Remove busybox from buildroot

Question

As part of Linux hardening we want to remove busybox from filesystem created with buildroot.

But I am not sure if system can boot without it.

I am quite sure that there are init files that depends on busybox.

Is it possible to boot without busybox or does it require a custom init ?

Is it for a bare metal system, a VM, or for a Docker container? busybox contains all the commands so it is not easy to remove. — xenoid, Oct 20 '18 at 07:17
Which distribution? Why have you not made a test in a VM yet,? — Rui F Ribeiro, Oct 20 '18 at 07:21
What kind of system is it? Why do you think that removing a program would harden your system? — Gilles 'SO- stop being evil', Oct 20 '18 at 07:25
It is for buildroot. I might have forgotten to mention it. I edited the question. — ransh, Oct 20 '18 at 09:28

garethTheRed · Answer 1 · 2018-10-20T07:28:01.490

7

It all depends on whether your distro uses Busybox for init.

To point you in the right direction, run ls -l /sbin/init.

If you get something like the following (example from OpenWRT):

~# ls -l /sbin/init
-rwxr-xr-x    1 root     root         10824 Jan 31  2016 /sbin/init

It means init is a different application and you may be able to remove Busybox. You'll still need to replace all the command init requires with alternatives as Busybox provides many tools required for booting successfully.

However, if you get (example from Alpine Linux):

~$ ls -l /sbin/init
lrwxrwxrwx    1 root     root            12 May  3 04:49 /sbin/init -> /bin/busybox

It means init is provided by Busybox and you'll not be able to boot unless you can replace Busybox's init with an alternative.

You have to consider whether you are really hardening your system by doing this as you'll end up replacing one binary with many.

edited Oct 20 '18 at 07:28

answered Oct 20 '18 at 07:21

garethTheRed

33,289
4
92
101

1

Even if `init` itself isn't the one from Busybox, if a system has Busybox, it probably has other critical programs provided by Busybox, for example `sh`. – Gilles 'SO- stop being evil' Oct 20 '18 at 07:24
@Gilles - edited and added as you commented :-) – garethTheRed Oct 20 '18 at 07:25
Using this solution, does buildroot provide the option to entirely remove busybox from buildroot ? – ransh Oct 20 '18 at 16:05

score 3 · Answer 2 · answered Oct 20 '18 at 08:52

I routinely delete busybox in my master template/Debian VMs.

As for Debian, it is a matter of not allowing it to install both the busybox and busybox-staticpackages.

You just have to keep in mind the recovery/rescue options will be more limited in a system without it. e.g. I might keep it on a physical system, I delete it as a norm form VMs to save space and under the Unix old golden rule of keeping the minimum of software installed.

At least speaking for Debian, the uninstall makes the necessary modifications in the background, and it is neither necessary to do any extra steps nor customizing anything.

I forgot to mention that I use buildroot (just edit the question). So this solution may not be relevant in my case. — ransh, Oct 20 '18 at 09:35

Remove busybox from buildroot

2 Answers2