From c7f2ffe7cb170e0ae1180f2a10442b0718d622a2 Mon Sep 17 00:00:00 2001
From: Paul Whalen <pwhalen@fedoraproject.org>
Date: Mar 17 2025 17:19:32 +0000
Subject: Default root config to mount sysroot as read only


See: https://github.com/fedora-iot/iot-distro/issues/81
     https://gitlab.com/fedora/bootc/base-images/-/blob/main/tier-0/ostree.yaml

Signed-off-by: Paul Whalen <pwhalen@fedoraproject.org>

---

diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml
index 1c13f3f..08e92cf 100644
--- a/fedora-iot-base.yaml
+++ b/fedora-iot-base.yaml
@@ -2,6 +2,8 @@ include:
   - bootupd.yaml
   # Enable composefs
   - composefs.yaml
+  # Read only sysroot
+  - sysroot-ro.yaml
 ref: fedora/rawhide/${basearch}/iot
 repos: []
 selinux: true
diff --git a/sysroot-ro.yaml b/sysroot-ro.yaml
new file mode 100644
index 0000000..8214f05
--- /dev/null
+++ b/sysroot-ro.yaml
@@ -0,0 +1,15 @@
+# Set up default root config to mount sysroot as read only
+# https://fedoraproject.org/wiki/Changes/Silverblue_Kinoite_readonly_sysroot
+# See: https://gitlab.com/fedora/bootc/base-images/-/blob/main/tier-0/ostree.yaml
+# See: https://github.com/fedora-iot/iot-distro/issues/81
+
+postprocess:
+  - |
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+
+    install -dm 0755 -o 0 -g 0 /usr/lib/ostree
+    cat >> /usr/lib/ostree/prepare-root.conf << 'EOF'
+    [sysroot]
+    readonly = true
+    EOF