Re: audit failed writes to read-only file-system?

From: Walter Roberson (roberson@ibd.nrc.ca)
Date: 02/28/02 

From: roberson@ibd.nrc.ca (Walter Roberson)
Date: 27 Feb 2002 23:12:22 GMT

In article <3C7D63E0.FD647F9E@coyotesong.com>,
Bear G <afu@coyotesong.com> wrote:
:Dustin Puryear wrote:

:> I am running Red Hat 6.2 and will be mounting /, /usr, and a few other
:> file systems read-only on our web servers.

:I won't say that you can't mount / read-only, but that's only because
:the
:fastest way to be called a fool is to make blanket statements like that.

:The problem is that you need to keep /etc writable, but if you make /etc
:a
:separate partition then it's not mounted when the kernel updates some
:key files on it.

I haven't played with Linux at all, but -generally- speaking it
is possible to have a read-only filesystem for root.

- You can send your syslog elsewhere (or just drop the entries)

- /etc/fstab is really a reflection of internal state, so if it isn't
writable the system doesn't really care

- the last login time files aren't critical

- you might have a few sockets to worry about; e.g., you might not
be able to run X or mysql .

I have run unix systems with read-only root in the past; I haven't
tried it lately.