instead of using the "sync" option when mounting USB data drives - which

slows down transfer speed considerably and also increases the wear level
load - we ensure a good synced media via decreased
vm.dirty_expire_centisecs and vm.dirty_writeback_centisecs to 5 seconds.
Thus we use a global sysctl.conf now with reasonable values.

buildroot-external/rootfs-overlay/etc/sysctl.conf

@@ -0,0 +1,35 @@
+# Try to keep kernel address exposures out of various /proc files (kallsyms, modules, etc). (There is no CONFIG for the changing the initial value.)
+kernel.kptr_restrict = 1
+
+# Avoid kernel memory address exposures via dmesg (this value can also be set by CONFIG_SECURITY_DMESG_RESTRICT).
+kernel.dmesg_restrict = 1
+
+# Block non-uid-0 profiling (needs distro patch, otherwise this is the same as "= 2")
+kernel.perf_event_paranoid = 3
+
+# Avoid non-ancestor ptrace access to running processes and their credentials.
+kernel.yama.ptrace_scope = 1
+
+# Disable User Namespaces, as it opens up a large attack surface to unprivileged users.
+user.max_user_namespaces = 0
+
+# increase netfilter conntrack maximum hash table size to 256K
+net.netfilter.nf_conntrack_buckets = 65536
+net.netfilter.nf_conntrack_max = 262144
+
+# Since multicast is rather popular increate the default 20 memberships
+net.ipv4.igmp_max_memberships = 1024
+
+# Increase maximum receive and send buffer size
+net.core.rmem_max = 4194304
+net.core.wmem_max = 4194304
+
+# use fq_codel net scheduler
+#net.core.default_qdisc = fq_codel
+
+# reduce swappiness
+vm.swappiness = 10
+
+# increase frequency of disk syncing (for more frequent USB data syncing)
+vm.dirty_expire_centisecs = 500
+vm.dirty_writeback_centisecs = 500

buildroot-external/rootfs-overlay/etc/usbmount/usbmount.conf

@@ -35,7 +35,7 @@ FILESYSTEMS="vfat ntfs fuseblk ext2 ext3 ext4 hfsplus exfat f2fs"
 #############################################################################
 # Mount options: Options passed to the mount command with the -o flag.
 # See the warning above regarding removing "sync" from the options.
-MOUNTOPTIONS="noexec,nodev,noatime,nodiratime,sync"
+MOUNTOPTIONS="noexec,nodev,noatime,nodiratime"
 
 # Filesystem type specific mount options: This variable contains a space
 # separated list of strings, each which the form "-fstype=TYPE,OPTIONS".