That's the entire init script from Alpine's initramfs. The only bits that are needed are a few fstab lines — the mount commands in my link show what options are needed for that.

Thanks for the links, very useful.

EDIT: and in respect of Qubes and their "secure" virtualisation:

https://marc.info/?l=openbsd-misc&m=119318909016582

The memory usage is the same irregardless of the tool used to measure it. Just accept the new procps package, it does not increase your RAM usage, it just reports it differently.

And sorry for missing that — I did check the procps changelog but obviously not carefully enough.

The improved security provided by a non-root X is plain, simple fact. It is not an opinion.

Anyway I don't want to drag this thread off-topic so I've posted how to get EXE to run X under the normal user in the screenshots thread:

https://dev1galaxy.org/viewtopic.php?pid=39482#p39482

The advice also applies to Devuan so perhaps it will be useful for the OP even though it's off-topic here.

The free firmware should be "safe", at least theoretically, because the source code is available.

The kernel is quite capable of dropping the cache by itself if the memory is needed. And anyway the free output clearly shows that the buffers are almost empty. See also https://www.linuxatemyram.com/.

That location is only used if X is running under root. I think the OP's log will be under ~/.local/share/xorg/ but their use of custom startup scripts complicates the picture somewhat.

Which graphics chip are you running? If it's Intel then remove xserver-xorg-video-intel. That driver hasn't been properly maintained for about 10 years and it's buggy as hell. X's built-in modesetting DDX driver should offer a better experience if you don't have old hardware. It even has a new TearFree option to help combat X's completely broken compositing model, which is nice.

Just for the record here are my values with Xorg 21.5.1 with a Wayland comparison (amdgpu, 1920x1080):

$ doas ps_mem | grep 'Xorg\|openbox\|sway$'
  7.4 MiB +   1.4 MiB =   8.8 MiB	openbox
 36.3 MiB +  17.0 MiB =  53.3 MiB	sway
 51.1 MiB +  32.7 MiB =  83.9 MiB	Xorg
$

EDIT: I use Arch btw

EDIT2: changed awk to grep just in case andyprough takes the piss.

EDIT3: s/composting/compositing/. Possibly more accurate with the typo though...

I would prefer to see the actual file contents, if you don't mind. TIA.

So what happens if you move that somewhere else and run

startx /usr/bin/fluxbox

That won't give you a full desktop but it will help eliminate custom startup scripts as a culprit here.

Boss Drum by The Shamen.

I remember when this album first came out, I hated it 'cos I was all about Death Metal at the time. I've mellowed with old age and can now recognise it as a stone cold classic though. E's are good!

Did the memory usage increase before the xserver-xorg-core 21.1.5 release? Perhaps there is a regression.

How are you starting fluxbox?

Use Wayland instead of X. If you have to use X then run it with startx from a console login to ensure the server runs under the normal user instead of under root. You will need elogind but it does improve security so it's worth it (IMO).

I use OpenBSD instead of Linux if security is a concern. That operating system is pro-active in respect of security, which is certainly not the case for the Linux kernel developers. It doesn't have bash or glibc or any of the other GNU bloatware. It's wonderful.

Can we see

apt policy
apt policy five-or-more

Thanks!

Why?

If the drive is solid state you can use blkdiscard to clear the drive instantly, no need to wait for it to fill with zeros. Note however that neither blkdiscard nor dd can completely wipe a solid state drive because of overprovision. #securitytheatre

Whilst I much admire and respect the work of Rod Smith I don't see why rEFInd should be preferred over the default bootloader. Do you have any sound technical reasons to prefer it?

EFI_STUB booting with a unified kernel image would be the best for security, especially if the kernel image is signed with a personal key. That's what I use anyway.

That program is ancient now. Try iwd instead — it's more modern and secure than wpasupplicant with fewer dependencies.

Yes it does: https://www.freedesktop.org/software/sy … asquerade=.

Running X via a setuid binary wrapper is the exact opposite of good security. Don't do that. Just use a proper login session.

Why?

I can get bulk supplies of tin foil really cheap if you're interested. PM me for details.