To create a read only root file system we need to know which processes access which files and which files must be accessible. So here is a list of files to take care of. Everything below /var is assumed of being accessible as it makes no sense from my point of view to restrict access for everything, which could nevertheless also be achieved by following this instructions.
There are already some special file systems available in a standard linux installation, so we do not need to take care about:
- /tmp – tmpfs
- /sys – sysfs
- /proc – procfs
- /dev – udev
So we finally will have:
/ root as extended fs read only mounted
/var as exteneded fs mounted read writable
/tmp as temp fs ounted read writable
And now to the tricks. We need to take care about /etc as there are some files which need special preparation:
adjtime – should be linked to somewhere beyond /var; /etc/init.d/hwclockfirst.sh and hwclock.sh should be adjusted to show the option –noadjtime
blkid.tab – should be linked to somewhere beyond /var; the environement variable BLKID_FILE must be set to /var/local/blkid.tab in /etc/environment
mtab – Create a symlink from /etc/mtab to /proc/self/mounts
network/run – ifupdown links /etc/network/run to /dev/shm/network in postinst if /dev/shm exists and /etc/network/run does not; my installation was not successful without an existing network/run/ifstates, so I copied the complete directory once the network was up and running.
nologin – This should already be a symlink to /var/lib/initscripts/nologin
resolv.conf – no problem with static nameserver configurations
passwd, shadow – may be modified by user interaction
apt-get could be modified to remount before installing anything:
DPkg {
// Auto re-mounting of a readonly /
Pre-Invoke { "mount -o remount,rw /"; };
Post-Invoke { "test ${NO_APT_REMOUNT:-no} = yes || mount -o remount,ro / || true"; };
};
Use lsof to find processes blocking the readonly mount.
There are some additional tricks to check:
- reduce swappiness in /proc/sys/vm/swappiness
- enable laptop mode
- reduce cache writeback time /proc/sys/vm/dirty_writeback_centisecs and dirty_expire_centisecs
- filesystem relatime
- reduce syslog file syncing by putting a “-” in front of the syslog lines