cros_make_image_bootable, mount_gpt_image, common.sh: root filesystem changes: ext2, ro by default

bin/cros_make_image_bootable

Index: bin/cros_make_image_bootable
diff --git a/bin/cros_make_image_bootable b/bin/cros_make_image_bootable
index 7179b89a6b2c6614e6cbf1d7fb56022011d88e4b..3517c85ec8cdbd38143b2784d3652815fd1977e2 100755
--- a/bin/cros_make_image_bootable
+++ b/bin/cros_make_image_bootable
@@ -148,6 +148,15 @@ make_image_bootable() {
   root_dev=$(mount | grep -- "on ${FLAGS_rootfs_mountpoint} type" |
              cut -f1 -d' ' | tail -1)
 
+  # Make the filesystem un-mountable as read-write.
+  # mount_gpt_image.sh will undo this as needed.
+  # TODO(wad) make sure there is parity in the signing scripts.
+  if [ ${FLAGS_enable_rootfs_verification} -eq ${FLAGS_TRUE} ]; then
+    # TODO(wad) this would be a good place to reset any other ext2 metadata.
+    warn "Disabling r/w mount of the root filesystem"
+    disable_rw_mount "$root_dev"
+  fi
+
   if [ ${FLAGS_use_dev_keys} -eq ${FLAGS_TRUE} ]; then
     use_dev_keys="--use_dev_keys"
   fi