How to make the filesystem immutable?

I have an industrial computer (read: no keyboard/mouse/monitor except during maintenance) which will control some machinery. The software doesn’t need to store anything between successive launches.

I want the end user to be able to just power off the computer at any time he wants, without sending a shutdown -h now command or the like, and then waiting for the computer to shut down. To achieve that, I want to use union mount, probably aufs, so that the SSD with root filesystem is accessed only for reading and is NEVER, EVER written to.

The Live USB stick article on OpenSuSE wiki says to just dd the *.iso with the OS on the flash drive. I guess that will work with SSD, too. But I don’t want the SSD to have the ISO 9660 filesystem. Can I just install OpenSuSE properly on say ext2/3/4 or XFS or whatever and then lock the SSD from writing, redirecting all write requests to a RAM disc through aufs?

Debian has a package called fsprotect which allows to achieve that by just adding an “fsprotect” parameter to the kernel for the root filesystem. I can’t believe that OpenSuSE doesn’t have something alike.

You’ll want to use OverlayFS; https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/Documentation/filesystems/overlayfs.txt

This’ll allow you to read the startup files from the SSD, keep it read only and write changes to temporary space for example tmpfs that’ll vanish into thin air upon reboot / shutdown.

Thanks a bunch for a such fast reply, but whoa, this thing looks bleeding-edge. Even the man you linked to calls it “a prototype for a new approach”. Also, Wiki says it was implemented in 3.18, and I still have 3.16.7-7 on my Harlequin. I kinda feel uncertain about using a brand new technology in a serious system. (Also, wouldn’t installing a 3.18 kernel on 13.2 cause problems?)

The 13.2 live images (KDE-live, Gnome-live and live Rescue) are all using overlayfs. So I’m inclined think that:

  • this is reasonably well tested for opensuse;
  • it is supported in opensuse provided kernels (no need for a 3.18 kernel).

I agree with Miuku, that it makes more sense than using a union mount.