Linux Administration Notes

This collection covers several independent administration tasks: removable storage, capabilities, filesystem locations, image composition, and ELF symbol versions. Each section states the operational boundary that matters for automation.

Operating Removable Devices Safely #

Unmount every mounted filesystem before powering down removable media. udisksctl uses the UDisks service, so it applies desktop-session authorization and coordinates the operation instead of issuing an unmediated device command.

bash

lsblk -o NAME,PATH,TYPE,FSTYPE,MOUNTPOINTS
udisksctl unmount -b /dev/sdb1
udisksctl power-off -b /dev/sdb

Pass a partition such as /dev/sdb1 to unmount, but pass the whole drive such as /dev/sdb to power-off. The latter flushes buffers, removes the device from kernel use, and, when the hardware supports it, switches off the drive. Verify device names immediately before running the command because names can change across attachment events. A successful unmount alone does not guarantee that a USB enclosure has been powered off.

Delegating Privilege with Capabilities #

Linux capabilities divide the traditional all-powerful root privilege into independently checked units. A process has permitted, effective, inheritable, bounding, and ambient capability sets; a file can also carry permitted and inheritable capability masks plus an effective bit. Consult capabilities(7) because each capability covers specific kernel checks.

For example, a dedicated binary that must set the system clock can receive CAP_SYS_TIME:

bash

sudo setcap cap_sys_time=ep /opt/example/bin/clock-setter
getcap /opt/example/bin/clock-setter

=ep adds the capability to the file’s permitted set and requests that it enter the executed process’s effective set. Grant the smallest capability set to a narrowly scoped, non-writable executable. File capabilities may be stripped by copying, packaging, or filesystems without the required extended-attribute support, so deployment checks should run getcap.

Capabilities are not a complete sandbox. CAP_SYS_ADMIN in particular authorizes many unrelated operations, and a privileged binary may still turn memory-safety or command-injection bugs into a system compromise. When delegation can be expressed as one audited command, a constrained sudoers rule can be easier to inspect.

Choosing Filesystem Locations #

The Filesystem Hierarchy Standard and hier(7) separate data by persistence and purpose:

/run contains volatile runtime state since boot. The hierarchy is cleared during boot. Services should create a private subdirectory such as /run/example/ for PID files, UNIX-domain sockets, locks, and other runtime metadata; service managers can create it with facilities such as systemd’s RuntimeDirectory=.
/var contains variable data that persists across boots, including logs, queues, caches, databases, and application state. Select a defined subtree such as /var/lib/example for durable state or /var/cache/example for regenerable data.
/tmp contains temporary files and can be cleared by policy or at boot. Never assume persistence. Create files atomically with unpredictable names and restrictive permissions; shell scripts should use mktemp, while programs should use an equivalent secure API.

Do not place application files directly in /run or /var when a namespaced subdirectory avoids collisions and allows ownership to be managed as one unit. /run is appropriate for a socket used to reach a daemon; durable daemon data belongs under /var, not beside that socket.

Resizing and Joining Images #

ImageMagick 7 uses the magick command. Geometry without ! preserves aspect ratio:

bash

# Fit within a width of 25 pixels, with unconstrained height.
magick src.png -resize 25x out.png

# Fit within a height of 25 pixels, with unconstrained width.
magick src.png -resize x25 out.png

# Scale both dimensions to 70 percent.
magick input.jpg -resize 70% output.jpg

25x25 means “fit inside this box,” not “force exactly 25 by 25.” Add ! only when distortion is intended, and use ^ plus -extent when the requirement is to fill and crop to an exact rectangle.

The append operators preserve input order:

bash

magick 1.jpg 2.jpg -append vertical.jpg
magick 1.jpg 2.jpg +append horizontal.jpg

-append stacks top to bottom; +append places images left to right. The output uses the largest input width or height on the cross-axis. -gravity controls alignment, and -background controls exposed space:

bash

magick -background '#202020' -gravity center 1.jpg 2.jpg +append row.jpg

Inspecting ELF Symbol Versions #

ELF symbol versioning lets a shared object publish more than one ABI generation of a symbol. A linker version script can assign exported names to version nodes, and .symver directives or library build machinery can bind implementations to those nodes. One definition is marked as the default with @@; older compatibility definitions use @. For example, memcpy@@GLIBC_2.14 is the default definition selected for a new unversioned reference, while an older binary may require memcpy@GLIBC_2.2.5.

Versioning supports backward-compatible implementations inside one SONAME; it does not make a binary built against a newer version runnable on a system whose library lacks the required node. Inspect both sides:

bash

readelf --dyn-syms --wide ./program
readelf --version-info ./program
objdump -T /lib/x86_64-linux-gnu/libc.so.6 | grep ' GLIBC_'

readelf --version-info shows version definitions, requirements, and symbol-version tables. objdump -T combines dynamic symbols with their versions. The runtime loader must resolve every required version node from the selected dependency; LD_DEBUG=versions ./program can trace that check during diagnosis.

Linux Administration Notes

Operating Removable Devices Safely #

Delegating Privilege with Capabilities #

Choosing Filesystem Locations #

Resizing and Joining Images #

Inspecting ELF Symbol Versions #

References #

Comments