Linux Read Only Partition's data changes [closed]

Question

Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.

---

Want to improve this question? Update the question so it's on-topic for Stack Overflow.

Closed 5 years ago.

Improve this question

I have a read only partition who's data is changing. The change occurs on the first mount only. Subsequent mounts do not change the partition data.

Tried with ext3 and ext2 incase journalling was an issue ... no help. Tried tune2fs with -c -1 -i 0 in order to disable updating timestamps or any other data that maybe touched by a check being executed ... no help

Normally I wouldn't care, but I need to hashsum this partition for data integrity purposes.

Answer 1

Linux can do a write on read-only fs in some rare cases. E.g. when it detects a fs in inconsistent state (after cold reboot) and is able to do a quick, safe-for-data fix.

I had a kind of such fix when working with Ubuntu Rescue Remix and the write was on second harddrive, before even mounting anything on it (while booting). Information about this was in dmesg, so check the dmesg too.

E.g. here is an orphan cleanup possible on readonly fs, it will temporary DISABLE READONLY flag

1485        if (s_flags & MS_RDONLY) {
1486                ext3_msg(sb, KERN_INFO, "orphan cleanup on readonly fs");
1487                sb->s_flags &= ~MS_RDONLY;
1488        }
... writes...
1549        sb->s_flags = s_flags; /* Restore MS_RDONLY status */

This is done in *ext3_mount-> mount_bdev -> (callback) ext3_fill_super -> ext3_orphan_cleanup

If the block device is not read-protected itself, linux (ASKING YEAH!)

1463        if (bdev_read_only(sb->s_bdev)) {
1464                ext3_msg(sb, KERN_ERR, "error: write access "
1465                        "unavailable, skipping orphan cleanup.");
1466                return;
1467        }

WILL COMMIT A WRITE ON READONLY FS

Update: here is a list http://www.forensicswiki.org/wiki/Forensic_Linux_Live_CD_issues

Ext3 File system requires journal recovery To disable recovery: use "noload" flag, or use "ro,loop" flags, or use "ext2" file system type

Ext4 File system requires journal recovery To disable recovery: use "noload" flag, or use "ro,loop" flags, or use "ext2" file system type

ReiserFS File system has unfinished transactions "nolog" flag does not work (see man mount). To disable journal updates: use "ro,loop" flags

XFS Always (when unmounting) "norecovery" flag does not help (fixed in recent 2.6 kernels). To disable data writes: use "ro,loop" flags