Protect your Raspberry PI SD card, use Read-Only filesystem

[Charles]

@arnt
Thank, for the fixes, I really need to take time to test on jessie

[icepick]

What arnt wrote works indeed with Jessie (otherwise it won't boot). Does anyone know a way to still make it boot in the graphical interface? I didn't remove the xserver packages as written above.. the box boots to a black screen now (I can still ssh to it)..

[Petr Klus]

Hello!

Sorry for being lazy but I would you consider providing pre-built images with all of the work above built-in? Or, alternatively, a script one can use that does all of the above?

[Petr Klus]

@arnt - what did you do with resolvconf?

[Petr Klus]

@arn I've written up instructions for Jessie inspired by this post (and many other). See here:

http://petr.io/2015/11/09/read-only-raspberry-pi-with-jessie/

[Charles]

@Petr-Klus
Since I migrated to Jessie, I've updated the post according to your changes, thanks for that.

I also corrected Fancy Prompt (was not working on Jessie) and ro/rw alias to also mount/remount /boot to avoid error when apt-get upgrade was upgrading also bootloader

[kamikazefish]

Thanks for the great tutorial. Works great! If I would make a third partition on the SD card, and put the logs there and a fourth partition for the program data, would this still prevent my raspberry pi from not booting? The system files and programs would be read only. If not, would using an usb stick for the logs and program data be better?

[Charles]

@kamikazefish
yes have more partition for R/W data could be a great idea and would work. but in this case you won't prevent data corruption on power loss

[kamikazefish]

Ok that wouldn't be a big deal with the log files. For the program data I think there are some work arounds. I could implement unionfs with 2 partitions, one with a working state and the other as working dir. Then every x minutes I sync the files from the working dir to the working state. These writes are to an temp file, that are renamed after the write, to prevent corrupting the working state files.

[Harlock]

Thank you very much for this!
Just to add my 2 cents: in Raspbian Jessie (mini) everything was fine except for the DHCP client which after fstab modification it was taking a life to stop waiting for an IP.
I solved editing /etc/systemd/system/dhcpcd5 this way:

changed the line

PIDFile=/run/dhcpcd.pid

into

PIDFile=/var/run/dhcpcd.pid

And now is fine.

[mefi]

Thanks for this. It really gives the stability to micro SD card that I need.

I have one question that may not be really about this topic, but in some way it is. I developed a Qt application which is basically a dummy application. It receives messages and images over UDP sockets, and shows them on the screen. The problem I have is that when I am in read-only mode application just aborts after about half a second or so. When it is run in read-write mode it works great.

After removing chunks of code and testing it in read-only mode I found out that if application don't process received messages, which i really have to since that's the only functionality application has, it doesn't get aborted. I am not that good with Linux to be honest, but what seems logical to me is that when I read that data in application it needs to be stored somewhere, and that somewhere is in read-only part of memory.

Does what I wrote make any sense? If yes which parts of file system need to be mounted as tmpfs to fix it? If not what is actually happening and is it possible to fix it somehow?

By the way I am using Raspbian Jessie Lite if that means something to you.

Thanks in advance

[Charles]

@Harlock thanks for the headup I will update the doc

@mefi, I'm not specialist of QT, may be related to QT run time or other lib, that's strange, does the application need to write something somewhere ? may be in your homedir ?

Would be interesting to know how QT runtime works, I have no idea, sorry.

[mefi]

@Charles No, the application doesn't write anything to the file system. It only reads settings. I implemented a logging mechanism which I used while developing but it is disabled now. I've also tried other Qt application and they run well in read-only mode. I hope I find solution soon. I'll leave a comment here when I do so others know what to do in similar situation. Thanks for great article once again.

[mefi]

@Charles Just to let you and everyone know I fixed the problem. The logger class was trying to open file for writing logs, even when there were no logs, so I added some tests, and now it runs fine. It was my mistake after all..

[kxb3292]

hello,

I have a setup of raspberry pi 3 with raspbian jessie installed. On top of it I have installed kodi v16.
I have been able to switch read only/read write mode following this tutorial:

However, when i put the system in read only mode and try to launch kodi I get the following message:
"""
Could not init logging classes. Permission errors on ~/.kodi (/home/pi/.kodi/temp/)
ERROR: Unable to create application. Exiting
Couldn't get a file descriptor referring to the console
"""
Is there a way to make kodi write its logs to a different location (like RAM?) or make it stop writing all logs all together?

I would really appreciate any help!

Thank you so much,

[Charles]

@kxb3292
may be setting kodi temp folder to tmpfs adding this line to /etc/fstab file ?

tmpfs  /home/pi/.kodi/temp  tmpfs  nosuid,nodev  0  0

Or best change kodi temp folder to point to /tmp/kodi in it's config (I don't know if it's possible)

[smartypants_no]

Trying to make a ro mediaplayer, but when I install omxplayer dbus is a dependency, and dbus do not like a ro filesystem. What are the tricks to make dbus run on a read only filesystem?

[Charles]

@smartypants_no
Not sure it's possible, may be setting up dbus to works on tmpfs Filesystem like I suggested in previous post ?
Works is to find out which folder/file need to be on this system.

[powerpuff]

Hello there,
Thank you for posting this great tutorial!
I tried following your instructions on both Lubuntu 16.04 and on Ubuntu Mate 16.04 but unfortunately my Raspi3 no longer boots after adding the magic word "ro" on the fstab file.
Everything else seems to be working including the tmpfs commands
Any ideas why this would happen? Do these distros differ fundamentally from Rasbian Jessie?

Below are the errors shown on the screen when it hangs:
[34.800508] brcmfmac: brcmf_add_if: ERROR: netdev:wlan0 already exists
[34.800657] brcmfmac: brcmf_add_if: ignore IF event
[35.852809] brcmfmac: brcmf_add_if: ERROR: netdev:wlan0 already exists
[35.853037] brcmfmac: brcmf_add_if: ignore IF event

Thanks much!

[powerpuff]

Hello again,
I realized what my problem was...I was trying to make the GUI system read only (i.e. without removing the x server stuff). This leads me to a second question: Is it possible to make a basic Debian system with a GUI truly read only (like squashfs for an i386 architecture)? I assume the risks of running out of the 1GB Raspi memory, if only I knew how to get there.
Many thanks