Another option is to put the firmware in its own initramfs. This approach makes it obvious to you how your setup is different from vanilla TCL, which is helpful to remember when upgrading. It's also convenient because you don't have to remaster core.gz every time you upgrade.
Right, better. but with one little remark: the firmware.gz
should have only the necessary blobs. I mean to avoid loading in RAM something like 16MB instead of just few KB of few files g-zipped. The necessary files can be discovered from dmesg kernel log.
For the hard-coded path into firmware, someone can see "interesting things" with a hex viewer/editor, or
strings, if
modinfo is clueless.
[rant] We are captive to greedy IP -- intellectual property bullshit, close source firmware in software, in hardware UEFI, etc. So
no security is possible in this environment. Like: you can not safety build your house on other people land... Maybe we just naively bet on attacker lack of resources/hardware/technology, or lack of knowledge, or security by obscurity (0 days bugs). [/rant]