How to create a read-only shadow for existing RAM disk on macOS?

Question

Read-only RAM disk can be created with method described in this post, so how to create a read-only shadow mount point for existing RAM disk while keeping the original mount point unchanged with command line on macOS Catalina?

Answer 1

Start by finding the device node for your RAM disk by running the following in the Terminal:

diskutil list

You'll find that the ram disk is probably listed as something like disk3, disk4 or similar.

Then mount the RAM disk as read-only:

mkdir ~/MyReadOnlyMountPoint
mount -o ro /dev/disk3 ~/MyReadOnlyMountPoint

I assume that you have formatted the whole RAM-disk with your file system. If you have created instead an APFS container with an APFS volume inside, you'll want to use the volume device node instead (suck as disk3s1 or similar).

Note that you'll only want to mount the RAM-disk once at a time. macOS does not natively support the bind mounting feature of Linux that you mention in your question.

If you need to have the RAM-disk mounted twice (i.e. you cannot use symlinks, file permissions or other means to achieve what you need) - you could look into non-native options such as bindfs or osxfs to be able to mount the RAM-disk into two places at the same time. Performance will be different though.

For example with bindfs, you can easily provide an extra read-only mount point for you RAM-disk like this:

bindfs --perms=a-w MyMountPoint MyReadOnlyMountPoint.

Answer 2

Theoretical answer! - I will update this answer if I find an appropriate tool...or some hidden option in diskutil or apfs.util.

In theory it's very easy to create such a read-only shadow: use the snapshot feature of APFS and mount the snapshot read-only:

1. Create an APFS RAMDisk:

   diskutil partitionDisk $(hdiutil attach -nomount ram://1048576) 1 GPTFormat APFS 'RAMDisk' '100%'
   

2. Create an APFS snapshot of the current state of the RAMDisk
3. Get the name of this APFS snapshot
4. Mount this APFS snapshot read-only

However, the tools to create such a snapshot are missing; or better: only some tools like tmutil or ccc (and probably some forensic apps) can create APFS snapshots.