I would like to get as close as possible to a perfect score with Guide to the Secure Configuration of AlmaLinux OS 8 with profile Protection Profile for General Purpose Operating Systems.
To do that, I would need to create separate partitions for the following directories.
/home
/var
/var/log
/var/audit/log
/var/tmp
Is this possible? I tried to create these partitions using the cloud-init functionality during first boot from the SD card and was unable to create these partitions.
Red Hat wrote in a RHEL 8 guide (that google now fails to find):
If /usr or /var is partitioned separately from the rest of the root volume, the boot process becomes much more complex because these directories contain boot-critical components.
The apparent reason for those is that /bin and /sbin are mere symlinks to /usr/bin and /usr/sbin, so if early boot uses commands from the former, the /usr must be mounted. Similarly, /var/run and /var/lock are symlinks and services that have not been updated yet to use directly what they point to need the /var mounted.
The guide did not say how to modify the boot process to cope with that.
On “normal” install with install media one would do the partitioning interactively, or with kickstart config. The installer does the partitioning before anything else is written to target storage. That is “before first boot”.
I’ve used cloud-init only to modify installed configuration. That happened after install and install was made from pre-created cloud image – including the partitioning.
I do these kind of splits all the time, but during installation, using the installer.
Occasionally, I’ve split out further post-install, but that’s generally for some /var/lib subdirectory where whatever’s using it can be definitively stopped, moved to its own filesystem, and restarted. That would be difficult to negotiate with /var itself. You’d probably need to do it offline (e.g. from a rescue disk) and even then I’m not sure if there’s magic the installer does to overcome the complexity jlehtone cites, which you might then need to reproduce. I imagine it could be like when you change the name of a boot VG and have to do it in several different places to end up with a bootable system.
Best bet would be to have already made such splits, during installation.