As part of Linux hardening we want to remove busybox from filesystem created with buildroot.

But I am not sure if system can boot without it.

I am quite sure that there are init files that depends on busybox.

Is it possible to boot without busybox or does it require a custom init ?

  • Is it for a bare metal system, a VM, or for a Docker container? busybox contains all the commands so it is not easy to remove. – xenoid Oct 20 at 7:17
  • Which distribution? Why have you not made a test in a VM yet,? – Rui F Ribeiro Oct 20 at 7:21
  • What kind of system is it? Why do you think that removing a program would harden your system? – Gilles Oct 20 at 7:25
  • It is for buildroot. I might have forgotten to mention it. I edited the question. – ransh Oct 20 at 9:28

It all depends on whether your distro uses Busybox for init.

To point you in the right direction, run ls -l /sbin/init.

If you get something like the following (example from OpenWRT):

~# ls -l /sbin/init
-rwxr-xr-x    1 root     root         10824 Jan 31  2016 /sbin/init

It means init is a different application and you may be able to remove Busybox. You'll still need to replace all the command init requires with alternatives as Busybox provides many tools required for booting successfully.

However, if you get (example from Alpine Linux):

~$ ls -l /sbin/init
lrwxrwxrwx    1 root     root            12 May  3 04:49 /sbin/init -> /bin/busybox

It means init is provided by Busybox and you'll not be able to boot unless you can replace Busybox's init with an alternative.

You have to consider whether you are really hardening your system by doing this as you'll end up replacing one binary with many.

  • 1
    Even if init itself isn't the one from Busybox, if a system has Busybox, it probably has other critical programs provided by Busybox, for example sh. – Gilles Oct 20 at 7:24
  • @Gilles - edited and added as you commented :-) – garethTheRed Oct 20 at 7:25
  • Using this solution, does buildroot provide the option to entirely remove busybox from buildroot ? – ransh Oct 20 at 16:05

I routinely delete busybox in my master template/Debian VMs.

As for Debian, it is a matter of not allowing it to install both the busybox and busybox-staticpackages.

You just have to keep in mind the recovery/rescue options will be more limited in a system without it. e.g. I might keep it on a physical system, I delete it as a norm form VMs to save space and under the Unix old golden rule of keeping the minimum of software installed.

At least speaking for Debian, the uninstall makes the necessary modifications in the background, and it is neither necessary to do any extra steps nor customizing anything.

  • I forgot to mention that I use buildroot (just edit the question). So this solution may not be relevant in my case. – ransh Oct 20 at 9:35

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.