Re: Debian on Read Only root fs: what files are opened rw?

[William Ballard <nospam_50307@alltel.net>]

On Mon, Mar 07, 2005 at 03:39:34PM +0000, Chris Boot wrote:
> How can I find out what files are opened read/write? Obviously I'll keep 

I asked this question in Dec. when messing with BootCD.
Here is the answer I got to find out what files are modified at boot:
http://lists.debian.org/debian-user/2004/12/msg02848.html
(You may want to read the whole thead.)

Based on that technique I discovered the following files were modified 
in /etc during boot:

/etc/adduser.conf /etc/aliases /etc/alternatives /etc/apt /etc/at.deny
/etc/bash.bashrc /etc/bash_completion /etc/bash_completion.d
/etc/bootcd /etc/calendar /etc/cdrecord /etc/console /etc/console-tools
/etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.monthly
/etc/cron.weekly /etc/crontab /etc/debconf.conf /etc/debian_version
/etc/default /etc/deluser.conf /etc/dhclient-script /etc/dhclient.conf
/etc/dpkg /etc/email-addresses /etc/environment /etc/exim4
/etc/fdmount.conf /etc/groff /etc/host.conf /etc/hosts /etc/hosts.allow
/etc/hosts.deny /etc/inetd.conf /etc/init.d /etc/inittab /etc/inputrc
/etc/issue /etc/issue.net /etc/kernel-img.conf /etc/ld.so.cache
/etc/locale.alias /etc/locale.gen /etc/localtime /etc/login.defs
/etc/logrotate.conf /etc/logrotate.d /etc/magic /etc/mail.rc
/etc/manpath.config /etc/mediaprm /etc/modules /etc/modules.conf
/etc/modutils /etc/nanorc /etc/nsswitch.conf /etc/opt /etc/pam.conf
/etc/pam.d /etc/ppp /etc/profile /etc/protocols /etc/rc0.d /etc/rc1.d
/etc/rc2.d /etc/rc3.d /etc/rc4.d /etc/rc5.d /etc/rc6.d /etc/rmt
/etc/rpc /etc/securetty /etc/security /etc/services /etc/shells
/etc/skel /etc/sysctl.conf /etc/syslog.conf /etc/terminfo
/etc/updatedb.conf /etc/wgetrc /etc/rcS.d/README

Obviously as you stated /var and /tmp need to be rw.  I was only 
interested in what under /etc was modified.