1

I'm trying to make a read-only file-system (Raspbian). One common way is to place some directory (that are to be writable) in a tmpfs.

Example, I found some tutorials that suggest:

rm -rf /var/lib/dhcp/ /var/run /var/spool /var/lock
ln -s /tmp /var/lib/dhcp
ln -s /tmp /var/run
ln -s /tmp /var/spool
ln -s /tmp /var/lock

and in /etc/fstab:

tmpfs           /tmp            tmpfs   nosuid,nodev            0       0
tmpfs           /var/log        tmpfs   nosuid,nodev            0       0
tmpfs           /var/tmp        tmpfs   nosuid,nodev            0       0

as far as I understand:

  • /var/lib/dhcp/, /var/run, /var/spool and /var/lock are symlinked to /tmp that is mounted as tmpfs
  • but /var/log and /var/tmp are mounted on separated tmpfs

Why you can't mount just /tmp as tmpfs and symlink there all the other directories?

  • Strange technique... normally non-root users can write to /tmp but not to /var/log or /var/run. With the links above writing to /tmp is the same as writing to these directories. Still access rights or avoiding name clashes could be an explanation. – xenoid Sep 5 '17 at 11:32
  • 1
    It makes sense. About the "strange" technique - would you mind to suggest a better one? – Mark Sep 5 '17 at 11:48
  • 1
    As far as a I can tell, one could make separate directories under /tmp/ (or even to be cleaner /tmp/var) and link each /var/something to the matching /tmp/var/something (with adequate access rights). – xenoid Sep 5 '17 at 13:15
  • Ok, that was I tried to say with Why you can't mount just /tmp as tmpfs and symlink there all the other directories? – Mark Sep 5 '17 at 13:24
0

Although there is no one true correct approach, one of the better ones is the one suggested by xenoid: mount /tmp as tmpfs and make subdirectories there with the appropriate permissions. Then link the appropriate subdirectories of /var to those.

In general, it's probably not a good idea to mount multiple temporary file systems unless you manually specify their size. By default (according to man tmpfs), each will get half the amount of RAM available. Your example would use up a total of 87.5% of whatever the free memory is at time of mounting, and each successive instance is half the size of the previous one. This is a profoundly strange thing to do.

As an alternative, if you truly only want a temporary file system, you could make a single large tmpfs and use UnionFS or something similar to make a writeable temporary overlay of /. The possible safety you lose in having a fundamentally writeable / (with permissions providing the usual amount of security anyway) is offset by the whole thing being cleared on reboot.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.