Protect your Raspberry PI SD card, use Read-Only filesystem

[fcatuhe]

What are the limitations for using Read-Only filesystem on a Pi? For example, will node-red work flawlessly? And a domotic solution like Domoticz or Jeedom?

Thanks in advance.

[Charles]

@fcatuhe
yes of course there's some limitation with RO filesystem, especially with system using databases such as Jeedom or Domoticz.
A solution would be to report database away from PI (NAS as example). But in all cases I won't recommend using Pi + database on SD card.
For node red, yes it works, but each time you want to modify the flow the system need to be set as RW when saving the flow. Except that, it's working fine on RO filesystem

[alwayslearning]

Hello,

Almost two years ago I made something similar to my Pi but I lost the SD auto detect and auto mount, can you please tell me if you have the SD Auto detected functionality working while in read-only mode?

Best regards

[Charles]

@alwayslearning
I was not aware of this feature, what is this for ? to know if SD is pluuged or not ? that's a good idea but I do not use it.

[alwayslearning]

Hello, sorry it's not the SD auto detect, it's the USB auto detect and auto mount, that feature is really importante if you use your pi and wan't to simply change content or program data with a new USB stick/pen.

[nicklas]

Hello

Thank you very much for a very helpful tutorial!

I have one comment and one question.

I think you should mention that you also have to mount /tmp as tmpfs in /etc/fstab
After doing that it works like a charm.

But I also want samba to serve some files from my rpi. I find samba hard to handle here since it seems to need to write to some files in /var/lib/samba. When I boot with writable / it works, but not if I remount as writable after boot. If I make it writable after boot, it seems like smbd starts, but I cannot connect to the shares. What I think I have to do is create some files in /tmp at boot time maybe with tdbtool, but I don't know yet what files and if it will work. I will continue to investigate, but any time saving tips is highly appreciated :-).

[nicklas]

I think I have solved my samba problem with an ugly hack.
I copied everything in /var/lib/samba to a backup-folder.
THen I put a symlink to /tmp so /var/lib/samba is found there.

Then I put a line in rc.local that copies the content of my backed up /var/lib/samba back (which now points to /tmp
and another line starting smbd

Now I can connect to my shares in my read only filesystem.
Of course I copy only the needed files, but this was the quich and dirty version
I have disabled nmbd, but it should work too now I guess.

To not make unsuccessful appempts to start smbd before doing the copy I also disabled sbd with update-rc.d

[Charles]

@nicklas
thank for the head up, this tip can help some applications not directly compatible with read only filesystem.
Curious you're the second telling me for tmpfs to be done in /etc/initab, may be related to jessie because I did not defined it in my fstab entrie and by default tmp goes to tmpfs.

[nicklas]

Interesting. I haven't rechecked but I had problems when /tmp wasn't mounted in /etc/fstab as tmpfs. What made me try that was the original blog post that you refer to. In his /etc/fstab is a line for /tmp, but he doesn't mention it in the text.

I use minibian jessie, so it is not the full raspbian distro. Don't know if that could make a difference.

[Charles]

Hummmm, minibian?
just reading the name, I like it, was searching for a minimal distro for long time, I'll try it

[arnt]

Thanks for sharing this post!
I was able to get it forking with the RASPBIAN JESSIE LITE distro.

Some minor issues were solved by adding

tmpfs /tmp tmpfs mode=1777,nosuid,nodev 0 0
tmpfs /var tmpfs mode=1777,nosuid,nodev 0 0

to /etc/fstab

I used the resolvconf package for fixing some issues with dhcpcd

[Charles]

@arnt
Thank, for the fixes, I really need to take time to test on jessie

[icepick]

What arnt wrote works indeed with Jessie (otherwise it won't boot). Does anyone know a way to still make it boot in the graphical interface? I didn't remove the xserver packages as written above.. the box boots to a black screen now (I can still ssh to it)..

[Petr Klus]

Hello!

Sorry for being lazy but I would you consider providing pre-built images with all of the work above built-in? Or, alternatively, a script one can use that does all of the above?

[Petr Klus]

@arnt - what did you do with resolvconf?

[Petr Klus]

@arn I've written up instructions for Jessie inspired by this post (and many other). See here:

http://petr.io/2015/11/09/read-only-raspberry-pi-with-jessie/

[Charles]

@Petr-Klus
Since I migrated to Jessie, I've updated the post according to your changes, thanks for that.

I also corrected Fancy Prompt (was not working on Jessie) and ro/rw alias to also mount/remount /boot to avoid error when apt-get upgrade was upgrading also bootloader

[kamikazefish]

Thanks for the great tutorial. Works great! If I would make a third partition on the SD card, and put the logs there and a fourth partition for the program data, would this still prevent my raspberry pi from not booting? The system files and programs would be read only. If not, would using an usb stick for the logs and program data be better?

[Charles]

@kamikazefish
yes have more partition for R/W data could be a great idea and would work. but in this case you won't prevent data corruption on power loss

[kamikazefish]

Ok that wouldn't be a big deal with the log files. For the program data I think there are some work arounds. I could implement unionfs with 2 partitions, one with a working state and the other as working dir. Then every x minutes I sync the files from the working dir to the working state. These writes are to an temp file, that are renamed after the write, to prevent corrupting the working state files.