"
    • set "Type" to "Application"
    • set "Name" to "mc"
    • set "Command" to "mc-term %f"
    • click "OK"
  • create an open-with association

    • right click folder to select "Open with Other Application …"
    • click open "Use a custom command" dialog and enter "mc-term %f"
    • click "Open".
[ティップ] ティップ

Launcher is a file at "~/Desktop" with ".desktop" as its extension.

9.5.11. Customizing program to be started

Some programs start another program automatically. Here are check points for customizing this process:

  • アプリケーション設定メニュー:

    • GNOME desktop: "System" → "Preferences" → "Preferred Application"
    • KDE desktop: "K" → "Control Center" → "KDE Components" → "Component Chooser"
    • Iceweasle browser: "Edit" → "Preferences" → "Applications"
    • mc(1): "/etc/mc/mc.ext"
  • environment variables such as "$BROWSER", "$EDITOR", "$VISUAL", and "$PAGER" (see eviron(7)).
  • the update-alternatives(8) system for programs such as "editor", "view", "x-www-browser", "gnome-www-browser", and "www-browser" (see 「デフォルトのテキストエディタの設定」).
  • the "~/.mailcap" and "/etc/mailcap" file contents which associate MIME type with program (see mailcap(5)).
  • the the "~/.mime.types" and "/etc/mime.types" file contents which associate file name extension with MIME type (see run-mailcap(1)).
[ティップ] ティップ

update-mime(8) updates the "/etc/mailcap" file using "/etc/mailcap.order" file (see mailcap.order(5)).

[ティップ] ティップ

The debianutils package provides sensible-browser(1), sensible-editor(1), and sensible-pager(1) which make sensible decisions on which editor, pager, and web browser to call, respectively. I recommend you to read these shell commands.

[ティップ] ティップ

In order to run a console application such as mutt under X as your prefered application, you should create an X application as following and set "/usr/local/bin/mutt-term" as your prefered application to be started as described.

# cat /usr/local/bin/mutt-term <<EOF
#!/bin/sh
gnome-terminal -e "mutt \$@"
EOF
chmod 755 /usr/local/bin/mutt-term

9.5.12. Kill a process

Use kill(1) to kill (or send a signal to) a process by the process ID.

Use killall(1) or pkill(1) to do the same by the process command name and other attributes.

表9.14 List of frequently used signals for kill command.

signal value シグナル名 機能
1 HUP restart daemon
15 TERM normal kill
9 KILL kill hard

9.5.13. Schedule tasks once

Run the at(1) command to schedule a one-time job:

$ echo 'command -args'| at 3:40 monday

9.5.14. Schedule tasks regularly

Use cron(8) to schedule tasks regularly. See crontab(1) and crontab(5).

Run the command "crontab -e" to create or edit a crontab file to set up regularly scheduled events.

Example of a crontab file:

# use /bin/sh to run commands, no matter what /etc/passwd says
SHELL=/bin/sh
# mail any output to paul, no matter whose crontab this is
MAILTO=paul
# Min Hour DayOfMonth Month DayOfWeek command (Day... are OR'ed)
# run at 00:05, every day
5  0  *  * *   $HOME/bin/daily.job >> $HOME/tmp/out 2>&1
# run at 14:15 on the first of every month -- output mailed to paul
15 14 1  * *   $HOME/bin/monthly
# run at 22:00 on weekdays(1-5), annoy Joe. % for newline, last % for cc:
0 22 *   * 1-5 mail -s "It's 10pm" joe%Joe,%%Where are your kids?%.%%
23 */2 1 2 *   echo "run 23 minutes after 0am, 2am, 4am ..., on Feb 1"
5  4 *   * sun echo "run at 04:05 every sunday"
# run at 03:40 on the first Monday of each month
40 3 1-7 * *   [ "$(date +%a)" == "Mon" ] && command -args
[ティップ] ティップ

For the system not running continuously, install the anacron package to schedule periodic command at the specified intervals as closely as machine-uptime permits.

9.5.15. Alt-SysRq

Insurance against system malfunction is provided by the kernel compile option "Magic SysRq key" (SAK key) which is now the default for the Debian kernel. Pressing Alt-SysRq followed by one of the following keys does the magic of rescuing control of the system:

表9.15 List of SAK command keys.

key following Alt-SysRq 機能
r Unraw restores the keyboard after things like X crashes.
0 Changing the console loglevel to 0 reduces error messages.
k SAK (system attention key) kills all processes on the current virtual console.
e Send a SIGTERM to all processes, except for init(8).
i Send a SIGKILL to all processes, except for init(8).
s Sync all mounted filesystems.
u Remount all mounted filesystems read-only (umount).
b Reboot the system without syncing or unmounting.

The combination of "Alt-SysRq s", "Alt-SysRq u", and "Alt-SysRq r" is good for getting out of really bad situations.

See "/usr/share/doc/linux-doc-2.6.*/Documentation/sysrq.txt.gz".

[注意] 注意

The Alt-SysRq feature may be considered a security risk by allowing users access to root-privileged functions. Placing "echo 0 >/proc/sys/kernel/sysrq" in "/etc/rc.local" or "kernel.sysrq = 0" in "/etc/sysctl.conf" will disable the Alt-SysRq feature.

[ティップ] ティップ

From SSH terminal etc., you can use the Alt-SysRq feature by writing to the "/proc/sysrq-trigger". For example, "echo s > /proc/sysrq-trigger; echo u > /proc/sysrq-trigger" from the root shell prompt will sync and umount all mounted filesystems.

9.6. System maintenance tips

9.6.1. Who is logged on

You can check who is logged on to the system with w(1) or who(1).

9.6.2. Warn everyone

You can send message to everyone who is logged on to the system with wall(1):

$ echo "We are shutting down in 1 hour" | wall

9.6.3. Hardware identification

For the PCI-like devices (AGP, PCI-Express, CardBus, ExpressCard, etc.), lspci(8) (probably with "-nn" option) is a good start for the hardware identification

Alternatively, you can identify the hardware by reading contents of "/proc/bus/pci/devices" or browsing directory tree under "/sys/bus/pci" (see 「procfsとsysfs」).

表9.16 List of hardware identification tools.

パッケージ popcon サイズ 説明
pciutils V:16, I:92 780 Linux PCI Utilities, lspci(8)
usbutils V:38, I:97 548 Linux USB utilities, lsusb(8)
pcmciautils V:0.9, I:14 172 PCMCIA utilities for Linux 2.6, pccardctl(8)
scsitools V:0.2, I:1.3 484 Collection of tools for SCSI hardware management, lsscsi(8)
pnputils V:0.02, I:0.2 108 Plug and Play BIOS utilities, lspnp(8)
procinfo V:0.5, I:4 164 Displays system information from "/proc", lsdev(8)
lshw V:1.1, I:6 804 Information about hardware configuration, lshw(1)
discover V:4, I:14 928 Hardware identification system, discover(8)

9.6.4. ハードウエア設定

Although most of the hardware configuration on modern GUI desktop systems such as GNOME and KDE can be managed through accompanying GUI configuration tools, it is a good idea to know some basics methods to configure them.

表9.17 List of hardware configuration tools.

パッケージ popcon サイズ 説明
hal V:45, I:58 1844 Hardware Abstraction Layer, lshal(1)
console-tools V:59, I:95 948 Linux console font and keytable utilities.
x11-xserver-utils V:32, I:46 648 X server utilities. xset(1) and xmodmap(1).
acpid V:55, I:90 200 Daemon to manage events delivered by the Advanced Configuration and Power Interface (ACPI)
acpi V:3, I:33 92 Utilities for ACPI devices
apmd V:1.2, I:12 144 Daemon to manage events delivered by the Advanced Power Management (APM)
powersaved V:0.7, I:0.9 1800 Daemon to manage battery, temperature, ac, cpufreq (SpeedStep, Powernow!) control and monitor with ACPI and APM supports.
noflushd V:0.07, I:0.14 244 Allow idle hard disks to spin down
sleepd V:0.07, I:0.11 92 Puts a laptop to sleep during inactivity
hdparm V:13, I:34 284 Hard disk access optimization. Very effective but dangerous. You must read hdparm(8) first.
smartmontools V:6, I:18 828 Control and monitor storage systems using S.M.A.R.T.
setserial V:2, I:4 176 Collection of tools for serial port management.
memtest86+ V:0.5, I:4 384 Collection of tools for memory hardware management.
scsitools V:0.2, I:1.3 484 Collection of tools for SCSI hardware management.
tpconfig V:0.4, I:0.5 208 A program to configure touchpad devices
setcd V:0.08, I:0.4 28 Compact disc drive access optimization.
big-cursor I:0.19 68 Larger mouse cursors for X

Here, ACPI is a newer framework for the power management system than APM.

9.6.5. System and hardware time

The following will set system and hardware time to MM/DD hh:mm, CCYY.

# date MMDDhhmmCCYY
# hwclock --utc --systohc
# hwclock --show

Times are normally displayed in the local time on the Debian system but the hardware and system time usually use UTC.

If the hardware (BIOS) time is set to GMT, change the setting to "UTC=yes" in the "/etc/default/rcS".

If you wish to update system time via network, consider to use the NTP service with the packages such as ntp, ntpdate, and chrony. See:

[ティップ] ティップ

ntptrace(8) in the ntp package can trace a chain of NTP servers back to the primary source.

9.6.6. ターミナルの設定

There are several components to configure character console and ncurses(3) system features:

  • the "/etc/terminfo/*/*" file (terminfo(5))
  • the "$TERM" environment variable (term(7))
  • setterm(1), stty(1), tic(1), and toe(1)

If the terminfo entry for xterm doesn't work with a non-Debian xterm, change your terminal type, "$TERM", from "xterm" to one of the feature-limited versions such as "xterm-r6" when you log in to a Debian system remotely. See "/usr/share/doc/libncurses5/FAQ" for more. "dumb" is the lowest common denominator for "$TERM".

9.6.7. The sound infrastructure

Device drivers for sound cards for current Linux 2.6 are provided by Advanced Linux Sound Architecture (ALSA). ALSA provides emulation mode for previous Open Sound System (OSS) for compatibility.

Run "dpkg-reconfigure linux-sound-base" to select the sound system to use ALSA via blacklisting of kernel modules. Unless you have very new sound hardware, udev infrastructure should configure your sound system.

[ティップ] ティップ

Use "cat /dev/urandom > /dev/audio" or speaker-test(1) to test speaker. (^C to stop)

[ティップ] ティップ

If you can not get sound, your speaker may be connected to a muted output. Modern sound system has many outputs. alsamixer(1) in the alsa-utils package is useful to configure volume and mute settings.

Application softwares may be configured not only to access sound devices directly but also to access them via some standardized sound server system.

表9.18 サウンドパッケージのリスト。

パッケージ Popcon サイズ 説明
linux-sound-base V:42, I:55 136 Base package for ALSA and OSS sound systems
alsa-base V:3, I:54 464 ALSA driver configuration files
alsa-utils V:38, I:55 1964 Utilities for configuring and using ALSA
oss-compat V:26, I:33 60 OSS compatibility under ALSA preventing "/dev/dsp not found" errors
esound-common V:13, I:63 193 Enlightened Sound Daemon (ESD) common (Enlightenment and GNOME)
esound V:2, I:17 48 Enlightened Sound Daemon (ESD) server (Enlightenment and GNOME)
esound-clients V:8, I:21 140 Enlightened Sound Daemon (ESD) client (Enlightenment and GNOME)
libesd-alsa0 V:2, I:4 60 Enlightened Sound Daemon (ESD) library Enlightenment and GNOME)
libesd0 V:3, I:59 52 Enlightened Sound Daemon (ESD) library (Enlightenment and GNOME) - OSS
arts I:13 40 aRtsサーバー(KDE)
libarts1c2a V:21, I:38 6064 aRtsライブラリー(KDE)
libartsc0 V:18, I:44 76 aRtsライブラリー(KDE)
jackd V:1.8, I:5 400 JACK Audio Connection Kit. (JACK) server (low latency)
libjack0 V:5, I:38 540 JACK Audio Connection Kit. (JACK) library (low latency)
libjack0.100.0-0 I:17 48 JACK Audio Connection Kit. (JACK) library (low latency)
nas V:0.19, I:0.2 328 Network Audio System (NAS) server
libaudio2 V:29, I:55 204 Network Audio System (NAS) library
pulseaudio V:2, I:4 3440 PulseAudio server, replacement for ESD
libpulse0 V:7, I:34 752 PulseAudio client library, replacement for ESD
libpulsecore9 I:0.9 NOT_FOUND PulseAudio server library, replacement for ESD
libgstreamer0.10-0 V:29, I:57 2960 GStreamer: GNOME sound engine
libxine1 V:6, I:40 24 xine: KDE older sound engine
libphonon4 I:11 556 Phonon: KDE new sound engine

There is usually a common sound engine for each popular desktop environment. Each sound engine used by the application can choose to connect to different sound servers.

9.6.8. Disable the screen saver

For disabling the screen saver, use following commands.

表9.19 List of commands for disabling the screen saver.

environment コマンド
The Linux console setterm -powersave off
The X Window by turning off screensaver xset s off
The X Window by disabling dpms xset -dpms
The X Window by GUI configuration of screen saver xscreensaver-command -prefs

9.6.9. Disable the sound (beep)

One can always unplug the PC speaker. ;-) Removing pcspkr kernel module does this for you.

The following will prevent the readline(3) program used by bash(1) to beep when encountering "\a" (ASCII=7):

$ echo "set bell-style none">> ~/.inputrc

9.6.10. 使用メモリ

The kernel boot message in the "/var/log/dmesg" contains the total exact size of available memory.

free(1) and top(1) display information on memory resources on the running system.

$ grep '\] Memory' /var/log/dmesg
[    0.004000] Memory: 990528k/1016784k available (1975k kernel code, 25868k reserved, 931k data, 296k init)
$ free -k
             total       used       free     shared    buffers     cached
Mem:        997184     976928      20256          0     129592     171932
-/+ buffers/cache:     675404     321780
Swap:      4545576          4    4545572

For my MacBook with 1GB=1048576k DRAM (video system steals some of this):

表9.20 List of memory sizes reported.

報告 サイズ
Total size in dmesg 1016784k = 1GB - 31792k
Free in dmesg 990528k
Total under shell 997184k
Free under shell 20256k

Do not worry about the large size of "used" and the small size of "free" in the "Mem:" line, but read the one under them (675404 and 321780 in the example below) and relax.

9.6.11. System security and integrity check

Poor system maintenance may expose your system to external exploitation.

For system security and integrity check, you should start with:

表9.21 システムセキュリティや整合性確認のためのツールリスト

パッケージ popcon サイズ 説明
logcheck V:3, I:4 264 This mails anomalies in the system logfiles to the administrator
debsums V:2, I:3 264 こうしてインストールされたパッケージファイルはMD5チェックサムを使って検証されます。
chkrootkit V:2, I:6 864 ルートキット検出器。
clamav V:2, I:11 504 Unix用アンチウィルスユーティリティー -- コマンドラインインターフェース
tiger V:0.8, I:1.0 3088 Report system security vulnerabilities
tripwire V:0.6, I:0.8 5020 ファイルやディレクトリの整合性チェッカー
john V:0.5, I:2 476 Active password cracking tool
aide V:0.3, I:0.5 1112 Advanced Intrusion Detection Environment - static binary
bastille V:0.19, I:0.5 1960 セキュリティ強化ツール
integrit V:0.10, I:0.2 440 A file integrity verification program
crack V:0.05, I:0.2 204 Password guessing program

Here is a simple script to check for typical world writable incorrect file permissions.

# find / -perm 777 -a \! -type s -a \! -type l -a \! \( -type d -a -perm 1777 \)
[注意] 注意

Since the debsums package uses MD5 checksums stored locally, it can not be fully trusted as the system security audit tool against malicious attacks.

9.7. カーネル

Debian distributes modularized Linux kernel as packages for supported architectures.

9.7.1. Linux kernel 2.6

There are few notable features on Linux kernel 2.6 compared to 2.4.

  • Devices are created by the udev system (see 「udevシステム」).
  • Read/write accesses to IDE CD/DVD devices do not use the ide-scsi module.
  • Network packet filtering functions use iptable kernel modules.

9.7.2. Kernel headers

Most normal programs don't need kernel headers and in fact may break if you use them directly for compiling. They should be compiled against the headers in "/usr/include/linux" and "/usr/include/asm" provided by the libc6-dev package (created from the glibc source package) on the Debian system.

[注意] 注意

For compiling some kernel-specific programs such as the kernel modules from the external source and the automounter daemon (amd), you must include path to the corresponding kernel headers, e.g. "-I/usr/src/linux-particular-version/include/", to your command line. module-assistant(8) (or its short form m-a) helps users to build and install module package(s) easily for one or more custom kernels.

9.7.3. Kernel and module compile

Debian has its own method of compiling the kernel and related modules.

表9.22 Debianシステム上でカーネルの再コンパイルためにインストールする重要パッケージのリスト

パッケージ popcon サイズ 説明
build-essential I:45 48 essential packages for building Debian packages: make, gcc, …
bzip2 V:57, I:80 132 compress and decompress utilities for bz2 files
libncurses5-dev V:4, I:27 6724 developer's libraries and docs for ncurses
git-core V:6, I:10 14344 git: distributed revision control system used by the Linux kernel
fakeroot V:4, I:27 444 provide fakeroot environment for building package as non-root
initramfs-tools V:35, I:97 420 tool to build an initramfs (Debian specific)
kernel-package V:2, I:18 2340 tool to build Linux kernel packages (Debian specific)
module-assistant V:4, I:22 540 tool to help build module packages (Debian specific)
devscripts V:2, I:13 1656 helper scripts for a Debian Package maintainer (Debian specific)
linux-tree-2.6.* N/A N/A Linuxカーネルのソースツリーのメタパッケージ(Debian固有)

If you use initrd in 「2段目: ブートローダ」, make sure to read the related information in initramfs-tools(8), update-initramfs(8), mkinitramfs(8) and initramfs.conf(5).

[警告] 警告

Do not put symlinks to the directories in the source tree (e.g. "/usr/src/linux*") from "/usr/include/linux" and "/usr/include/asm" when compiling the Linux kernel source. (Some outdated documents suggest this.)

[注意] 注意

When compiling the latest Linux kernel on the Debian stable system, the use of backported latest tools from the Debian unstable may be needed.

9.7.4. Kernel source compile: Debian standard method

The Debian standard method for compiling kernel source to create a custom kernel package uses make-kpkg(1). The official documentation is in (the bottom of) "/usr/share/doc/kernel-package/README.gz". See kernel-pkg.conf(5) and kernel-img.conf(5) for customization.

Here is an example for amd64 system:

# aptitude install linux-tree-<version>
$ cd /usr/src
$ tar -xjvf linux-source-<version>.tar.bz2
$ cd linux-source-<version>
$ cp /boot/config-<oldversion> .config
$ make menuconfig
 ...
$ make-kpkg clean
$ fakeroot make-kpkg --append_to_version -amd64 --initrd --revision=rev.01 kernel_image modules_image
$ cd ..
# dpkg -i linux-image*.deb
  • reboot to new kernel with "shutdown -r now" .
[注意] 注意

When you intend to create a non-modularized kernel compiled only for one machine, invoke make-kpkg without "--initrd" option since initrd is not used. Invocation of "make oldconfig" and "make dep" are not required since "make-kpkg kernel_image" invokes them.

9.7.5. Module source compile: Debian standard method

The Debian standard method for creating and installing a custom module package for a custom kernel package uses module-assistant(8) and module-source packages. For example, following will build the unionfs kernel module package and installs it.

$ sudo aptitude install module-assistant
...
$ sudo aptitude install unionfs-source unionfs-tools unionfs-utils
$ sudo m-a update
$ sudo m-a prepare
$ sudo m-a auto-install unionfs
...
$ sudo apt-get autoremove

9.7.6. Kernel source compile: classic method

You can still build Linux kernel from the pristine sources with the classic method. You must take care the details of the system configuration manually.

$ cd /usr/src
$ wget http://www.kernel.org/pub/linux/kernel/v2.6/linux-<version>.tar.bz2
$ tar -xjvf linux-<version>.tar.bz2
$ cd linux-<version>
$ cp /boot/config-<version> .config
$ make menuconfig
 ...
$ make dep; make bzImage
$ make modules
# cp ./arch/x86_64/boot/bzImage /boot/vmlinuz-<version>
# make modules_install
# depmod -a
# update-initramfs -c -k <version>
  • set up bootloader

    • edit "/etc/lilo.conf" and run "/sbin/lilo", if you use lilo.
    • edit "/boot/grub/menu.lst", if you use grub.
  • reboot to new kernel with "shutdown -r now".

9.7.7. Non-free hardware drivers

Although most of hardware drivers are available as free software and as a part of the Debian system, you may need to load some non-free external drivers to support some hardwares, such as Winmodem, on your system.

Check pertinent resources:

9.8. 仮想化システム

Use of virtualized system enables us to run multiple instances of system simultaneously on a single hardware.

9.8.1. 仮想化ツール

仮想化には2つの段階があります:

  • create file system populated with required package data. Programs such as debootstrap and cdebootstrap helps this process.
  • run a program under virturized environment. Most basic method is provided by chroot.

There are several system virtualization and emulation related packages in Debian beyond simple chroot. Some packages also help you to setup such system.

表9.23 List of virtualization tools

パッケージ Popcon サイズ 説明
schroot V:1.0, I:1.6 1988 Specialized tool for executing Debian binary packages in chroot
sbuild V:0.07, I:0.3 408 Tool for building Debian binary packages from Debian sources
pbuilder V:0.4, I:2 1112 Debianパッケージの個人的なパッケージビルダー
debootstrap V:1.7, I:12 260 Bootstrap a basic Debian system (written in sh)
cdebootstrap V:0.5, I:2 112 Bootstrap a Debian system (written in C)
rootstrap V:0.03, I:0.2 156 A tool for building complete Linux filesystem images
user-mode-linux V:0.10, I:0.5 17828 User-mode Linux (kernel)
xen-tools V:0.3, I:2 996 Tools to manage debian XEN virtual server
bochs V:0.09, I:0.5 3360 Bochs: IA-32 PC emulator
qemu V:1.2, I:6 43984 Qemu: fast generic processor emulator
virtualbox-ose V:2, I:3 22944 VirtualBox: x86 virtualization solution on i386 and amd64
wine V:1.6, I:16 64 Wine: Windows API Implementation (standard suite)
dosbox V:0.6, I:3 2240 DOSBox: x86 emulator with Tandy/Herc/CGA/EGA/VGA/SVGA graphics, sound and DOS
util-vserver V:0.8, I:1.1 2388 Linux-VServer virtual private servers - user-space tools
vzctl V:0.5, I:1.0 1148 OpenVZ server virtualization solution - control tools
vzquota V:0.5, I:1.0 272 OpenVZ server virtualization solution - quota tools

See Wikipedia article Comparison of virtual machines for detail comparison of different virtualization solutions.

9.8.2. Chrootシステム

chroot(8) offers most basic way to run different instances of the GNU/Linux environment on a single system simultaneously without rebooting.

[注意] 注意

Examples below assumes both parent system and chroot system share the same CPU architecture.

You can learn how to setup and use chroot(8) by running pbuilder(8) program under script(1) as follows.

$ sudo mkdir /sid-root
$ sudo pbuilder --create --no-targz --debug --buildplace /sid-root

debootstrap(8)かdebootstrap(1)が、"sid-root"の下にsid環境のためのシステムデータをどのようにして埋め込んでいくかが分かります。

[ティップ] ティップ

These debootstrap(8) or debootstrap(1) are used to install Debian by the Debian Installer. These can also be used to install Debian to a system without using a Debian install disk, but instead from another GNU/Linux distribution.

$ sudo pbuilder --login --no-targz  --debug --buildplace /sid-root

You will see how a system shell running under sid environment is created:

  • ローカル設定のコピー("/etc/hosts"と"/etc/hostname"と"/etc/resolv.conf")
  • "/proc"ファイルシステムのマウント
  • "/dev/pts"ファイルシステムのマウント
  • "/usr/sbin/policy-rc.d"が作成される(これは常に101でプログラム終了する)
  • run "chroot /sid-root bin/bash -c 'exec -a -bash bin/bash'"
[注意] 注意

プログラムによっては機能するためにchrootの下でpbuilderが提供するより多くの親システムのファイルへのアクセスする必要があります。例えば、"/sys"や"/etc/passwd"や"/etc/group"や"/var/run/utmp"や"/var/log/wtmp"等がbindマウントもしくはコピーされる必要があるかもしれません。

[注意] 注意

"/usr/sbin/policy-rc.d"ファイルは、Debianシステム上でデーモンプログラムが自動的に起動されることを防ぎます。"/usr/share/doc/sysv-rc/README.policy-rc.d.gz"を参照下さい。

[ティップ] ティップ

The original purpose of the specialized chroot package, pbuilder is to construct a chroot system and builds a package inside the chroot. It is an ideal system to use to check that a package's build-dependencies are correct, and to be sure that unnecessary and wrong build dependencies will not exist in the resulting package.

[ティップ] ティップ

Similar schroot package may give you an idea to run i386 chroot system under amd64 parent system.

[ティップ] ティップ

By installing a system into a separate partition using the installer of other distributions and using this system for chroot(8), you can run other distributions under chroot(8).

9.8.3. Setting up login for chroot

You can run another login process on a separate virtual terminal where you can log in to the chroot system directly. Since on default Debian systems tty1 to tty6 run Linux consoles and tty7 runs the X Window System, let's set up tty8 for a chrooted console as an example. After creating a sid chroot system under "/sid-root" by following steps you learned from pbuilder(8), type from the root shell of the main system:

main # echo "8:23:respawn:/usr/sbin/chroot /sid-root /sbin/getty 38400 tty8"  >> /etc/inittab
main # init q
  • reload init