My system is based upon Raspbian Stretch and has three partitions:
I don't have a lot of background services, just samba, ssh, lighttpd. I'm looking for a recommended way to mount the second partition as read-only.
Most guides I find are related to Jessie and they refer to outdated files. I'm able to mount the partition as ro, but I don't know what should I do with logging and the other system features that need to write to disk.
I was able to get this guide to work with Stretch 2017-11-29:
https://www.raspberrypi.org/forums/viewtopic.php?f=63&t=161416
A few notes, though:
In the second code block, there is no "local-bottom" directory to copy, which is also noted by posts below the original. This is fine, and you don't need an "overlay-bottom" directory for it to work.
In the third code block, be sure to scroll down and modify/add every line that differs, not just the top 4, which get commented. This is where I really got into trouble when I made mistakes.
Below, I have copied the block and marked modified lines (m) and added lines (a).
m# if [ "${readonly}" = "y" ]; then
roflag=-r
m# else
m# roflag=-w
m# fi
# FIXME This has no error checking
modprobe ${FSTYPE}
checkfs ${ROOT} root
# FIXME This has no error checking
# Mount root
a mkdir /upper /lower
if [ "${FSTYPE}" != "unknown" ]; then
m mount ${roflag} -t ${FSTYPE} ${ROOTFLAGS} ${ROOT} /lower
else
m mount ${roflag} ${ROOTFLAGS} ${ROOT} /lower
fi
a modprobe overlay
a mount -t tmpfs tmpfs /upper
a mkdir /upper/data /upper/work
a mount -t overlay \
a -olowerdir=/lower,upperdir=/upper/data,workdir=/upper/work \
a overlay ${rootmnt}
If you're curious about what's happening beneath, this document provided a reasonable explanation for me: https://www.kernel.org/doc/Documentation/filesystems/overlayfs.txt
I forked some existing scripts to easily setup a read-only root filesystem on a fresh install of the raspbian stretch dist.
With a single paste of commands from the README, everything will be configured and the Pi will reboot into read-only mode.
Two simple .sh scripts are placed in /root. One to reboot in to permanent-write mode (disable read-only mode permanently) and one to enable read-only permanently.
Get the script here: https://github.com/JasperE84/root-ro
