Protect your Raspberry PI SD card, use Read-Only filesystem

[nicklas]

Hello

Thank you very much for a very helpful tutorial!

I have one comment and one question.

I think you should mention that you also have to mount /tmp as tmpfs in /etc/fstab
After doing that it works like a charm.

But I also want samba to serve some files from my rpi. I find samba hard to handle here since it seems to need to write to some files in /var/lib/samba. When I boot with writable / it works, but not if I remount as writable after boot. If I make it writable after boot, it seems like smbd starts, but I cannot connect to the shares. What I think I have to do is create some files in /tmp at boot time maybe with tdbtool, but I don't know yet what files and if it will work. I will continue to investigate, but any time saving tips is highly appreciated :-).

[nicklas]

I think I have solved my samba problem with an ugly hack.
I copied everything in /var/lib/samba to a backup-folder.
THen I put a symlink to /tmp so /var/lib/samba is found there.

Then I put a line in rc.local that copies the content of my backed up /var/lib/samba back (which now points to /tmp
and another line starting smbd

Now I can connect to my shares in my read only filesystem.
Of course I copy only the needed files, but this was the quich and dirty version
I have disabled nmbd, but it should work too now I guess.

To not make unsuccessful appempts to start smbd before doing the copy I also disabled sbd with update-rc.d

[Charles]

@nicklas
thank for the head up, this tip can help some applications not directly compatible with read only filesystem.
Curious you're the second telling me for tmpfs to be done in /etc/initab, may be related to jessie because I did not defined it in my fstab entrie and by default tmp goes to tmpfs.

[nicklas]

Interesting. I haven't rechecked but I had problems when /tmp wasn't mounted in /etc/fstab as tmpfs. What made me try that was the original blog post that you refer to. In his /etc/fstab is a line for /tmp, but he doesn't mention it in the text.

I use minibian jessie, so it is not the full raspbian distro. Don't know if that could make a difference.

[Charles]

Hummmm, minibian?
just reading the name, I like it, was searching for a minimal distro for long time, I'll try it

[arnt]

Thanks for sharing this post!
I was able to get it forking with the RASPBIAN JESSIE LITE distro.

Some minor issues were solved by adding

tmpfs /tmp tmpfs mode=1777,nosuid,nodev 0 0
tmpfs /var tmpfs mode=1777,nosuid,nodev 0 0

to /etc/fstab

I used the resolvconf package for fixing some issues with dhcpcd

[Charles]

@arnt
Thank, for the fixes, I really need to take time to test on jessie

[icepick]

What arnt wrote works indeed with Jessie (otherwise it won't boot). Does anyone know a way to still make it boot in the graphical interface? I didn't remove the xserver packages as written above.. the box boots to a black screen now (I can still ssh to it)..

[Petr Klus]

Hello!

Sorry for being lazy but I would you consider providing pre-built images with all of the work above built-in? Or, alternatively, a script one can use that does all of the above?

[Petr Klus]

@arnt - what did you do with resolvconf?

[Petr Klus]

@arn I've written up instructions for Jessie inspired by this post (and many other). See here:

http://petr.io/2015/11/09/read-only-raspberry-pi-with-jessie/

[Charles]

@Petr-Klus
Since I migrated to Jessie, I've updated the post according to your changes, thanks for that.

I also corrected Fancy Prompt (was not working on Jessie) and ro/rw alias to also mount/remount /boot to avoid error when apt-get upgrade was upgrading also bootloader

[kamikazefish]

Thanks for the great tutorial. Works great! If I would make a third partition on the SD card, and put the logs there and a fourth partition for the program data, would this still prevent my raspberry pi from not booting? The system files and programs would be read only. If not, would using an usb stick for the logs and program data be better?

[Charles]

@kamikazefish
yes have more partition for R/W data could be a great idea and would work. but in this case you won't prevent data corruption on power loss

[kamikazefish]

Ok that wouldn't be a big deal with the log files. For the program data I think there are some work arounds. I could implement unionfs with 2 partitions, one with a working state and the other as working dir. Then every x minutes I sync the files from the working dir to the working state. These writes are to an temp file, that are renamed after the write, to prevent corrupting the working state files.

[Harlock]

Thank you very much for this!
Just to add my 2 cents: in Raspbian Jessie (mini) everything was fine except for the DHCP client which after fstab modification it was taking a life to stop waiting for an IP.
I solved editing /etc/systemd/system/dhcpcd5 this way:

changed the line

PIDFile=/run/dhcpcd.pid

into

PIDFile=/var/run/dhcpcd.pid

And now is fine.

[mefi]

Thanks for this. It really gives the stability to micro SD card that I need.

I have one question that may not be really about this topic, but in some way it is. I developed a Qt application which is basically a dummy application. It receives messages and images over UDP sockets, and shows them on the screen. The problem I have is that when I am in read-only mode application just aborts after about half a second or so. When it is run in read-write mode it works great.

After removing chunks of code and testing it in read-only mode I found out that if application don't process received messages, which i really have to since that's the only functionality application has, it doesn't get aborted. I am not that good with Linux to be honest, but what seems logical to me is that when I read that data in application it needs to be stored somewhere, and that somewhere is in read-only part of memory.

Does what I wrote make any sense? If yes which parts of file system need to be mounted as tmpfs to fix it? If not what is actually happening and is it possible to fix it somehow?

By the way I am using Raspbian Jessie Lite if that means something to you.

Thanks in advance

[Charles]

@Harlock thanks for the headup I will update the doc

@mefi, I'm not specialist of QT, may be related to QT run time or other lib, that's strange, does the application need to write something somewhere ? may be in your homedir ?

Would be interesting to know how QT runtime works, I have no idea, sorry.

[mefi]

@Charles No, the application doesn't write anything to the file system. It only reads settings. I implemented a logging mechanism which I used while developing but it is disabled now. I've also tried other Qt application and they run well in read-only mode. I hope I find solution soon. I'll leave a comment here when I do so others know what to do in similar situation. Thanks for great article once again.

[mefi]

@Charles Just to let you and everyone know I fixed the problem. The logger class was trying to open file for writing logs, even when there were no logs, so I added some tests, and now it runs fine. It was my mistake after all..