AlmaLinux 8. Read-only root system

Links

https://access.redhat.com/documentation/ru-ru/red_hat_enterprise_linux/8/html/managing_file_systems/setting-read-only-permissions-for-the-root-file-system_managing-file-systems

Installation

Install readonly-root package

dnf install -y readonly-root

In the /etc/sysconfig/readonly-root file, set the READONLY option to yes to mount the file systems as read-only

nano/etc/sysconfig/readonly-root

...
READONLY=yes
...

If you want really RO system, comment all the rules in /etc/rwtab

Add the ro option in the root entry (/) in the /etc/fstab file

nano /etc/fstab

...
/dev/mapper/luks-c376919e...  /  xfs  x-systemd.device-timeout=0,ro  1  1
...

Enable the ro kernel option

Ensure that the rw kernel option is disabled

grubby --update-kernel=ALL --args="ro"

grubby --update-kernel=ALL --remove-args="rw"

If you need to add files and directories to be mounted with write permissions in the tmpfs file system, create a text file in the /etc/rwtab.d/ directory and put the configuration there.

For example, to mount the /etc/example/file file with write permissions, add this line to the /etc/rwtab.d/example file:

// It doesn't work in a way how we need it to work. Yeah, dirs and paths will be mounted RW and you can write to these dirs and files.

// But, after reboot, the directory, in which you wrote some files, will be emptied.

// Because changes made to files and directories in tmpfs do not persist across boots

// So, I prefer to remount FS in RW online, make changes, and set FS in RO again (or reboot).    

nano /etc/rwtab.d/example

---

dirs /opt

files /root/test.txt

---

Reboot the system to apply the changes.

Now your system is read-only!

To remount FS as RW

mount -o remount,rw /

To remount FS as RO again

mount -o remount,ro /

-OR-

reboot

Also you can add the aliases for the commands above

nano ~/.bashrc

...
alias rw='mount -o remount,rw /'
alias ro='mount -o remount,ro /'

Relogin