Protect your Raspberry PI SD card, use Read-Only filesystem

[mefi]

@Charles No, the application doesn't write anything to the file system. It only reads settings. I implemented a logging mechanism which I used while developing but it is disabled now. I've also tried other Qt application and they run well in read-only mode. I hope I find solution soon. I'll leave a comment here when I do so others know what to do in similar situation. Thanks for great article once again.

[mefi]

@Charles Just to let you and everyone know I fixed the problem. The logger class was trying to open file for writing logs, even when there were no logs, so I added some tests, and now it runs fine. It was my mistake after all..

[kxb3292]

hello,

I have a setup of raspberry pi 3 with raspbian jessie installed. On top of it I have installed kodi v16.
I have been able to switch read only/read write mode following this tutorial:

However, when i put the system in read only mode and try to launch kodi I get the following message:
"""
Could not init logging classes. Permission errors on ~/.kodi (/home/pi/.kodi/temp/)
ERROR: Unable to create application. Exiting
Couldn't get a file descriptor referring to the console
"""
Is there a way to make kodi write its logs to a different location (like RAM?) or make it stop writing all logs all together?

I would really appreciate any help!

Thank you so much,

[Charles]

@kxb3292
may be setting kodi temp folder to tmpfs adding this line to /etc/fstab file ?

tmpfs  /home/pi/.kodi/temp  tmpfs  nosuid,nodev  0  0

Or best change kodi temp folder to point to /tmp/kodi in it's config (I don't know if it's possible)

[smartypants_no]

Trying to make a ro mediaplayer, but when I install omxplayer dbus is a dependency, and dbus do not like a ro filesystem. What are the tricks to make dbus run on a read only filesystem?

[Charles]

@smartypants_no
Not sure it's possible, may be setting up dbus to works on tmpfs Filesystem like I suggested in previous post ?
Works is to find out which folder/file need to be on this system.

[powerpuff]

Hello there,
Thank you for posting this great tutorial!
I tried following your instructions on both Lubuntu 16.04 and on Ubuntu Mate 16.04 but unfortunately my Raspi3 no longer boots after adding the magic word "ro" on the fstab file.
Everything else seems to be working including the tmpfs commands
Any ideas why this would happen? Do these distros differ fundamentally from Rasbian Jessie?

Below are the errors shown on the screen when it hangs:
[34.800508] brcmfmac: brcmf_add_if: ERROR: netdev:wlan0 already exists
[34.800657] brcmfmac: brcmf_add_if: ignore IF event
[35.852809] brcmfmac: brcmf_add_if: ERROR: netdev:wlan0 already exists
[35.853037] brcmfmac: brcmf_add_if: ignore IF event

Thanks much!

[powerpuff]

Hello again,
I realized what my problem was...I was trying to make the GUI system read only (i.e. without removing the x server stuff). This leads me to a second question: Is it possible to make a basic Debian system with a GUI truly read only (like squashfs for an i386 architecture)? I assume the risks of running out of the 1GB Raspi memory, if only I knew how to get there.
Many thanks

[rln-nard]

Hi
If you ever want to go "one step further", then please have a look at my project Nard SDK. Everything runs from RAM. The SD card isn't used at all (except for boot).
http://www.arbetsmyra.dyndns.org/nard/

[Charles]

@rln-nard
very interesting, thanks for sharing it

[Bcow7]

Hi,
Thank you very much for this tutorial. It helped me a lot! I have one issue that I can't solve by myself! I followed this tutorial step by step on my Raspian Jessie Lite system and it works perfectly...but when I put SD Card into another Raspberry Pi (same model RPi B+), it always boot with the IP (through Ethernet) 169.254.xxx.xxx. To fix it, I have to boot (only one time) without ",ro" in /etc/fstab for the disk "/". Then I can put back ",ro"! Do you think that I have some missing symlinks??
Thanks

[Charles]

@Bcow7
That's interesting, may be network config has MAC address hard coded and then it can't write the new. Did you tried to switch the SD and the Wifi Dongle at the same time ? (if you're not using eth0 of course) ?

[Bcow7]

@Charles
Hi, I'm using eth0 and I don't have any Dongle or shield. I tried to list all modified files modified after I reboot in Read-Write, but I didn't find anything related to the MAC address... :-S

[MarkDurbin]

I've made a couple of scripts for this as I keep needing it for various projects.
These work with the standard desktop and with the chrome browser as I use it for kiosk mode.
The main problem I had was making the file system RO only to realize I needed to install/update something so I've included a script to re-enable RW mode.
Nothing complicated, but they seem to work reliably.
One caviat, if you riu the makerw script when the file system is already RW you'll screw up your OS, I should add a check at the start of the script really...
https://github.com/MarkDurbin104/rPi-ReadOnly

[Gregor Ratajc]

Hi,

great tutorial, helped me a lot! Hopefully this will end my SD card corruption problems. One thing I noticed is that there is a constant error in syslog: frequency file /var/lib/ntp/ntp.drift.TEMP: Read-only file system - ntp wants to write driftfile but is unable to. I fixed that so that driftfile command in /etc/ntp.conf points to /tmp/ntp.drift.

# /etc/ntp.conf, configuration for ntpd; see ntp.conf(5) for help

driftfile /tmp/ntp.drift

Another thing - I added loggly integration so I'm able to debug my Pi after reboots when syslogs are gone. I kept rsyslog and followed this guide (besides Python specific logging it also adds adds syslogs).

Some info about driftfile: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Deployment_Guide/s1-Understanding_the_Drift_File.html

[Charles]

@Gregor-Ratajc
Thanks for the tip, I updated the tuturial according driftfile

[Charles]

I also updated to avoid the random-seed file problem

[Bruce Aldridge]

I've used this multiple times, great resource.
One thing that could be made clearer is the tmpfs additions to fstab, I missed them and couldn't ssh in

[Christian Ferbar]

Thanks a lot for this tutorial!
On debian jessie /usr/lib/tmpfiles.d/var.conf chmods /var/spool to 0755. This means that /tmp is changed to 0755 as well because we changed /var/spool to point to /tmp. So the /var/spool line in /usr/lib/tmpfiles.d/var.conf has to be commented out.
/run and /run/lock are tmpfs already, maybe they are better softlink targets than /tmp.

[xproto]

@Bruce Aldridge
I cannot SSH too, to my RPi. What I did is I created a symlink for sshd

ln -s /tmp /var/run/sshd

Great article btw Charles! :). Thanks!