3.1 Hard Disk Layout, Partition Schemes & Swap Design (102.1)

3.1 Hard Disk Layout, Partition Schemes & Swap Design (102.1)

Quick Summary: Designing an enterprise Linux partition layout requires balancing workload requirements, system resilience, and security hardening. Isolating directories such as /boot, /home, /var, /var/log, and /tmp onto dedicated filesystems prevents runaway log files or user uploads from exhausting disk space on the root (/) filesystem. Furthermore, proper swap space sizing and vm.swappiness kernel tuning ensure reliable virtual memory management and system stability under heavy load.

---

1. Principles of Storage Layout Design

When installing a Linux system, administrators must determine whether to place all files on a single monolithic root (/) partition or divide the directory tree across multiple dedicated partitions or Logical Volume Manager (LVM) logical volumes. While a single-partition layout is simple and suitable for personal desktop testing, production servers demand multi-partition or multi-volume architectures.

Workload-Specific Layout Architectures

---

2. Dedicated Partitions Rationale & Filesystem Hierarchy

The Filesystem Hierarchy Standard (FHS) defines the structure and purpose of directories in Linux. Isolating specific directories onto dedicated block devices provides three primary benefits: fault isolation, data preservation, and security enforcement.

                    ┌────────────────────────┐
                    │        / (Root)        │
                    │  Core System Binaries  │
                    └───────────┬────────────┘
         ┌──────────────┬───────┴───────┬──────────────┬──────────────┐
         ▼              ▼               ▼              ▼              ▼
  ┌────────────┐ ┌────────────┐  ┌────────────┐ ┌────────────┐ ┌────────────┐
  │   /boot    │ │   /home    │  │    /var    │ │    /tmp    │ │    /opt    │
  │  Kernels,  │ │ User Data, │  │ Logs, Spool│ │ Temp Files │ │ 3rd-Party  │
  │ Initramfs  │ │   Quotas   │  │ Databases  │ │noexec,nosuid│ │ Add-on PKG │
  └─────┬──────┘ └────────────┘  └─────┬──────┘ └────────────┘ └────────────┘
        ▼                              ▼
  ┌────────────┐                 ┌────────────┐
  │ /boot/efi  │                 │  /var/log  │
  │  UEFI ESP  │                 │ Audit Logs │
  │   FAT32    │                 │ Isolation  │
  └────────────┘                 └────────────┘

Detailed Mount Point Specifications

• Root (/): Contains the operating system core (/bin, /sbin, /lib, /etc). If / runs out of free space or inodes, the Linux kernel cannot allocate file descriptors, write temporary sockets, or spawn processes, leading to complete system lockup.
• /boot: Holds Linux kernel binaries (vmlinuz-*), initial RAM disk images (initramfs-* or initrd-*), and bootloader assets (/boot/grub/).
  • Must be accessible by the system BIOS or bootloader before device drivers or LVM modules are loaded.
  • Must reside on an unencrypted, standard filesystem (typically ext4, ext3, or ext2).
  • Recommended size: 500 MiB to 2 GiB to accommodate multiple kernel versions.
• /boot/efi: The EFI System Partition (ESP) mandated on UEFI-based systems.
  • Must be formatted as FAT32 (vfat).
  • Partition type code: EF00 in GPT (gdisk) or 0xEF in MBR (fdisk).
  • Recommended size: 100 MiB to 512 MiB.
• /home: Contains user personal directories, dotfiles, and application configurations.
  • Isolating /home ensures that re-installing or upgrading the Linux OS does not overwrite user data.
  • Enables filesystem quota management (usrquota, grpquota).
• /var and /var/log: Stores variable data including system logs (/var/log), mail queues (/var/spool/mail), package caches (/var/cache/apt, /var/cache/dnf), and database storage (/var/lib/mysql).
  • Runaway daemon logging or print queues can quickly fill gigabytes of storage. Isolating /var or /var/log ensures log flooding never exhausts the root filesystem.
• /tmp: World-writable directory (drwxrwxrwt with sticky bit) used by applications for ephemeral scratch files.
  • Highly vulnerable to security exploits where malicious users download and execute unauthorized binaries.
  • Frequently mounted as tmpfs (RAM-backed volatile filesystem) or an isolated partition with restrictive mount flags.
• /opt and /srv: /opt holds self-contained third-party software suites (e.g., /opt/google/chrome, /opt/gitlab); /srv holds site-specific data served by network protocols (e.g., /srv/www, /srv/ftp).
• /usr: Historically placed on a separate partition containing user utilities and shared libraries (/usr/bin, /usr/lib, /usr/share). Modern systemd-based distributions require /usr to be mounted inside the initramfs stage before switching root.

💡 LPIC-1 Exam Fill-in-the-Blank Alert: When asked which directory stores architecture-independent shared data such as man pages, documentation, and icons, the answer is /usr/share. When asked which filesystem type is mandatory for the UEFI EFI System Partition (ESP), the answer is vfat (or FAT32).

---

3. Filesystem Security Mount Options

Hardening dedicated filesystems in /etc/fstab prevents common attack vectors such as SUID binary exploitation and unauthorized script execution.

⚠️ LPIC-1 Trap: Mounting /tmp with noexec may cause package managers or compiler tools (e.g., gcc, apt, dnf) that rely on building temporary executables in /tmp to fail unless redirected using TMPDIR=/var/tmp.

---

4. Swap Space Architecture, Sizing & Configuration

Swap space provides virtual memory backing when physical RAM is fully committed. The Linux kernel's memory management subsystem moves inactive (anonymous) memory pages from physical RAM into swap, freeing physical RAM frames for active execution and high-priority filesystem page caching.

Swap Sizing Reference Guide

Swap Partition vs. Swap File

1. Swap Partition: A dedicated raw disk slice formatted with partition type 82 (MBR) or 8200 (GPT). Provides optimal contiguous disk sector performance.
2. Swap File: A pre-allocated regular file on an existing filesystem. Highly flexible because it can be created, resized, or deleted dynamically without repartitioning.

# Creating and activating a 4 GiB swap file
sudo fallocate -l 4G /swapfile
# Secure permissions (critical: only root can read/write)
sudo chmod 600 /swapfile
# Format the file as Linux swap area
sudo mkswap /swapfile
# Activate the swap file
sudo swapon /swapfile
# Verify active swap allocations
swapon --show
free -h
cat /proc/swaps

Filename                                Type            Size            Used            Priority
/dev/sda3                               partition       4194300         0               -2
/swapfile                               file            4194304         0               -3

To make the swap file persistent across reboots, add the following entry to /etc/fstab:

/swapfile    none    swap    sw    0    0

---

5. Kernel Swappiness Tuning (vm.swappiness)

The Linux kernel parameter vm.swappiness defines the relative balance between paging out anonymous application memory to swap versus reclaiming active/inactive page cache (file-backed pages).

• Value Range: 0 to 100 (up to 200 in Linux kernel 5.8+ with cgroups v2).
• Default Value: 60 on most enterprise distributions (Debian, Ubuntu, RHEL).
• Low Values (e.g., 1–10): The kernel aggressively avoids swapping anonymous memory pages, preferring to drop reclaimable filesystem cache. Essential for latency-sensitive databases (e.g., MySQL, Redis, SAP HANA) to prevent query stalls.
• High Values (e.g., 80–100): The kernel aggressively pages out idle process memory to swap, maximizing free physical RAM for filesystem buffering and I/O throughput.
• Value of 0: Disables swapping completely until the system reaches an absolute out-of-memory (OOM) condition.

# Inspect current runtime swappiness
cat /proc/sys/vm/swappiness
# OR using sysctl
sysctl vm.swappiness

# Temporarily set swappiness to 10 (reverts on reboot)
sudo sysctl vm.swappiness=10

# Make swappiness persistent across reboots in /etc/sysctl.d/99-swappiness.conf
echo 'vm.swappiness = 10' | sudo tee /etc/sysctl.d/99-swappiness.conf
sudo sysctl --system