Is making /var/log directory read only on debian linux safe?

Instead of making it read only, I would create /var/log as tempfs. and regularily prune. Of course that only works if you have enough spare RAM available.

You can do the same for other possible non-essential directories like /var/tmp

Entries in my /etc/fstab (now commented out):

tmpfs   /var/tmp   tmpfs   defaults,noatime,mode=1777,size=128M   0  0
tmpfs   /var/log   tmpfs   defaults,noatime,mode=0755,size=128M   0  0

If you are planning on making it read-only, then it is as good as worthless. You should control how and what you log.

If you are running short on space, you might want to have a separate reasonably-sized /var partition and choose a file system that can handle lots of small files, such as ReiserFS or something.

According to the Debian FHS (Filesystem Hierarchy Standard), /var/log must be writable. Upon boot up, the system itself must be able to write to a log in that directory. You can make /usr read-only, but /var should be mounted writeable.

To answer the question asked in your write-up, yes the system will hang on start up. The kernel will attempt to write to dmesg, and will hang when it cannot.

As stated in my comment, a writable /var/log is kind of important but there are things you can do to ensure that as little gets saved as possible. For example, you can configure logrotate to rotate the log files based on their size, compressing the old ones. You can also configure syslog to only write CRIT and above to the logs (the rest are discarded)

logrotate example:

   compress

   /var/log/messages {
       rotate 5
       size 100k
       postrotate
           /usr/bin/killall -HUP syslogd
       endscript
   }

(You would need to configure logrotate /etc/logrotate.conf to be ran in a cronjob as well).

rsyslog.conf example:

$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imklog   # provides kernel logging support (previously done by rklogd)

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

$IncludeConfig /etc/rsyslog.d/*.conf

*.crit                                                  /var/log/messages
*.emerg                                                 *

This is probably the best middle ground as next to nothing gets logged but you're still notified of critical events. You may also think about configuring remote syslog to a server with bigger storage if log retention is important.