Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an embedded system setup built using buildroot and using initramfs. It runs on compact flash device where I have created separate ext3 partitions to mount /etc/ and /var directories as well as custom directory to store data. I am not entirely certain if this is a good idea or not, but I need access to sytem log output and also need to be able to modify files in /etc as they require a static IP address to be configured here. Once the /etc/network/interfaces file has been edited to set the IP, I have no further need to manually edit anything in /etc so I was wondering if making this mount as read only when the devices are out in the field is a good idea or whether it is possible that other applications on my system need to write to any files in /etc ? I run a fairly minimal system, really just dropbear and busybox are running (as well as my custom controller application that controls the devices). I have looked around on various forums and sites and this idea does not seem too controversial, but my knowledge is fairly limited. I realise I could just try mounting it as read only, but it seems possible that things could break silently so is it a bad idea??

share|improve this question
You might be interested in this recent question: unix.stackexchange.com/questions/62974/… – goldilocks Jan 29 '13 at 15:15
up vote 3 down vote accepted

A read-only /etc is increasingly common on embedded devices. A rarely-changing /etc is also increasingly common on desktop and server installations, with files like /etc/mtab and /etc/resolv.conf located on another filesystem and symbolically linked in /etc (so that files in /etc need to be modified when installing software or when the computer's configuration changes, but not when mounting a USB drive or connecting in a laptop to a different network).

The emerging standard is to have a tmpfs filesystem mounted on /run and symbolic links in /etc like

/etc/mtab -> /run/mtab
/etc/resolv.conf -> /etc/resolvconf/run/resolv.conf

Existing or embedded systems may have the tmpfs mounted on a different location such as /dev/shm or /lib/init/rw or /var/run.

The problem with making /etc read-only is that this locks the set of files that you'll ever be able to modify.

A different approach that avoids this problem is to make the root filesystem an initramfs. This is an archive that's stored next to the kernel image and loaded by the bootloader. It is unpacked into RAM and becomes the root of the root of the filesystem. If you're going to let the initramfs stick around, it shouldn't be too big (because it's using up precious RAM), but a BusyBox binary plus some configuration files may be an acceptable use of RAM.

Another approach is to have a read-only root filesystem plus a union mount of a read-write filesystem.

share|improve this answer

That is distribution specific, but a few things I can think of:

/etc/mtab, /etc/adjtime and /etc/resolv.conf are typical files that may need modified. /etc/motd and /etc/issue might be as well. cups updates some of its configuration files by itself as well. Some things might want to create a nologin file in /etc as well.

In most instances, you should be able to replace the file with a symlink to one under /var.

share|improve this answer

Just check that there is nothing in there that is modified. The last modification times (as reported by ls(1)) should be enough. Many current Linux distributions should be there already (or almost). You can try to make it read-only, and look for anything complaining in the logs.

OTOH, /etc is rather small, so skimping on R/W space on its account doesn't make much sense.

share|improve this answer
Making things read-only can be much more about reliability than saving some space. E.g., if its read-only and your box gets the cord pulled on it, no corruption, no fsck. – derobert Jan 29 '13 at 16:19
@derobert, if "somebody" is able to frob /etc (or system files in general) you have much more serious problems. Besides, those files are very rarely modified, and so the time window for corruption is vanishingly small anyway (in my many Unix/Linux years, I've never seen such corruption, but plenty of messups in user's data and files under /var). – vonbrand Jan 29 '13 at 16:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.