Ubuntu – Will mounting the disk as “ro” make it completely read-only

hard drivemountntfsread-onlyubuntu-10.04

I've got a dualboot installation with Ubuntu 10.04 and Windows 7 Ultimate. I've got 2 drives with the following partitions set up:

500 GB drive
2 partitions:
    C:/   320GB NTFS (Has Win 7 on it)
    D:/   180GB NTFS


160 GB drive
1 main partition:
    1     160GB EXT4 (Has Ubuntu 10.04 in it)

In Ubuntu, I'm auto mounting the entire 500GB drive, using an /etc/fstab line. I've configured that line as the following:

UUID=XXXXXXXXXXXXXXXX /media/WinEmily         auto    ro,auto,user,exec 0 0

Where the UUID is the one of the 500GB drive and /media/WinEmily is my existing mount point.

Now my question is, is there any way for Ubuntu to still write to either of the partitions of the 500GB drive. I'm trying to prevent that so that it will have read access only, no matter what it tries. (Except of course unmounting and remounting with read/write access.)

Update
I'm talking about normal file operations, editing and erasing files from the file system. Not destroying the entire file system using brute force.

So is there like a command like this, that would allow writing even though it's mounted as read-only.

supersuperuserdo rm --doitanyway /media/WinEmily/file.txt

Best Answer

If you mount a filesystem read-only, there is no way to modify it through filesystem operations. Not even if you're root. If you want to perform any modification (write to a file, remove a file, change permissions, update the access time, etc.), you have to remount the file system read-write (mount -o remount,rw /dev/foo).

You can still access the underlying device and write to it. (It's a very bad idea, of course.) Disks and partitions are only accessible by root unless you've explicitly changed this (usually a bad idea too).

One thing that doesn't come up very often is that the action of mounting itself might write to the disk. This can happen even with read-only mounts for journaled filesystems: if the filesystem was not cleanly unmounted, the action of mounting the filesystem may replay the journal and perform the queued actions (it does for ext3; I don't know about ntfs). This means you can't easily inspect the disk of a suspended machine (e.g. the disk image of a paused virtual machine viewed on the host, or a hibernating system from a rescue CD).

Related Question