How 'honest' is fstat(1)?

[Mikhail Teterin]

Hello!

As a policy I try to keep my /, /usr, and other filesystems (except /var 
and /home) mounted readonly. (Not so much for security as for safety.)

When I need to make a modification, I remount them:

	mount -orw -u /

make the change, and remount back:

	mount -oro -u /usr/local

This works for "small" changes, but sometimes, however, after a bigger on 
(such as rebuilding of some ports), the last step fails with "busy".

At this time nothing should have a file open, and nothing does according to 
fstat. The command:

	 fstat | awk '$5 == "/usr/local" && $NF != "r"'

does not list anything. Yet, the fs (in this case -- /usr/local) will not 
remount readonly.

My only guess is, the earlier versions of the just reinstalled executables are 
still running and that trigger's the rarely noticed bug.

Any other guesses? Thanks!

	-mi