Protect your Raspberry PI SD card, use Read-Only filesystem

[Bcow7]

@Charles
Hi, I'm using eth0 and I don't have any Dongle or shield. I tried to list all modified files modified after I reboot in Read-Write, but I didn't find anything related to the MAC address... :-S

[MarkDurbin]

I've made a couple of scripts for this as I keep needing it for various projects.
These work with the standard desktop and with the chrome browser as I use it for kiosk mode.
The main problem I had was making the file system RO only to realize I needed to install/update something so I've included a script to re-enable RW mode.
Nothing complicated, but they seem to work reliably.
One caviat, if you riu the makerw script when the file system is already RW you'll screw up your OS, I should add a check at the start of the script really...
https://github.com/MarkDurbin104/rPi-ReadOnly

[Gregor Ratajc]

Hi,

great tutorial, helped me a lot! Hopefully this will end my SD card corruption problems. One thing I noticed is that there is a constant error in syslog: frequency file /var/lib/ntp/ntp.drift.TEMP: Read-only file system - ntp wants to write driftfile but is unable to. I fixed that so that driftfile command in /etc/ntp.conf points to /tmp/ntp.drift.

# /etc/ntp.conf, configuration for ntpd; see ntp.conf(5) for help

driftfile /tmp/ntp.drift

Another thing - I added loggly integration so I'm able to debug my Pi after reboots when syslogs are gone. I kept rsyslog and followed this guide (besides Python specific logging it also adds adds syslogs).

Some info about driftfile: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Deployment_Guide/s1-Understanding_the_Drift_File.html

[Charles]

@Gregor-Ratajc
Thanks for the tip, I updated the tuturial according driftfile

[Charles]

I also updated to avoid the random-seed file problem

[Bruce Aldridge]

I've used this multiple times, great resource.
One thing that could be made clearer is the tmpfs additions to fstab, I missed them and couldn't ssh in

[Christian Ferbar]

Thanks a lot for this tutorial!
On debian jessie /usr/lib/tmpfiles.d/var.conf chmods /var/spool to 0755. This means that /tmp is changed to 0755 as well because we changed /var/spool to point to /tmp. So the /var/spool line in /usr/lib/tmpfiles.d/var.conf has to be commented out.
/run and /run/lock are tmpfs already, maybe they are better softlink targets than /tmp.

[xproto]

@Bruce Aldridge
I cannot SSH too, to my RPi. What I did is I created a symlink for sshd

ln -s /tmp /var/run/sshd

Great article btw Charles! :). Thanks!

[xproto]

Update: My mistake I missed the sysmlink for /var/run.

No need for my first comment.

v
v
v

[Joo]

Hello,
There is a (rather new) Olimex single board card with onboard 4GB eMMC MLC/SLC Flash
Do you think this could be an answer to the corruption of data for an always on card ?
(with regular backup...of cours...) or the problem is not related to SD card ???
thx.

[notmichael]

I tried this tutorial twice and both times couldn't SSH in after the final reboot. I found this tutorial a little more helpful - http://petr.io/en/blog/2015/11/09/read-only-raspberry-pi-with-jessie/. I susptec the difference was the part they mentione specifically enables SSH after changing these settings. That tutorial also makes it a little more clear that you have to add three lines in /etc/fstab, not just add ro twice.

[Ing.Fernando]

Hi I successfully made my Pi Zero v 1.3 Read Mode, but a problem came up when I was trying to connect to internet with a 3g usb dongle.

First, the modem get connected to internet, but after a minute or less, it losed the connection, and then it reconnects, and the same story was looping forever.

After thinking, the problem was the DNS, because when the modem connects to internet, it changes the default DNS and tried to write the new DNS to the default file, here is the problem, the modem didn't notice that he cant write to the SD!

I took the solution from here: https://github.com/emoncms/emoncms/blob/master/docs/RaspberryPi/read-only.md

touch /tmp/resolv.conf
sudo rm /etc/resolv.conf
sudo ln -s /tmp/resolv.conf /etc/resolv.conf

touch /tmp/resolv.conf.dhclient-new
sudo chmod 777 /tmp/resolv.conf.dhclient-new
sudo rm /etc/resolv.conf.dhclient-new
sudo ln -s /tmp/resolv.conf.dhclient-new /etc/resolv.conf.dhclient-new

sudo mv /sbin/dhclient-script /sbin/dhclient-script_original
sudo ln -s /home/pi/emonpi/dhclient-script_raspbian_jessielite /sbin/dhclient-script

Then rebooted and all worked fine, the 3g modem connected to the internet and never disconnected, then I successfully SSH with weaved.com service.

After that another problem came up, my system is a GPS tracker for public transport, so there is a GPS module in my system, and the GPS was not working for the same reason as the 3g modem.

I'm using a "Ublox Neo 6m GPS" and GPSD to get the required information.

When GPSD run at boot it tryes to write a configuration file to open the stream, but it cant because the Pi is in read mode, so we need to put in that file what GPSD write at boot.

To solve this, just edit this file: /etc/default/gpsd

Then edit as this:

START_DAEMON="true"
GPSD_OPTIONS="-n"
DEVICES="/dev/ttyAMA0" #My GPS is connected via UART, change if yours is via USB or whatelse
USBAUTO="true"
GPSD_SOCKET="/var/run/gpsd.sock"

Finally reboot and all will work fine.

So, if you are having a problem with a sensor or what else, first verify if the program who communicates with it needs to write sometime to the SD.

Thank you and greetings from Mexico!!!

[FBorges]

Hi !

I've tried to complete tour tutorial but when I do the step "Move some system files to temp filesystem", I've detected that it result on a dbus problem that when the Raspberry is rebooted It can resolve the dhcp and hostname service.

Can anyone help me please?

[cfreund]

need to change UPEX4C_autoconfigfil in /usr/sbin/update-exim4.conf

[willn]

Will brick your Pi if you're running the new PIXEL distro. Any idea what's causing this?

[dgatwood]

You should really add some commentary about the tmpfs lines in /etc/fstab before the code listing. When I got to that step, I read that we were ready to set the volume to read-only, and thought, "I know how to do that," and stopped reading at that point, resulting in an unbootable system. I'd imagine many other folks with sysadmin experience will do the same. Actually, you should probably add the tmpfs lines first before you start making changes that depend on them, then make the changes, then change fstab a second time to make it read-only. Also, for Jessie, the systemd changes are unnecessary, because /run is already a tmpfs volume. And it might be worth redirecting things from /var/run to /run just for simplicity (on Jessie).

[Bruno Duarte]

How to fix this ?

pi@raspberrypi(ro):~$ reboot
Failed to execute operation: The name org.freedesktop.PolicyKit1 was not provided by any .service files
Must be root.

[mjeanne]

you need to be root..
use 'sudo'

[mocart2]

Hello! Can anybody help me with user crontab file? I have problem: i installed raspbian in Read-only mode, i have some scripts, (cron jobs) that works every 5 minutes, 10 etc. I set it by crontab -e command, but after reboot, system is clean it, i think, because i moved /var/spool dir to tmpfs (like howto), and user cronjob file stored at /var/spool/cron/crontabs dir. How i can fix it for not clearing after system reboot? Thanks!

[Cavallonzio]

Did anyone figured out how to use crontab? it is wiped after reboot and i really need it