Granted Patent B2

US 12,423,435 · App. 18/362,636 · Granted Sep 23, 2025

Inventors: Leigh Griffin (Kilmacthomas, IE); Pierre-Yves Chibon (Saint-Pol-de-Léon, FR)

Assignee: Red Hat, Inc.

G06F21/575G06F9/4401G06F21/602G06F2221/034

Abstract

Claims (65)

1. A method comprising:

storing, in a first base boot partition, an image of a first base operating system;

storing, in a first overlay boot partition, a first overlay filesystem comprising a first encrypted file;

configuring the first overlay boot partition to boot the image of the first base operating system from the first base boot partition and install the first overlay filesystem;

receiving a request to access the first encrypted file, wherein the request does not contain an authorization to access the first overlay boot partition;

responsive to determining that the request does not contain the authorization to access the first overlay boot partition, detecting an unauthorized attempt to access the first encrypted file; and

responsive to detecting the unauthorized attempt to access the first encrypted file, designating the first base boot partition as an active boot partition.

2. The method of claim 1 , further comprising:

responsive to detecting an authorized attempt to access the first encrypted file, designating the first overlay boot partition as the active boot partition.

3. The method of claim 1 , further comprising:

creating a second base boot partition and a second overlay boot partition;

storing, in the second base boot partition, an image of a second base operating system; and

storing, in the second overlay boot partition, a second overlay filesystem comprising a second encrypted file.

4. The method of claim 3 , wherein the second encrypted file comprises an updated version of the first encrypted file, further comprising:

responsive to detecting a request for an update of the first encrypted file, configuring the second overlay boot partition to boot the image of the first base operating system from the first base boot partition and install the second overlay filesystem; and

designating the second overlay boot partition as the active boot partition.

5. The method of claim 3 , wherein the second base operating system comprises an updated version of the first base operating system, further comprising:

responsive to detecting a request for an update of the first base operating system, configuring the first overlay boot partition to boot the image of the second base operating system from the second base boot partition and install the first overlay filesystem; and

designating the first overlay boot partition as the active boot partition.

6. The method of claim 3 , wherein the second base operating system comprises an updated version of the first base operating system and the second encrypted file comprises an updated version of the first encrypted file, further comprising:

responsive to detecting a request for an update of the first base operating system and the first encrypted file, configuring the second overlay boot partition to boot the image of the second base operating system from the second base boot partition and install the second overlay filesystem; and

designating the second overlay boot partition as the active boot partition.

7. The method of claim 1 , wherein the first overlay filesystem comprises an operating system component associated with a first service, wherein the operating system component is represented by one of: a driver, or a configuration file.

8. The method of claim 1 , further comprising:

storing a list of a plurality of disk partitions in a data file, wherein the data file comprises a plurality of records, wherein each record of the plurality of records corresponds to a partition of the plurality of disk partitions, wherein each disk partition of the plurality of disk partitions comprises at least one of: a base boot partition, or an overlay boot partition.

9. The method of claim 3 , further comprising:

responsive to detecting a triggering event, configuring the second overlay boot partition to boot the second base operating system from the second base boot partition and install the second overlay filesystem, wherein the triggering event comprises at least one of: receiving a user request, receiving a network notification, satisfying a condition associated with a first service, an expiration of a defined time period, or detection of a presence of a second device.

10. A system comprising:

a memory; and

a processing device operatively coupled to the memory, the processing device to perform operations comprising:

storing, in a first base boot partition, an image of a first base operating system;

storing, in a first overlay boot partition, a first overlay filesystem comprising a first encrypted file;

configuring the first overlay boot partition to boot the image of the first base operating system from the first base boot partition and install the first overlay filesystem;

receiving a request to access the first encrypted file, wherein the request does not contain an authorization to access the first overlay boot partition;

responsive to determining that the request does not contain the authorization to access the first overlay boot partition, detecting an unauthorized attempt to access the first encrypted file; and

responsive to detecting the unauthorized attempt to access the first encrypted file, designating the first base boot partition as an active boot partition.

11. The system of claim 10 , wherein the operations further comprise:

responsive to detecting an authorized attempt to access the first encrypted file, designating the first overlay boot partition as the active boot partition.

12. The system of claim 11 , wherein the operations further comprise:

creating a second base boot partition and a second overlay boot partition;

storing, in the second base boot partition, an image of a second base operating system; and

storing, in the second overlay boot partition, a second overlay filesystem comprising a second encrypted file.

13. The system of claim 12 , wherein the second encrypted file comprises an updated version of the first encrypted file, wherein the operations further comprise:

responsive to detecting a request for an update of the first encrypted file, configuring the second overlay boot partition to boot the image of the first base operating system from the first base boot partition and install the second overlay filesystem; and

designating the second overlay boot partition as the active boot partition.

14. The system of claim 12 , wherein the second base operating system comprises an updated version of the first base operating system, wherein the operations further comprise:

responsive to detecting a request for an update of the first base operating system, configuring the first overlay boot partition to boot the image of the second base operating system from the second base boot partition and install the first overlay filesystem; and

designating the first overlay boot partition as the active boot partition.

15. The system of claim 12 , wherein the second base operating system comprises an updated version of the first base operating system and the second encrypted file comprises an updated version of the first encrypted file, wherein the operations further comprise:

responsive to detecting a request for an update of the first base operating system and the first encrypted file, configuring the second overlay boot partition to boot the image of the second base operating system from the second base boot partition and install the second overlay filesystem; and

designating the second overlay boot partition as the active boot partition.

16. The system of claim 10 , wherein the first overlay filesystem comprises an operating system component associated with a first service, wherein the operating system component is represented by one of: a driver, or a configuration file.

17. The system of claim 15 , wherein the operations further comprise:

storing a list of a plurality of disk partitions in a data file, wherein the data file comprises a plurality of records, wherein each record of the plurality of records corresponds to a partition of the plurality of disk partitions, wherein each disk partition of the plurality of disk partitions comprises at least one of: a base boot partition, or an overlay boot partition.

18. The system of claim 12 , wherein the operations further comprise:

responsive to detecting a triggering event, configuring the second overlay boot partition to boot the second base operating system from the second base boot partition and install the second overlay filesystem, wherein the triggering event comprises at least one of: receiving a user request, receiving a network notification, satisfying a condition associated with a first service, an expiration of a defined time period, or detection of a presence of a second device.

19. A non-transitory computer-readable media storing instructions that, when executed, cause a processing device to perform operations comprising:

storing, in a first base boot partition, an image of a first base operating system;

storing, in a first overlay boot partition, a first overlay filesystem comprising a first encrypted file;

configuring the first overlay boot partition to boot the image of the first base operating system from the first base boot partition and install the first overlay filesystem;

receiving a request to access the first encrypted file, wherein the request does not contain an authorization to access the first overlay boot partition;

responsive to determining that the request does not contain the authorization to access the first overlay boot partition, detecting an unauthorized attempt to access the first encrypted file; and

responsive to detecting the unauthorized attempt to access the first encrypted file, designating the first base boot partition as an active boot partition.

20. The non-transitory computer-readable media of claim 19 , wherein the operations further comprise:

responsive to detecting an authorized attempt to access the first encrypted file, designating the first overlay boot partition as the active boot partition.

Assignments (2)

Continuity (1)

References Cited (12)