Read-only-rootfs writable

Hi

I am trying to create an image with a read only file system based on your yocto/openembedded guide.

I have built core-image-minimal for MACHINE = "colibri-imx6" and added EXTRA_IMAGE_FEATURES += "read-only-fs" to local.conf. However when booting the resulting image (installed via the Toradex Easy Installer) it isn’t read-only, I can still create files anywhere (everywhere I tried at least). As far as I can tell read-only-rootfs has made no difference.

The environment is set up according to OpenEmbedded (core) - Toradex System/Computer on Modules using Ubuntu 18.04.

Any ideas?

Thanks

Moritz

Hello @LVTTL ,

Greetings from Toradex!

This question has been already discussed in our community forum a couple of times. I will link them below and please kindly have a look if they are relevant to your situation.

Best Regards,
Janani

Hello @saijanani.tx

I have seen these 2, but couldn’t find an answer. I have tried core-image-minimal and console-tdx-image, no LXDE in sight as far as I can tell. The build runs successfully, no indication that something might not work with the read-only-fs. I just end up with a root fs that is still writable.

Kind Regargs

Moritz

Dear @LVTTL ,

Thanks again for your update, I only recently noticed that you have included EXTRA_IMAGE_FEATURES += "read-only-fs" instead of read-only-rootfs.
There exists no flag named “read-only-fs”.

Was it a typo on the question or perhaps it could be the reason for the writable rootfs?

Best Regards,

Janani.

Hello @saijanani.tx ,
Oops, that was a mistake typing this up. I use read-only-rootfs. I also built the same image (that sets EXTRA_IMAGE_FEATURES_append = " read-only-rootfs") for a different machine and it works there.

Kind Regards

Moritz

I have just noticed something:

It seemsro is passed to the kernel, but it seems to ignore it.

cat /proc/cmdline yields:

galcore.contiguousSize=50331648 user_debug=30 ip=off root=/dev/mmcblk0p2 ro rootfstype=ext4 rootwait fec_mac=00:14:2d:4c:bd:48 consoleblank=0 no_console_suspend=1 console=tty1 console=ttymxc0,115200n8 video=mxcfb0:dev=lcd,640x480M@60,if=RGB666 video=mxcfb1:off fbmem=8M

This time I built using the image using BSP 2.8 for a custom machine based on the colibri-imx6. The only differences being that the custom machine sets a custom device tree and selects linux-toradex-rt as the default kernel. This image however is based on the non-RT kernel (overidden in local.conf), since we had issues with the RT kernel.

Kind regards
Moritz

Hello @LVTTL ,

Thank you for your patience. We have been able to reproduce the same issue at our side and we are currently looking into why it happens and what could be a possible workaround.

We will keep you updated on the developments promptly.

Thank you again for your understanding.

Best Regards,
Janani

Hi @saijanani.tx

No worries, I’m glad we’re getting to the bottom of this.
Any idea when a workaround might be ready?

Thanks

Kind Regards

Moritz

It seemsro is passed to the kernel, but it seems to ignore it.

No, initially the root file system always gets mounted read-only and systemd will subsequently re-mount it read/write. To avoid this I believe fstab needs adjusting as well. Did you do that?

Hi @LVTTL

As @marcel.tx pointed out, you need to adapt the file /etc/fstab.

Change the first line to this and you will get a read-only file system:

/dev/root            /                    auto       noatime,ro            1  0

We will also investigate why this is not set by the option EXTRA_IMAGE_FEATURES_append = " read-only-rootfs".

Best regards,
Jaski

BTW: noatime does not make any sense together with ro (;-p).

Hi @jaski.tx

Thanks! This works.
For anyone interested I have created a .bbappend that patches fstab to mount root as read-only.
Note that this makes all images read-only.
Link here: https://github.com/zechenturm/meta-ntb/tree/master/meta-ntb-toradex/recipes-core/base-files

@marcel.tx Fair point :stuck_out_tongue:

Kind Regards

Moritz

Hi @LVTTL

Perfect that it works. Thanks for the feedback.

@marcel.tx: Thanks for your Input.

Best regards,
Jaski

Any updates on why EXTRA_IMAGE_FEATURES_append = " read-only-rootfs" does not work?

Hi @brayan.almonte ,

Can you specify what exactly does not work? What is expected from your side? Are you talking about run time or build time?

Our Reference Images contain some configurations that are put in place at first boot rather than at build time.

Furthermore, there exists a systemd remount service, which may or may not be enabled in the presence of read-only rootfs. The service is called systemd-remount-fs.service.

Best Regards
Kevin

“Furthermore, there exists a systemd remount service, which may or may not be enabled in the presence of read-only rootfs.”

What does this mean? “may or may not” seems rather vague.

"As @marcel.tx pointed out, you need to adapt the file /etc/fstab … We will also investigate why this is not set by the option EXTRA_IMAGE_FEATURES_append = " read-only-rootfs".

What was the result of this investigation? I ask because - as of 5.6.0 - it’s still not automatically changed as a result of specifying read-only-rootfs

“It seems ro is passed to the kernel, but it seems to ignore it.”

In my testing “ro” is passed to kernel (/proc/cmdline) regardless of whether “read-only-rootfs” is specified in EXTRA_IMAGE_FEATURES_append.

In fact I can’t figure out what - if anything - passing “read-only-rootfs” to the build achieves. Either way it is required to manually change fstab to “,ro”. After changing fstab I see the same read only root behavior regardless of whether or not I specify “read-only-rootfs”. For either build (with/without read-only-rootfs") if I change / to be ‘ro’ in fstab, I get 3 new overlay filesystems created automatically, for /var/cache, /var/lib and /var/spool.

Looking in the build log for with and without “read-only-rootfs” I see no difference.