Laptop scientist and BSD fan Stefano Marinelli has penned a information to utilizing NetBSD as a safe and steady platform for embedded system tasks — by making a read-only set up.
“One element that’s typically neglected when coping with embedded (or distant) units is a key level of vulnerability: the file system.,” Marinelli explains. “For non-COW [Copy-On-Write] file techniques (like ext4 on Linux, FFS, and many others.), there are conditions the place a crash or an influence outage might trigger corruption, requiring handbook intervention. For sure use instances, it is advisable to arrange a read-only root file system, which ensures higher reliability in case of system points. Consider eventualities like a router (important for community entry) or a caching reverse-proxy.”
For those who’re trying so as to add some safety and stability to an embedded NetBSD mission, a read-only filesystem might assist. (📷: Stefano Marinelli)
Many working techniques, Marinelli explains, already present a mechanism for read-only root file techniques, or alternate options equivalent to an overlay filesystem. NetBSD, nonetheless, doesn’t — but Marinelli recommends it for embedded use anyway, as “it helps practically all embedded units, is light-weight, and its stability minimizes the necessity for frequent updates.”
Marinelli’s answer for a scarcity of native help is to construct it himself — placing the 2 directories usually written to in every day operation, /tmp and /var, in-memory so writes by no means hit the underlying filesystem. If something will get corrupted, merely reboot and also you’re again to a working system once more.
There’s, in fact, a catch: for those who’re working a read-only system, it is read-only for every part — together with putting in essential safety updates. Whereas any assault on the system ought to final solely so long as it takes you to reset the system, it is essential to remain on high of updates — with Marinelli’s answer being as straightforward as commenting out the mount-in-memory instruction for /var, switching the filesystem again to read-write, rebooting, putting in the replace, regenerating the /var tarball, restoring the mount instruction, and rebooting once more.
The complete information is out there on Marinelli’s weblog.