Am 01.07.2012 19:32, schrieb Joe Zeff: > On 07/01/2012 10:23 AM, John Wendel wrote: >> Extra security is certainly a plus. My main reason for wanting to run a >> read-only root it to avoid wearing out the consumer grade compact flash >> card that I'm using as my root device (yes, I'm cheap). > > I'd suggest, then, using a distro that doesn't update as frequently as Fedora. /sbin is on the root device and > you'd need to set it to rw every time one of its programs gets updated. Also, if you're using Fedora, have a > separate /boot that's not on that card to make kernel updates easier. i do it the other direction /var/cache, /var/lib, /boot, /var/tmp, /var/log and /tmp on own partitions or in case of virtual machines even on drives because i can have rootfs as small as possible without fearing it gets full

this would have the same effect without the problem of have to remeber remount rw before updates with "yum-plugin-security" and "yum update --security" you can even on Fedora minimize updates most of the time if you really want while you can update packages selective from the normal repos if a update fixes a bug which affects you

On 07/01/2012 12:17 PM, jdow wrote: > [SNIP] > The equivalent is done with live CDs you know. > > {^_^} I think you just supplied the answer! I didn't think of it, but the equivalent of a live CD is exactly what I need. Now I just need to figure out how to build a live CD like system, minus the compressed filesystem stuff and I should be there. I should have mentioned earlier that this box is going to be a dedicated media player, with the compact flash drive as it's only disc. I know I should probably just use openelec or geexbox, but that would take all the fun out of it. I will try to steal the init system from one of these dedicated distributions, but I really want to build the system with Fedora packages as much as possible. Thanks everyone for sharing your knowledge. John

Am 01.07.2012 19:23, schrieb John Wendel: > On 07/01/2012 10:11 AM, Reindl Harald wrote: >> >> Am 01.07.2012 19:08, schrieb Joe Zeff: >>> On 07/01/2012 10:01 AM, John Wendel wrote: >>>> Is it possible to setup Fedora, using Fedora provided tools/software, >>>> with a read-only root partition? >>>> >>>> There's an ancient wiki entry from the FC6 days that indicates that some >>>> work was done, but I would assume that this depended on the SysV init >>>> system. I've haven't seen any mention of read-only root setup with systemd. >>>> >>>> Any clues would be greatly appreciated. >>>> >>> If I'm not mistaken, /var needs to be on that partition and needs to be writable. >> it is not uncommon to have /var on a own partition >> >>> If so, then you can't have a >>> read-only root partition. >> it works, but be really carefull >> >>> And, just so we all know where we're going here, why would you want to? >> in theory more security >> >> imagine a root-exploit changing a system binary >> much more difficult if the rootfs is readonly >> > Extra security is certainly a plus. My main reason for wanting to run a read-only root it to avoid wearing out the > consumer grade compact flash card that I'm using as my root device (yes, I'm cheap) even if it works - you have ALWAYS to remember remount it rw on any yum-update - i personally would not do it because of some hardware

On 07/01/2012 10:23 AM, John Wendel wrote: > Extra security is certainly a plus. My main reason for wanting to run a > read-only root it to avoid wearing out the consumer grade compact flash > card that I'm using as my root device (yes, I'm cheap). I'd suggest, then, using a distro that doesn't update as frequently as Fedora. /sbin is on the root device and you'd need to set it to rw every time one of its programs gets updated. Also, if you're using Fedora, have a separate /boot that's not on that card to make kernel updates easier.

On 07/01/2012 10:11 AM, Reindl Harald wrote: > > Am 01.07.2012 19:08, schrieb Joe Zeff: >> On 07/01/2012 10:01 AM, John Wendel wrote: >>> Is it possible to setup Fedora, using Fedora provided tools/software, >>> with a read-only root partition? >>> >>> There's an ancient wiki entry from the FC6 days that indicates that some >>> work was done, but I would assume that this depended on the SysV init >>> system. I've haven't seen any mention of read-only root setup with systemd. >>> >>> Any clues would be greatly appreciated. >>> >> If I'm not mistaken, /var needs to be on that partition and needs to be writable. > it is not uncommon to have /var on a own partition > >> If so, then you can't have a >> read-only root partition. > it works, but be really carefull > >> And, just so we all know where we're going here, why would you want to? > in theory more security > > imagine a root-exploit changing a system binary > much more difficult if the rootfs is readonly > Extra security is certainly a plus. My main reason for wanting to run a read-only root it to avoid wearing out the consumer grade compact flash card that I'm using as my root device (yes, I'm cheap)

On 07/01/2012 10:01 AM, John Wendel wrote: > Is it possible to setup Fedora, using Fedora provided tools/software, > with a read-only root partition? > > There's an ancient wiki entry from the FC6 days that indicates that some > work was done, but I would assume that this depended on the SysV init > system. I've haven't seen any mention of read-only root setup with systemd. > > Any clues would be greatly appreciated. > If I'm not mistaken, /var needs to be on that partition and needs to be writable.

If so, then you can't have a read-only root partition.

And, just so we all know where we're going here, why would you want to?

it is not uncommon to have /var on a own partition