cros_make_image_bootable, mount_gpt_image, common.sh: root filesystem changes: ext2, ro by default

bin/cros_make_image_bootable

 #!/bin/bash
 #
 # Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 #
 # Script which ensures that a given image has an up-to-date
 # kernel partition, rootfs integrity hashes, and legacy bootloader configs.
 
 # Load common constants.  This should be the first executable line.
@@ skipping 130 matching lines @@
   ${SCRIPTS_DIR}/mount_gpt_image.sh --from "$(dirname ${image})" \
     --image "$(basename ${image})" -r "${FLAGS_rootfs_mountpoint}" \
     -s "${FLAGS_statefulfs_mountpoint}"
 
   # The rootfs should never be mounted rw again after this point without
   # re-calling make_image_bootable.
   sudo mount -o remount,ro "${FLAGS_rootfs_mountpoint}"
   root_dev=$(mount | grep -- "on ${FLAGS_rootfs_mountpoint} type" |
              cut -f1 -d' ' | tail -1)
 
+  # Make the filesystem un-mountable as read-write.
+  # mount_gpt_image.sh will undo this as needed.
+  # TODO(wad) make sure there is parity in the signing scripts.
+  if [ ${FLAGS_enable_rootfs_verification} -eq ${FLAGS_TRUE} ]; then
+    # TODO(wad) this would be a good place to reset any other ext2 metadata.
+    warn "Disabling r/w mount of the root filesystem"
+    disable_rw_mount "$root_dev"
+  fi
+
   if [ ${FLAGS_use_dev_keys} -eq ${FLAGS_TRUE} ]; then
     use_dev_keys="--use_dev_keys"
   fi
 
   # Builds the kernel partition image.  The temporary files are kept around
   # so that we can perform a load_kernel_test later on the final image.
   ${SCRIPTS_DIR}/build_kernel_image.sh \
     --arch="${FLAGS_arch}" \
     --to="${FLAGS_output_dir}/vmlinuz.image" \
     --hd_vblock="${FLAGS_output_dir}/vmlinuz_hd.vblock" \
@@ skipping 95 matching lines @@
 mkdir -p ${FLAGS_statefulfs_mountpoint}
 mkdir -p ${FLAGS_espfs_mountpoint}
 
 make_image_bootable ${IMAGE}
 
 if [ ${FLAGS_cleanup_dirs} -eq ${FLAGS_TRUE} ]; then
   rmdir ${FLAGS_rootfs_mountpoint}
   rmdir ${FLAGS_statefulfs_mountpoint}
   rmdir ${FLAGS_espfs_mountpoint}
 fi