How to Remove Write Command In LibreELEC (Thread Closed)

**chewitt** · February 25, 2018 at 11:57 AM Official Post

It is possible to create a udev rule that runs "mount -o remount,ro /path/to/mount-point" but this will prevent data from being written. It will not stop something in the OS from reading the drive. NB: There is nothing in LE that copies add-ons automatically from an SD card or USB drive. Your description makes no sense.

Schreibwaise · February 25, 2018 at 7:55 PM

Quote from tiku

NB. I want to give my MXQ Box to somebody for demonstration, in order to prevent anyone from copying my addons from my box i want to do this thing.

But this someone could copy your addons via network to some samba or nfs share!?

Schreibwaise · February 26, 2018 at 7:25 AM

I'm not sure what you want to achieve is possible with libreELEC. Solutions I'm aware of require running the tool "blockdev" which is not available in libreELEC. Maybe you could use some kernel parameter to disable usb block devices entirely...

**chewitt** · February 26, 2018 at 10:25 PM Official Post

You can block writing *to* the USB drive (using the command I posted before) but once the USB device has been mounted you cannot block reading or copying *from* the USB drive. LE has a single user, root, who can access anything.

Schreibwaise · February 27, 2018 at 7:24 AM

Type "df" to find out where your USB stick is mounted. You should see something like:

/dev/sda1 524008 136328 387680 26% /var/media/LIBREELEC

Instead of "LIBREELEC" you will see the label of your stick.

Then remount the drive readonly by giving this command:

mount -o remount,ro /var/media/LIBREELEC

Yes, there is a comma between "remount" and "ro". "ro" means "read-only" and is the parameter for the remount option.

But beware that this solution is not persistent! If you unplug the USB stick and put it back in, it will be mounted writable again and your write protection is gone.

Schreibwaise · February 27, 2018 at 7:44 AM

Now type

mount -o remount,ro /var/media/sda1-usb-Sony_Storage_Med

If you do not want to type the whole cryptic name, just do

mount -o remount,ro /var/media/sda1[TAB]

where [TAB] is the tab key on your keyboard and the shell will expand the name for you.

Schreibwaise · February 27, 2018 at 7:55 AM

Looks fine. Test it:

cd /var/media/sda1[TAB]

touch foobar

you should get an error message "readonly filesystem".

But as said before: If you unplug the stick and put it back in, it will be writable again.

Schreibwaise · February 27, 2018 at 8:19 AM

A "permanent solution" would require some system changes and/or additional tools that would only be useful for this specific/bizarre use case. If somebody has physical access to a device he can do a lot of things. Trying to secure it by exploiting the linux inexperience is not really a solution.

**chewitt** · February 28, 2018 at 4:37 AM Official Post

auto-mounting is done using udev and user created udev rules can be placed in /storage/.config/udev.rules.d/ to make them persistent if not truly permanent (which would require creating your own image). udev rules are applied in alphanumeric sequence so a rule numbered +1 higher than our default auto-mount rule can be used to remount the mounted USB with 'ro' set.

this will still not prevent anyone from READING the data from the USB which is what the OP has stated (twice) as the problem.

Schreibwaise · March 1, 2018 at 10:14 AM

Quote from chewitt

this will still not prevent anyone from READING the data from the USB which is what the OP has stated (twice) as the problem.

You seem to assume that the OP is running LibreELEC off the external USB stick. I understood that he is running it from internal storage and wants to prevent copying data *TO* the external USB drive only.

**vpeter** · March 1, 2018 at 3:32 PM

This remounts USB in read-only mode.

Create two files

/storage/.config/udev.rules.d/96-enforce-usb-ro.rules

/storage/.config/system.d/enforce-usb-ro\@.service

and reload rules and services or just reboot.

Code

cat >/storage/.config/udev.rules.d/96-enforce-usb-ro.rules <<EOL
SUBSYSTEMS=="usb",ACTION=="add",KERNEL=="sd*",ENV{SYSTEMD_WANTS}="enforce-usb-ro@%k"
EOL

cat >/storage/.config/system.d/enforce-usb-ro\@.service <<EOL
[Unit]
Description=Enforce read-only mode on USB storage device
BindsTo=dev-%i.device

[Service]
Type=simple
ExecStart=/usr/bin/mount -o remount,ro /dev/%I
EOL

udevadm control --reload
systemctl daemon-reload

Display More

**vpeter** · March 1, 2018 at 5:30 PM

Just select all the code I wrote above and paste it in ssh terminal. It will create both files and reload service. After that usb disk should be mounted readonly.

But in case you like to make file by hand here is the content

/storage/.config/udev.rules.d/96-enforce-usb-ro.rules

Code

SUBSYSTEMS=="usb",ACTION=="add",KERNEL=="sd*",ENV{SYSTEMD_WANTS}="enforce-usb-ro@%k"

/storage/.config/system.d/enforce-usb-ro\@.service

Code

[Unit]
Description=Enforce read-only mode on USB storage device
BindsTo=dev-%i.device

[Service]
Type=simple
ExecStart=/usr/bin/mount -o remount,ro /dev/%I

One other option to make device read only is to use hdparm

Quote

-r Get/set read-only flag for the device. When set, Linux disallows write operations on the device

Code

/usr/sbin/hdparm -r1 /dev/%I

tiku · March 1, 2018 at 5:37 PM

i think selecting code and pasting in ssh terminal is more easy than creating with hand.i will be using putty, just copy and paste, will do the needful i hope.

**vpeter** · March 1, 2018 at 5:57 PM

You can see content of file with

Code

cat /storage/.config/udev.rules.d/96-enforce-usb-ro.rules

Code

cat /storage/.config/system.d/enforce-usb-ro\@.service

And I think files are created. Just attach one USB disk and see with mount command if is mounted ro.

**vpeter** · March 1, 2018 at 6:02 PM

Quote from tiku

it will be overwritten when there is a new release of Libreelec

No, those two files will stay after update. Only after complete reinstall you need to create them.

tiku · March 1, 2018 at 7:08 PM

Mission Accomplished.

tiku · March 2, 2018 at 6:37 AM

THREAD CLOSED