4 ms·

/usr can be made read-only. It is more convenient to have everything in /usr than to have /bin, /sbin, /lib, etc.

• vbezhenar 10y ago
  I would argue, that it's better to mount / as RO and remount /var, /home as RW.
  • lomnakkus 10y ago
    It's not just amount mounting as RO. It could physically be RO (or use e.g. dm-verity or similar)... which would be quite inconvenient if you wanted to add-site-specific directories under /. (Or if a distro wants to add a directory, or whatever.). Also, wouldn't mounting /var, /home etc. RW on top of a RO-mounted / require that they were actually on different file systems? I don't think you can have a RW bind mount on a RO-mounted file system. (Haven't tried it, though.)
    • hawski 10y ago
      > It's not just amount mounting as RO. It could physically be RO (or use e.g. dm-verity or similar)... which would be quite inconvenient if you wanted to add-site-specific directories under /. (Or if a distro wants to add a directory, or whatever.). You could use two partition update scheme as ChromeOS. I am working on Linux distribution that have rootfs as a squashfs image and I want to have as painless updates as on ChromeOS. > Also, wouldn't mounting /var, /home etc. RW on top of a RO-mounted / require that they were actually on different file systems? I don't think you can have a RW bind mount on a RO-mounted file system. (Haven't tried it, though.) You can mount RW fs on RO fs. Distributions on Live-CDs do it all the time.
      • lomnakkus 10y ago
        > You can mount RW fs on RO fs. Distributions on Live-CDs do it all the time. Right, but that's with OverlayFS and such, right? (I.e. not just straight bind mounts.) Seems awfully complicated to solve what essentially should be a non-problem... (I'm aware OverlayFS has other uses, but in this instance it seems like overkill.) EDIT: I'll just note, I did say "separate filesystem" (i.e. non-bind), but I guess it might have been easy to miss.
        • hawski 10y ago
          > Right, but that's with OverlayFS and such, right? (I.e. not just straight bind mounts.) Most probably yes, but there are probably distributions using ro rootfs + specific mounts. I think that in many cases embedded devices would use such a scheme instead of OverlayFS. EDIT: But you probably have to mount workdir and upperdir somewhere over this ro rootfs for OverlayFS to work. > EDIT: I'll just note, I did say "separate filesystem" (i.e. non-bind), but I guess it might have been easy to miss. I was hoping that you could read between the lines also :) I mentioned my WIP distribution. I have mounted: - squashfs ro on / - ext4 rw on /mnt/rw - /mnt/rw/var bind on /var - /mnt/rw/home bind on /home
          • lomnakkus 10y ago
            > > EDIT: I'll just note, I did say "separate filesystem" (i.e. non-bind), but I guess it might have been easy to miss. > I was hoping that you could read between the lines also :) I mentioned my WIP distribution. I have mounted: Oooh, burn! :) I honestly didn't see any relevant mention of the WIP-distro you're talking about... but now that you mention it I had a look back. "I am working on Linux distribution" (etc.). > I have mounted:[snip] So... separate file systems.
    • thinkmassive 10y ago
      I recently joined a project that uses OSTree to deliver atomic OS updates (read-only), and flatpak for applications. I'm still learning the implementation details, so I might not be able to provide much detail yet, but it seems like an interesting approach to reliably deliver Linux to non-technical users. https://endlessm.com/for-developers/ https://endlessm.com/for-developers/