Simon Hobson <linux@???> writes:
> Rainer Weikusat <rainerweikusat@???> wrote:
>
>>> Or the third option - mount r/o and remount r/w when needed.
>>
>> As I wrote in the original text, that's a extremely bad idea because
>> this means it may suddenly be affected by an already running command
>> never supposed to work with it.
>
> The window for that must be "very small". Yes I know about TOCTOU
> issues, but unless a command has a long execution time, then it's got
> to run during "just" the small window between the fs being made r/w
> and it being made r/o again - typically a few seconds.

rm -rf / will have a long execution time. But that's besides the point:
The guy who killed his laptop could have avoided that. With an "remount
whenever systemd feels like that" mechanism, nobody can anymore.

> Requiring user intervention (ie making it writeable) has just the same
> problem - except that the window is very much longer.

It doesn't. In this case, someone administrating the machine has been
informed (at least) about the fact that such-and-such a filesystem will
become writeable until and that someone can coordinate his activities
with those of other people, including his own.

> Just mounting r/w leaves us with the problem as already described.

I see no problem with this except the cultural problem that "GUI people"
are accustomed to being able to press random buttons in random sequences
while always being stopped by a child-proof lock before anyhing actually
happens[*]. And nothing which hasn't been computerized works in this way:
If I turn my stove on, the burners get hot despite this is a seriously
dangerous device when used incorrectly.

[*] Coincidentally, the same people usually prefer household appliances
    to be operated by less fumble-happy "expert technicians".