I'm developing an embedded Buildroot OS for the Raspberry Pi. This system will be turned off by simply removing power (there will be no shutdown timer), therefore it must be able to handle poweroff without corruption of the SD card.

Currently the system is using a read-only squashfs for it's root filesystem, and this works well. However, it lacks flexibility because, obviously, the partition cannot be written to. The only way to install new software, for example, is to rebuild the entire OS in Buildroot. So I would like to change this to make the system read-only nearly all of the time but writeable in certain select situations.

What is the best way to utilise user permissions to prevent all writing to the SD card except in certain controlled circumstances? I'm thinking that I will simply do a chmod -R u-w / on the entire filesystem, preventing the user from writing anything anywhere. Then, in order to write something, the user must authenticate with sudo.

Is this a robust approach to take?

One problem I can foresee is that processes run by the OS at boot will be run as root, and would therefore have write permissions. I would need to find a way to disallow the operating system from writing anything to the root FS unless it is explicitly commanded to by the user.

I could adjust the systems' init scripts so that they run as a non-privileged user - has anyone done this before? Is it possible to start system processes as a user other than root?

  • 1
    Then why do you write boot processes that writes to filesystem if you don't want it to write? – 炸鱼薯条德里克 Jun 9 at 1:48
  • I don't understand your comment sorry – Jeremiah Rose Jun 9 at 1:57
  • Any particular reason you're not using a normal writable filesystem mounted read-only? – Fox Jun 9 at 8:16
  • I'm going for very quick boot times and squashfs offers a slight performance advantage. But I'd be happy to use a different filesystem. – Jeremiah Rose Jun 9 at 11:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.