keep the root filesystem mounted ro in case switchroot breaks