Linux in general is moving slowly towards a system where /
can be mounted as "read-only" and other partitions can be mounted as "writable".
This move is done by moving things into directories with "run" as a sub directory. Those are "writable". When you look at df -h
you will see a few of these already:
$ df -h
Filesystem Size Used Avail Use% Mounted on
udev 5,8G 0 5,8G 0% /dev
tmpfs 1,2G 9,5M 1,2G 1% /run
/dev/sda2 46G 8,1G 36G 19% /
tmpfs 5,9G 31M 5,8G 1% /dev/shm
tmpfs 5,0M 4,0K 5,0M 1% /run/lock
tmpfs 5,9G 0 5,9G 0% /sys/fs/cgroup
/dev/sda1 47M 3,6M 43M 8% /boot/efi
/dev/sda5 34G 11G 22G 34% /home
/dev/sdb1 917G 235G 636G 27% /discworld
cgmfs 100K 0 100K 0% /run/cgmanager/fs
tmpfs 1,2G 76K 1,2G 1% /run/user/1000
As another measure these are (often) mounted as a temporary filesystem (tmpfs).
Now to get to the point.
As files at the moment are not defined by being writable or not they are scattered all over the filesystem.
Following the FHS and sticking to the main directories:
/bin
, /lib
, /sbin
and /usr
can be mounted read-only.
/etc
, /home
, /srv
, /tmp
, /var
must be writable.
/dev
, /proc
, /selinux
and /sys
are handled by special filesystems.
Readonlyroot on Debian pages has a more indepth article on specific files that prevent a directory from being read-only. For instance /etc/
is pretty much a mess in regards to getting it separated into read-only and writable files.
The command at the end of the link only works for zsh
. In chat @serg came up with this as an alternative:
{ lsof +L1; lsof|sed -n '/SYSV/d; /DEL\|(path /p;' ; } |grep -Ev '/(dev|home|tmp|var)'
This command list processes that are open:
lsof /
And here is a filter to only show the process ids that prevent you to mount as read-only:
lsof -F pa /home | awk '/^p/ {pid = substr($0, 2)} /^a.*w/ {print pid}'
Gilles came up with that last one so upvote his answer :)