Protect your Raspberry PI SD card, use Read-Only filesystem

[alwayslearning]

Hello,

Almost two years ago I made something similar to my Pi but I lost the SD auto detect and auto mount, can you please tell me if you have the SD Auto detected functionality working while in read-only mode?

Best regards

[Charles]

@alwayslearning
I was not aware of this feature, what is this for ? to know if SD is pluuged or not ? that's a good idea but I do not use it.

[alwayslearning]

Hello, sorry it's not the SD auto detect, it's the USB auto detect and auto mount, that feature is really importante if you use your pi and wan't to simply change content or program data with a new USB stick/pen.

[nicklas]

Hello

Thank you very much for a very helpful tutorial!

I have one comment and one question.

I think you should mention that you also have to mount /tmp as tmpfs in /etc/fstab
After doing that it works like a charm.

But I also want samba to serve some files from my rpi. I find samba hard to handle here since it seems to need to write to some files in /var/lib/samba. When I boot with writable / it works, but not if I remount as writable after boot. If I make it writable after boot, it seems like smbd starts, but I cannot connect to the shares. What I think I have to do is create some files in /tmp at boot time maybe with tdbtool, but I don't know yet what files and if it will work. I will continue to investigate, but any time saving tips is highly appreciated :-).

[nicklas]

I think I have solved my samba problem with an ugly hack.
I copied everything in /var/lib/samba to a backup-folder.
THen I put a symlink to /tmp so /var/lib/samba is found there.

Then I put a line in rc.local that copies the content of my backed up /var/lib/samba back (which now points to /tmp
and another line starting smbd

Now I can connect to my shares in my read only filesystem.
Of course I copy only the needed files, but this was the quich and dirty version
I have disabled nmbd, but it should work too now I guess.

To not make unsuccessful appempts to start smbd before doing the copy I also disabled sbd with update-rc.d

[Charles]

@nicklas
thank for the head up, this tip can help some applications not directly compatible with read only filesystem.
Curious you're the second telling me for tmpfs to be done in /etc/initab, may be related to jessie because I did not defined it in my fstab entrie and by default tmp goes to tmpfs.

[nicklas]

Interesting. I haven't rechecked but I had problems when /tmp wasn't mounted in /etc/fstab as tmpfs. What made me try that was the original blog post that you refer to. In his /etc/fstab is a line for /tmp, but he doesn't mention it in the text.

I use minibian jessie, so it is not the full raspbian distro. Don't know if that could make a difference.

[Charles]

Hummmm, minibian?
just reading the name, I like it, was searching for a minimal distro for long time, I'll try it

[arnt]

Thanks for sharing this post!
I was able to get it forking with the RASPBIAN JESSIE LITE distro.

Some minor issues were solved by adding

tmpfs /tmp tmpfs mode=1777,nosuid,nodev 0 0
tmpfs /var tmpfs mode=1777,nosuid,nodev 0 0

to /etc/fstab

I used the resolvconf package for fixing some issues with dhcpcd

[Charles]

@arnt
Thank, for the fixes, I really need to take time to test on jessie

[icepick]

What arnt wrote works indeed with Jessie (otherwise it won't boot). Does anyone know a way to still make it boot in the graphical interface? I didn't remove the xserver packages as written above.. the box boots to a black screen now (I can still ssh to it)..

[Petr Klus]

Hello!

Sorry for being lazy but I would you consider providing pre-built images with all of the work above built-in? Or, alternatively, a script one can use that does all of the above?

[Petr Klus]

@arnt - what did you do with resolvconf?

[Petr Klus]

@arn I've written up instructions for Jessie inspired by this post (and many other). See here:

http://petr.io/2015/11/09/read-only-raspberry-pi-with-jessie/

[Charles]

@Petr-Klus
Since I migrated to Jessie, I've updated the post according to your changes, thanks for that.

I also corrected Fancy Prompt (was not working on Jessie) and ro/rw alias to also mount/remount /boot to avoid error when apt-get upgrade was upgrading also bootloader

[kamikazefish]

Thanks for the great tutorial. Works great! If I would make a third partition on the SD card, and put the logs there and a fourth partition for the program data, would this still prevent my raspberry pi from not booting? The system files and programs would be read only. If not, would using an usb stick for the logs and program data be better?

[Charles]

@kamikazefish
yes have more partition for R/W data could be a great idea and would work. but in this case you won't prevent data corruption on power loss

[kamikazefish]

Ok that wouldn't be a big deal with the log files. For the program data I think there are some work arounds. I could implement unionfs with 2 partitions, one with a working state and the other as working dir. Then every x minutes I sync the files from the working dir to the working state. These writes are to an temp file, that are renamed after the write, to prevent corrupting the working state files.

[Harlock]

Thank you very much for this!
Just to add my 2 cents: in Raspbian Jessie (mini) everything was fine except for the DHCP client which after fstab modification it was taking a life to stop waiting for an IP.
I solved editing /etc/systemd/system/dhcpcd5 this way:

changed the line

PIDFile=/run/dhcpcd.pid

into

PIDFile=/var/run/dhcpcd.pid

And now is fine.

[mefi]

Thanks for this. It really gives the stability to micro SD card that I need.

I have one question that may not be really about this topic, but in some way it is. I developed a Qt application which is basically a dummy application. It receives messages and images over UDP sockets, and shows them on the screen. The problem I have is that when I am in read-only mode application just aborts after about half a second or so. When it is run in read-write mode it works great.

After removing chunks of code and testing it in read-only mode I found out that if application don't process received messages, which i really have to since that's the only functionality application has, it doesn't get aborted. I am not that good with Linux to be honest, but what seems logical to me is that when I read that data in application it needs to be stored somewhere, and that somewhere is in read-only part of memory.

Does what I wrote make any sense? If yes which parts of file system need to be mounted as tmpfs to fix it? If not what is actually happening and is it possible to fix it somehow?

By the way I am using Raspbian Jessie Lite if that means something to you.

Thanks in advance