Puppy Linux Discussion Forum

I need a Linux live system that meets the following requirements:

- allows to create non-sudo users without privileges
- allows to install latest browser versions (Firefox, Chrome/Chromium), make configuration changes to those browsers and install plugins
- remaster those changes and create a Live-CD which can be loaded into RAM and execute customized browsers under the non-sudo user account

I appreciate your feedback.

You can try DVD multisession. Fatdog supports it OOTB.
If it works on a particular machine, it is relatively easy:

Download latest (Fatdog64 812) .iso (check md5sum to be sure the download was ok).

Burn the .iso as image on the DVD+RW (I used Pburn program in Fatdog; DO NOT close the disc).

Boot the machine and choose multisession support on the welcome screen (every time you boot).

Do settings you want (keyboard layout, internet connection etc.).

Important setting: go to fatdog control panel->system->fatdog event manager and set "RAM save interval" to zero.
It will save session (as .sfs) back to the DVD+RW only when you press the button "save session" on the desktop, so you have control over that.

To activate firewall, go to fatdog control panel->system->manage servers and services->eztables (start it and allow it at boot).

Fatdog has installer/updater for Firefox, Chrome and Seamonkey.
Go to fatdog control panel->system->third party software installers and choose what you want.

All the internet apps in Fatdog run as spot by default and the “meeting point” with the filesystem is /home/spot folder (so the spot is not under /root, which should be better).

The system will load all the .sfs’s with changes from DVD+RW (previously created by pressing save session button) during boot and will run entirely in ram.
Although the DVD+RW is not read-only (in comparison to CD), it can be removed from the optical drive after boot (or after saving session).

To have the system clean, do the settings (update of a browser etc.) and saving sessions immediatelly after boot (before you go to the internet).

More information (DVD multisession described in chapter 5.):
https://distro.ibiblio.org/fatdog/web/faqs/faq.html

Is it possible to create a non-sudo user account and save it with all program customizations on a multisession DVD? I don't want to be auto-logged in as root.

Running the browser as spot under root unfortunately does not work for me. I am a bit concerned getting the image on my DVD corrupted, but if I understand you correctly, the DVD can be removed after the boot process.

And I would then simply not save the session during normal operation when I shut the system down. So I only safe the first session with my customizations.

Thanks for your advice.

Neo_78 wrote: Sun Jan 09, 2022 12:20 am

Is it possible to create a non-sudo user account and save it with all program customizations on a multisession DVD? I don't want to be auto-logged in as root.

I don't know.
Maybe someone from Fatdog team could advise you whether it is possible.

I am a bit concerned getting the image on my DVD corrupted, but if I understand you correctly, the DVD can be removed after the boot process.

Yes, the DVD can be removed after the boot process.

Is it possible to create a non-sudo user account and save it with all program customizations on a multisession DVD? I don't want to be auto-logged in as root.

See here:

http://distro.ibiblio.org/fatdog/web/faqs/login.html

How secure do you need to be? And how good is your internet?

If you want to have a safe browser, boot into a virgin install, then connect to the internet and download your browser of choice, install addons and run your session. When you shutdown, don't save your session and nothing is remembered. You can boot from DVD or USB and have NO hard drive installed, no remove the boot media whilst running. Zero chance of infection

I've recently set up a couple of laptops. I have moderate (50mbps) internet, this process takes less than 5 minutes for me to install Chrome and do what I need to do.

I have normal broadband internet.

I would like a user account with 0 privileges who cannot install programs or modify the base system. Only browser execution should be possible.

What I would like to avoid is having to download the browser and implement my customizations every day. So either this should be automated with a script or I would like to set it up once and then save my changes and directly boot into the customized OS version with the non-sudo account.

@Feek I followed your instructions and burned the latest FatDog64 iso to a DVD-R (unfortunately didn't have a DVD+RW available) using pBurn in Puppy Linux. I left the close option unchecked.

I booted in multisession mode, configured the system, installed latest Firefox / Chrome. I also created a standard user and changed the login option as explained in the documentation shared by @p310don.

I then used the "Save Session" icon on the desktop, which saved the changes back to the DVD. I then tried to reboot from the DVD, but it just shows "Checking media_", shuts down and restarts in a circle over again.

So I guess the save session operation was not succesful and corrupted the image. Is it possible that it does not work with DVD-R and I need to get a DVD+RW? According to the documentation, it should work:

"Note 1: The following optical disc types have been tested and known to work: DVD+RW, DVD+R, DVD-R. CDs are not supported."

https://distro.ibiblio.org/fatdog/web/f ... drive.html

Neo_78 wrote: Sun Jan 09, 2022 12:50 pm

I would like a user account with 0 privileges who cannot install programs or modify the base system. Only browser execution should be possible.

What I would like to avoid is having to download the browser and implement my customizations every day. So either this should be automated with a script or I would like to set it up once and then save my changes and directly boot into the customized OS version with the non-sudo account.

Hi Neo_78,

@P310Don linked to a good document. It answers some of your needs. You can create a user with diminished permissions. You can automatically boot to that user. You can change the root password and not supply it to the end user. Do you want the end user to be able to save files or download content?

In the Fatdog Control Panel under the Utilities tab is the Fatdog64 Remaster Live CD utility. Once you have tweaked your new system to your liking, including installing a browser of your choice and removing such programs as you see fit, possibly including removing Gslapt installer, and adjusted the user's permissions as needed, you can use the Remaster utility to create a bootable image that ought to meet your needs. You would not want to use a rewritable CD. There are probably details pertaining to your needs that I don't know about, but this is a general framework that ought to be satisfactory. Fatdog64 is very tweakable.

Once you have created the remastered .iso, you can boot into it, remove the media, and it will be fresh and identical every time you do. You could arrange to allow access to a hard disk or removable media, or not, including hiding desktop icons if need be. You would not want to use the multi-session feature, and you would not want to use, and ought to disable, the savefile creation process at shutdown (/usr/sbin/savefile.sh).

Edit: I read a bit from your general Puppy thread, and understand better what you are trying to accomplish. Fatdog64 also has enhanced security options that might serve your needs. You can read about the sandbox and UML options here and here.

I expect that one of the Fatdog team will add useful details to lead you to a good result.

Dan

Neo_78 wrote: Sun Jan 09, 2022 5:22 pm

I then used the "Save Session" icon on the desktop, which saved the changes back to the DVD. I then tried to reboot from the DVD, but it just shows "Checking media_", shuts down and restarts in a circle over again.

So I guess the save session operation was not succesful and corrupted the image. Is it possible that it does not work with DVD-R and I need to get a DVD+RW? According to the documentation, it should work:

"Note 1: The following optical disc types have been tested and known to work: DVD+RW, DVD+R, DVD-R. CDs are not supported."

https://distro.ibiblio.org/fatdog/web/f ... drive.html

Hello Neo_78,

Multisession sfs works great on my laptop.
I started with DVD+RW and later set up multisession sfs on hard disk and usb stick (the stick can also -as the DVD- be removed after the boot process, if you set it up correctly).
Booting from an optical drive is slower and noisier, so now I use DVD booting only as a backup system.

I read somewhere that DVD+RWs are better in some ways.
The "+" and "-" characters on a DVD probably determine some of their properties, especially the technique used to determine the location of the data on the disc.
It may also depend on the hardware.

As dr__Dan wrote, Fatdog can also be remastered.
With these versatile operating systems, you have many techniques and ways to use them.

@dr__Dan Sorry for all the questions. I was able to create a non-root user and found the options to change the default login behaviour. I want the non-root user only be able to browse the internet with a custom-configured Firefox or Chrome browser. Ideally this user should not be able to save or download files nor be able to configure the system -> no sudo access. Do you know how the permissions can be adjusted in more detail and from which groups this user should be removed?

In a normal Linux system, if you install a program under root, it will also be available under the non-root account, but you have to access that non-root account in order to make and save customizations for that user. Because I would like to install plugins for Firefox / Chrome and create a custom configuration for that user, which ideally should be saved and not repeated ever day. So I am not sure how FatDog behaves in this regard ?!?

How do I remove the Gslapt installer or other unwanted programs?

Using the Remaster Live CD utility, can the created iso directly be burned in the same session? I am currently running FatDog in RAM using a Live-DVD without connected hard drives. Is it possible to use a CD or do I need a DVD?

Also, the Remaster Fatdog64 tool is asking for the exact location of the kernel (vmlinuz). Where can this be found? Is the location if EFI boot image (efiboot.img) required and where is the location?

Where do I disable the savefile creation process at shutdown?

Can the host name be customized for the remastered version? Saving the host name usually requires a reboot so all changes would be lost I guess...

@Feek After testing a bit more, I think only DVD+RW is working for multisession but that could be hardware specific. Using the remastering tool is probably the way to go for me.

Thanks for everyone's help and input. It's much appreciated.

---

Update 1: I was able to organize a DVD+RW, which are quiet difficult to obtain nowadays. After booting into multisession mode and implementing my changes, I was able to burn my changes back to the DVD (at least the DVD shows additional burn rings). However, when I boot the machine again in multisession mode, it does no show the graphical login screen as configured and boots back into the default root account without any changes. As if it does not find the saved changes on boot. What am I doing wrong?

Update 2:
I tried to use the "Remaster FatDog" CD tool to create an iso with my customizations. The burned DVD takes me to the initial remaster boot screen and then reloads ever 10 seconds. I guess the problem is that I could not specify the vmlinuz location during image creation. How do I find the correct location? Is the EFI boot image required and if yes how do I find the location to include it in the image?

Neo_78 wrote: Mon Jan 10, 2022 1:30 pm

@dr__Dan Sorry for all the questions. I was able to create a non-root user and found the options to change the default login behaviour. I want the non-root user only be able to browse the internet with a custom-configured Firefox or Chrome browser. Ideally this user should not be able to save or download files nor be able to configure the system -> no sudo access. Do you know how the permissions can be adjusted in more detail and from which groups this user should be removed?

First, I'm getting beyond my knowledge and experience, so I hope that some of the Fatdog team will chime in with better information.

I think it would be best to start with a no-savefile session, unless you have a session that has been devoted to nothing but creating the new .iso setup. Create your user, adjust as needed. Switch to that user for whatever adjustments you need there. I suppose that the user's file system permissions could be adjusted to disallow writing by any user. I don't know enough about permissions to guide you in that. We'll address sudo below

In a normal Linux system, if you install a program under root, it will also be available under the non-root account, but you have to access that non-root account in order to make and save customizations for that user. Because I would like to install plugins for Firefox / Chrome and create a custom configuration for that user, which ideally should be saved and not repeated ever day. So I am not sure how FatDog behaves in this regard ?!?

You could install and configure the programs you want prior to remastering, and they would be ready to go at every boot.

How do I remove the Gslapt installer or other unwanted programs?

As root, open Gslapt and remove unwanted programs. Be cautious of what you remove, as it could affect your system in unwanted manners. There are important scripts in /usr/bin and /usr/sbin. For example, /usr/sbin/savefile.sh is the script I mentioned before that handles checking for and proffering a savefile at shutdown, and it would be convenient to remove it for the purposes of your remaster. There is a substitute for sudu (which root doesn't need, but is useful in certain circumstances), but I don't remember the details. Removing /usr/bin/sudo might be enough, but I'm mostly ignorant of the workings of it all. When your removing of features is done, remove /usr/sbin/gslapt and /usr/sbin/gslapt.sh to avoid later additions by that method.

Using the Remaster Live CD utility, can the created iso directly be burned in the same session? I am currently running FatDog in RAM using a Live-DVD without connected hard drives. Is it possible to use a CD or do I need a DVD?

Yes, I think in the same session. I think a CD is too small for the .iso image, so you'll need a DVD.

Also, the Remaster Fatdog64 tool is asking for the exact location of the kernel (vmlinuz). Where can this be found? Is the location if EFI boot image (efiboot.img) required and where is the location?

In a live DVD session, vmlinuz should be at /mnt/sr0/vmlinuz, i.e. on the DVD or flash drive, so you'll want to copy it from the DVD you booted with, or otherwise place it somewhere accessible before you create the remaster.

Where do I disable the savefile creation process at shutdown?

/usr/sbin/savefile.sh, see above.

Can the host name be customized for the remastered version? Saving the host name usually requires a reboot so all changes would be lost I guess...

I don't know.

Update 2:
I tried to use the "Remaster FatDog" CD tool to create an iso with my customizations. The burned DVD takes me to the initial remaster boot screen and then reloads ever 10 seconds. I guess the problem is that I could not specify the vmlinuz location during image creation. How do I find the correct location? Is the EFI boot image required and if yes how do I find the location to include it in the image?

If you are able to boot in a non-EFI manner, you shouldn't need the EFI features. They may well be automatic, but that is mostly a guess.

Dan

@dr__Dan following your instructions I was able to burn a bootable remaster with a non-root user.

The only thing that does not work during the initial live session is desktop switching, which is explained under "How to launch a secondary desktop?":

https://distro.ibiblio.org/fatdog/web/faqs/login.html

It simply does not start the second desktop so that I can make the required customizations for that user.

Desktop switching also does not work on the remastered DVD, where you have a login option in the menu to switch users. This option is not available in the initital live session.

Do you have an idea how to switch users during the initial live session?

If I switch users in the terminal and run startx, I get the following error:

xauth: file /home/user/.serverauth.4112 does not exist
xauth: file /home/user/.Xauthority does not exist

xinit: giving up
xinit: unable to connect to X server: Connection refused
xinit: server error

Neo_78 wrote: Mon Jan 10, 2022 1:30 pm

Update 1: I was able to organize a DVD+RW, which are quiet difficult to obtain nowadays. After booting into multisession mode and implementing my changes, I was able to burn my changes back to the DVD (at least the DVD shows additional burn rings). However, when I boot the machine again in multisession mode, it does no show the graphical login screen as configured and boots back into the default root account without any changes. As if it does not find the saved changes on boot. What am I doing wrong?

Hello Neo_78,

no idea why it doesn't work for you.

You can simply check if the multisession .sfs with changes was written to the DVD:
click on the sr0 icon on the desktop and a rox window with the content of the DVD should open (or you can use Pmount to do the same thing).
You should see something similar as in the attached picture.

It seems that the remaster of the live CD works well for you. That's good .

Just my opinion, but I may be wrong:
If you have enough RAM there is no need to remove applications.
And also I don't see any serious reason for removing Gslapt package manager (it will allow you to install something if needed).

@Feek if the save sessions are written to the multisession DVD, but are not automatically loaded, is there a way to manually restore the saved session from the desktop?

Does your boot kernel line parameters look something like ...

kernel /FATDOG812/vmlinuz basesfs=ram:uuid:4df1:/FATDOG812/fd64.sfs savefile=direct:multi:uuid:4df1:/FATDOG812/: 

(I've shortened down the UUID's from longer strings)

i.e. the savefile option points to being direct multisession and the disk/folder where they're stored

@rufwoof are you referring to the problem to automatically load save sessions in multisession DVD+RW or the problem to switch between desktops of different users?

Neo_78 wrote: Tue Jan 11, 2022 6:01 pm

@Feek if the save sessions are written to the multisession DVD, but are not automatically loaded, is there a way to manually restore the saved session from the desktop?

You can try several things:

When you boot with your DVD, navigate with the arrow keys to the multisession mode but DO NOT press „enter“ key.
Instead of it press „tab“ key.
This will show the kernel line of the bootloader and here can be manually specified (changed) some parameters (e.g. from where to load savefile, in your case multisession .sfs´s).

Here is my default line (yours should look the same):

.linux vmlinuz rootfstype=ramfs savefile=direct:multi:sr0  initrd=initrd

Now you can try to add to the kernel line „waitdev=5“.

Explaination here (quoted from Fatdog´s FAQ):
„wait for device - this instructs Fatdog64 to delay boot process by a few more seconds, so that save devices have time to settle and be ready - so that they can be accessed (and the savefile can be read off them). By default, Fatdog64 boots as fast as it can. You need this if your save device is not recognised during boot - the easiest symptom is that you have a savefile but Fatdog does not use it. Thist mostly happens for USB devices. My computer for example requires at least 3 seconds for flash drives to be recognised; delays of up to 5 seconds is not uncommon. Some slower devices may need even longer time.“

It will look like this:

.linux vmlinuz rootfstype=ramfs savefile=direct:multi:sr0 waitdev=5  initrd=initrd

After you edit the line, press enter key to continue booting.

I don´t know if this will have an effect with the optical drives in the case that they are slower. On my machine it waits 5 sec. and then the booting continues. Just try, there's nothing to lose.
____________________________________________________________________________________________________________________

If the above will not help, next thing to try is to copy all the .sfs files (..base.sfs and ..multisession.sfs(s)) from DVD to a usb stick and change the device in the kernel line during boot.

So copy all the .sfs files from DVD to a usb stick (to its root) with rox-filer.
Remember the name of the usb stick (how the system calls it, e.g. sdb1) and let it plugged in.
Reboot with the DVD, choose the multisession mode and press „tab“ key.
On the kernel line change „sr0“ to the name of your stick (e.g. sdb1).
Then press enter and let the booting continue.

This should pick up the .sfs files from the usb stick and load them.

Maybe you will need to add the „waitdev=5“ parameter as explaned above (because of the usb stick).

I think rufwoof meant the same thing