1

I install Debian with separate /, /boot, /usr, /usr/local, /var, /tmp, and /home partitions. Assuming some of these partitions could be placed on a drive that has a physical "read only" switch, could any of these partitions function properly with write access prohibited? Assume that I'll only use the root account during install and upgrades, so I would switch off read-only mode during these times.

Improve this question

2 Answers 2

Reset to default
1

Out of the ones you list, the root, /boot and /usr hierarchies (and /usr/local as part of /usr) would be able to be mounted read-only, unless updates to installed software has to be performed.

/var is by definition variable data and needs to be writable, /tmp likewise needs to be writable to be able to create temporary files, and users would be upset to have /home mounted read-only...

The root (/) may be mounted read-only if any directories that requires writes are mounted separately and on writable partitions.

The directories that need to be writable are: /etc, /home, /srv, /tmp, and /var.

Further reading: https://wiki.debian.org/ReadonlyRoot

Improve this answer
4
  • If you want to make the root partition read-only, You should add /root to the list of directories that need write access. It is the default home directory for the root account. Even if you don't generally login as root and use sudo, you still may have to run programs that need to create files in the root home directory.
    – farhangfarhangfar
    Jan 28, 2017 at 23:30
  • @farhangfarhangfar There's no real reason to have /root writable as far as I know. Anything you'd like to write there might as well be written elsewhere.
    – Kusalananda ♦
    Jan 28, 2017 at 23:43
  • Depending on what programs you are using you can end up with situations like this: Before root was read only, you ran a program and created a config file /root/program/program.cfg. Now when you run the program you have an updated config file that had to be written to a different directory and you have to specify this config file on the command line. Then if you run the program and forget to specify the new config file, you end up running the program with the old undesired config file.
    – farhangfarhangfar
    Jan 29, 2017 at 0:06
  • @farhangfarhangfar Maybe I'm just lucky that I never ever have had to run such a program as root then.
    – Kusalananda ♦
    Jan 29, 2017 at 0:07
1

/boot, /usr, and /usr/local can be read-only except when you are adding or upgrading software. The rest need write access all the time.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .