[lug] /etc backup and unionfs(?)

[Bear Giles]

The recent discussion reminds me of an idea I had a while back but 
haven't pursued.

Live CDs are now able to run off a root image on the cd media.  It looks 
like there's a unionfs that allows a ramdisk to overlay the read-only disk.

That made me think -- what if the hard disk's / image is solely what's 
in the distribution packages and is read-only, and you overlay it with a 
read-write partition?  Wouldn't that mean that all configuration changes 
are in that overlay partition and easily backed up and restored?  It 
would also be easy to check for unwanted modifications, e.g., attempts 
to install compromised binaries.

(Okay, you would need to make a few changes in /etc, but only those 
required to boot the system.  Maybe nothing more than setting up 
/etc/fstab to load the overlay.)

Two additional benefits: restoration would be trivial since the root 
partition would depend on nothing but the standard packages, and you 
could even boot from a live CD that's been modified to load the disk 
overlay instead of a ramdisk.