I want to mount my root filesystem as read-only on boot, and use separate writable partition for logs. Is it necessary to create a ramfs image for such task?
How can I do this?
Yes, typically you would not want to mount / as read-only. I would recommend putting /usr in it's own partition and then mounting that read-only since it contains the majority of your executable files, which you would want to protect against manipulation of binaries. You could also run lsof to determine what processes are writing to the directories under /.
i tried creating separate partitions for /var, /tmp, /home,/proc and mount them as rw and mount / as ro.
system boots normal and i can login and run commands but i type mount command it shows every thing mount as rw! when i try to modify some thing it tell me that ro flag is set! so i beleive this is because /etc/mtab is read-only can't be modified.
what problems may be caused with such case? what else can happen? what programs need to modify /etc ?