I'm developing an embedded Buildroot OS for the Raspberry Pi. This system will be turned off by simply removing power (there will be no shutdown timer), therefore it must be able to handle poweroff without corruption of the SD card.
Currently the system is using a read-only squashfs for it's root filesystem, and this works well. However, it lacks flexibility because, obviously, the partition cannot be written to. The only way to install new software, for example, is to rebuild the entire OS in Buildroot. So I would like to change this to make the system read-only nearly all of the time but writeable in certain select situations.
What is the best way to utilise user permissions to prevent all writing to the SD card except in certain controlled circumstances? I'm thinking that I will simply do a
chmod -R u-w / on the entire filesystem, preventing the user from writing anything anywhere. Then, in order to write something, the user must authenticate with
Is this a robust approach to take?
One problem I can foresee is that processes run by the OS at boot will be run as root, and would therefore have write permissions. I would need to find a way to disallow the operating system from writing anything to the root FS unless it is explicitly commanded to by the user.
I could adjust the systems' init scripts so that they run as a non-privileged user - has anyone done this before? Is it possible to start system processes as a user other than root?