summaryrefslogtreecommitdiff
path: root/recipes-core/initrdscripts
diff options
context:
space:
mode:
authorJohn Klug <john.klug@multitech.com>2020-11-11 18:48:27 -0600
committerJohn Klug <john.klug@multitech.com>2020-11-11 18:48:27 -0600
commitb00be59bbc49535097c450b6b8c5fc10c1efd6dd (patch)
tree25cf0e14f66c5fca1cfe41b31bf862d60a36cf12 /recipes-core/initrdscripts
parentdb088915be6dca3f09dedbcdaa7264d9271b1c74 (diff)
downloadmeta-mlinux-b00be59bbc49535097c450b6b8c5fc10c1efd6dd.tar.gz
meta-mlinux-b00be59bbc49535097c450b6b8c5fc10c1efd6dd.tar.bz2
meta-mlinux-b00be59bbc49535097c450b6b8c5fc10c1efd6dd.zip
Merge multiarch project to: added missing index file 2020 June 11GitosisMultiarch
Diffstat (limited to 'recipes-core/initrdscripts')
-rw-r--r--recipes-core/initrdscripts/COPYING.MIT17
-rw-r--r--recipes-core/initrdscripts/README.md162
-rwxr-xr-xrecipes-core/initrdscripts/files/init-readonly-rootfs-overlay-boot.sh356
-rw-r--r--recipes-core/initrdscripts/initramfs-readonly-rootfs-overlay_1.0.bb8
-rw-r--r--recipes-core/initrdscripts/initscripts-readonly-rootfs-overlay_1.0.bb1
-rw-r--r--recipes-core/initrdscripts/readonly-rootfs-overlay-init-script.inc36
6 files changed, 580 insertions, 0 deletions
diff --git a/recipes-core/initrdscripts/COPYING.MIT b/recipes-core/initrdscripts/COPYING.MIT
new file mode 100644
index 0000000..89de354
--- /dev/null
+++ b/recipes-core/initrdscripts/COPYING.MIT
@@ -0,0 +1,17 @@
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
diff --git a/recipes-core/initrdscripts/README.md b/recipes-core/initrdscripts/README.md
new file mode 100644
index 0000000..a038dfa
--- /dev/null
+++ b/recipes-core/initrdscripts/README.md
@@ -0,0 +1,162 @@
+# meta-readonly-rootfs-overlay
+
+This OpenEmbedded layer provides the necessary scripts and configurations to
+setup a writable root file system overlay on top of a read-only root file system.
+
+## Why does this exists?
+
+Having a read-only root file system is useful for many scenarios:
+
+- Separate user specific changes from system configuration, and being able to
+find differences
+- Allow factory reset, by deleting the user specific changes
+- Have a fallback image in case the user specific changes made the root file
+system no longer bootable.
+
+Because some data on the root file system changes on first boot or while the
+system is running, just mounting the complete root file system as read-only
+breaks many applications. There are different solutions to this problem:
+
+- Symlinking/Bind mounting files and directories that could potentially change
+while the system is running to a writable partition
+- Instead of having a read-only root files system, mounting a writable overlay
+root file system, that uses a read-only file system as its base and writes
+changed data to another writable partition.
+
+To implement the first solution, the developer needs to analyse which file
+needs to change and then create symlinks for them. When doing factory reset,
+the developer needs to overwrite every file that is linked with the factory
+configuration, to avoid dangling symlinks/binds. While this is more work on the
+developer side, it might increase the security, because only files that are
+symlinked/bind-mounted can be changed. However, IMO that is better left to file
+permissions.
+
+This meta-layer provides the second solution. Here no investigation of writable
+files are needed and factory reset can be done by just deleting all files or
+formatting the writable volume.
+
+# Dependencies
+
+This layer depends on:
+
+```
+ URI: git://git.openembedded.org/bitbake
+ branch: krogoth
+```
+
+```
+ URI: git://git.openembedded.org/openembedded-core
+ layers: meta
+ branch: krogoth
+```
+
+# Patches
+
+Please submit any patches against the readonly-rootfs-overlay layer via pull
+request.
+
+
+# Table of Contents
+
+1. [Adding the readonly-rootfs-overlay layer to your build](#adding-the-readonly-rootfs-overlay-layer-to-your-build)
+1. [Read-only root filesystem](#read-only-root-filesystem)
+1. [Kernel command line parameters](#kernel-command-line-parameters)
+
+
+## Adding the readonly-rootfs-overlay layer to your build
+
+In order to use this layer, you need to make the build system aware of
+it.
+
+Assuming the readonly-rootfs-overlay layer exists at the top-level of your
+OpenEmbedded source tree, you can add it to the build system by adding the
+location of the readonly-rootfs-overlay layer to bblayers.conf, along with any
+other layers needed. e.g.:
+
+```
+ BBLAYERS ?= " \
+ /path/to/layers/meta \
+ /path/to/layers/meta-poky \
+ /path/to/layers/meta-yocto-bsp \
+ /path/to/layers/meta-readonly-rootfs-overlay \
+ "
+```
+
+To add the script to your image, just add:
+
+```
+ IMAGE_INSTALL_append = " initscripts-readonly-rootfs-overlay"
+```
+
+to your `local.conf` or image recipe. Or use
+`core-image-rorootfs-overlay-initramfs` as initrd.
+
+## Read-only root filesystem
+
+If you use this layer you do *not* need to set `read-only-rootfs` in the
+`IMAGE_FEATURES` or `EXTRA_IMAGE_FEATURES` variable.
+
+## Kernel command line parameters
+
+These examples are not meant to be complete. They just contain parameters that
+are used by the initscript of this repository. Some additional paramters might
+be necessary.
+
+### Example using initrd:
+
+```
+root=/dev/sda1 rootrw=/dev/sda2
+```
+
+This cmd line start `/sbin/init` with the `/dev/sda1` partition as the read-only
+rootfs and the `/dev/sda2` partition as the read-write persistent state.
+
+```
+root=/dev/sda1 rootrw=/dev/sda2 init=/bin/sh
+```
+
+The same as before but it now starts `/bin/sh` instead of `/sbin/init`.
+
+### Example without initrd:
+
+```
+root=/dev/sda1 rootrw=/dev/sda2 init=/init
+```
+
+This cmd line starts `/sbin/init` with `/dev/sda1` partition as the read-only
+rootfs and the `/dev/sda2` partition as the read-write persistent state. When
+using this init script without an initrd, `init=/init` has to be set.
+
+```
+root=/dev/sda1 rootrw=/dev/sda2 init=/init rootinit=/bin/sh
+```
+
+The same as before but it now starts `/bin/sh` instead of `/sbin/init`
+
+### Details
+
+`root=` specifies the read-only root file system device. If this is not
+specified, the current rootfs is used.
+
+`rootfstype=` if support for the read-only file system is not build into the
+kernel, you can specify the required module name here. It will also be used in
+the mount command.
+
+`rootoptions=` specifies the mount options of the read-only file system.
+Defaults to `noatime,nodiratime`.
+
+`rootinit=` if the `init` parameter was used to specify this init script,
+`rootinit` can be used to overwrite the default (`/sbin/init`).
+
+`rootrw=` specifies the read-write file system device. If this is not
+specified, `tmpfs` is used.
+
+`rootrwfstype=` if support for the read-write file system is not build into the
+kernel, you can specify the required module name here. It will also be used in
+the mount command.
+
+`rootrwoptions=` specifies the mount options of the read-write file system.
+Defaults to `rw,noatime,mode=755`.
+
+`rootrwreset=` set to `yes` if you want to delete all the files in the
+read-write file system prior to building the overlay root files system.
diff --git a/recipes-core/initrdscripts/files/init-readonly-rootfs-overlay-boot.sh b/recipes-core/initrdscripts/files/init-readonly-rootfs-overlay-boot.sh
new file mode 100755
index 0000000..199fc17
--- /dev/null
+++ b/recipes-core/initrdscripts/files/init-readonly-rootfs-overlay-boot.sh
@@ -0,0 +1,356 @@
+#!/bin/bash
+# fsck output of the upper file system (rw) is
+# written to /dev/kmsg
+
+# Kernel arguments for this script:
+# This script allows one to specify the root read-only device with
+# kernel argument:
+# root=
+# What follows can be a PARTUUID, PARTLABEL, or some other mechanism
+# understood by findfs, including the plain device name.
+#
+# The rw file system overlayed on top of root defaults to:
+# rootrw='PARTLABEL=user_data'
+# This is the first GPT partition found with the name user_data.
+#
+# Another file system can be specified by PARTUUID, or the
+# plain device name, or anything understood by findfs.
+# For instance:
+# rootrw=/dev/mmcblk0p10
+# to use the SD card.
+#
+# fsck is not done to the root file system. It is assumed it cannot be
+# corrupted.
+# By default, fsck -p [rootrw device] is done.
+#
+# There are two kernel options governing fsck:
+#
+# fsck.repair=true|false|force
+# false skips fsck, force adds the -f option.
+# true is the default (fsck with no -f option)
+# fsck.mode=preen|yes|no
+# These represent -p, -y, and -n options.
+# Preen (-p) is the default
+#
+# Additional options exist to specify the init program
+# mount options, file system type. rootrwreset="yes"
+# will cause the read/write file system to be erased.
+#
+# shintramfs starts a shell. To continue boot from
+# shell:
+#
+# bash-4.4# export ROOT_MOUNT=/mnt
+# bash-4.4# export INIT=/sbin/init
+# bash-4.4# exec switch_root $ROOT_MOUNT $INIT
+#
+#
+# U-Boot environment example to add an init overlay parameter:
+#
+# => printenv args_mmc
+# args_mmc=run finduuid;setenv bootargs console=${console} ${optargs} root=PARTUUID=${uuid} rw rootfstype=${mmcrootfstype}
+#
+# => setenv args_mmc 'run finduuid;setenv bootargs console=${console} ${optargs} root=PARTUUID=${uuid} rw rootfstype=${mmcrootfstype} rootrwreset=yes'
+
+
+# Enable strict shell mode
+set -euo pipefail
+
+PATH=/sbin:/bin:/usr/sbin:/usr/bin
+
+MOUNT="/bin/mount"
+UMOUNT="/bin/umount"
+
+INIT="/sbin/init"
+ROOT_ROINIT="/sbin/init"
+
+ROOT_MOUNT="/mnt"
+ROOT_RODEVICE=""
+ROOT_RWDEVICE=""
+ROOT_ROMOUNT="/run/media/rfs/ro"
+ROOT_RWMOUNT="/run/media/rfs/rw"
+ROOT_RWRESET="no"
+
+ROOT_ROFSTYPE=""
+ROOT_ROMOUNTOPTIONS="bind"
+ROOT_ROMOUNTOPTIONS_DEVICE="noatime,nodiratime,discard,ro"
+
+ROOT_RWFSTYPE=""
+ROOT_RWMOUNTOPTIONS="rw,noatime,mode=755 tmpfs"
+ROOT_RWMOUNTOPTIONS_DEVICE="rw,noatime,nodiratime,discard"
+
+# Arithmetic assignments of 0 are false, and then
+# script uses set -e, so use let instead.
+DO_FSCK=1
+DO_STOP=0
+FSCKOPT="-p"
+
+
+finddevice() {
+ DEVICE="$1"
+ if dev=$(findfs "${DEVICE}") && ((${#dev})) ; then
+ # Replace the rootfs string with the findfs device result
+ log "Searched for ${DEVICE} and found $dev"
+ echo "$dev"
+ return 0
+ fi
+ log "Could not find $DEVICE"
+ return 1
+}
+
+early_setup() {
+ mkdir -p /proc
+ mkdir -p /sys
+ $MOUNT -t proc proc /proc
+ $MOUNT -t sysfs sysfs /sys
+ grep -w "/dev" /proc/mounts >/dev/null || $MOUNT -t devtmpfs none /dev
+}
+
+read_args() {
+ # Default is to do fsck with -p option on user_data partition.
+ [ -z "${CMDLINE+x}" ] && CMDLINE=`cat /proc/cmdline`
+ for arg in $CMDLINE; do
+ # Set optarg to option parameter, and '' if no parameter was
+ # given
+ optarg=`expr "x$arg" : 'x[^=]*=\(.*\)' || echo ''`
+ case $arg in
+ shinitramfs)
+ ((DO_STOP=1)) ;;
+ root=*)
+ ROOT_RODEVICE=$optarg
+ if rootdev=$(finddevice "${ROOT_RODEVICE}") ; then
+ # Replace the rootfs string with the findfs device result
+ ROOT_RODEVICE="${rootdev}"
+ log "Actual root device to be used: $ROOT_RODEVICE"
+ fi
+ ;;
+ rootfstype=*)
+ ROOT_ROFSTYPE="$optarg" ;;
+ rootinit=*)
+ ROOT_ROINIT=$optarg ;;
+ rootoptions=*)
+ ROOT_ROMOUNTOPTIONS_DEVICE="$optarg" ;;
+ rootrw=*)
+ ROOT_RWDEVICE=$optarg
+ if rootrwdev="$(finddevice ${ROOT_RWDEVICE})" ; then
+ # Replace the rootfs string with the findfs device result
+ ROOT_RWDEVICE="${rootrwdev}"
+ fi
+ ;;
+ rootrwfstype=*)
+ ROOT_RWFSTYPE="$optarg" ;;
+ rootrwreset=*)
+ ROOT_RWRESET=$optarg ;;
+ rootrwoptions=*)
+ ROOT_RWMOUNTOPTIONS_DEVICE="$optarg" ;;
+ init=*)
+ INIT=$optarg ;;
+ fsck.mode=*)
+ fsck_mode=$optarg
+ case $fsck_mode in
+ preen)
+ FSCKOPT="-p" ;;
+ yes)
+ FSCKOPT="-y" ;;
+ no)
+ FSCKOPT="-n" ;;
+ esac
+ ;;
+ fsck.repair=*)
+ fsck_repair=$optarg
+ case $fsck_repair in
+ force)
+ if ((${#FSCKOPT})) ; then
+ FSCKOPT+="f"
+ else
+ FSCKOPT="-f"
+ fi
+ DO_FSCK=1
+ ;;
+ yes)
+ DO_FSCK=1
+ ;;
+ no)
+ DO_FSCK=0
+ ;;
+ esac
+
+ ;;
+ esac
+ done
+}
+
+fatal() {
+ echo "rorootfs-overlay: $1" >$CONSOLE
+ echo >$CONSOLE
+ exec bash
+}
+
+log() {
+ echo "rorootfs-overlay: ${BASH_LINENO[*]}: ${*-""}" >$CONSOLE
+}
+
+early_setup
+
+[ -z "${CONSOLE+x}" ] && CONSOLE="/dev/kmsg"
+
+log "Kernel args are:"
+log "$(cat /proc/cmdline)"
+read_args
+
+
+mount_and_boot() {
+ mkdir -p $ROOT_MOUNT $ROOT_ROMOUNT $ROOT_RWMOUNT
+
+ # Build mount options for read only root file system.
+ # If no read-only device was specified via kernel command line, use
+ # current root file system via bind mount.
+ ROOT_ROMOUNTPARAMS_BIND="-o ${ROOT_ROMOUNTOPTIONS} /"
+ if [ -n "${ROOT_RODEVICE}" ]; then
+ ROOT_ROMOUNTPARAMS="-o ${ROOT_ROMOUNTOPTIONS_DEVICE} $ROOT_RODEVICE"
+ if [ -n "${ROOT_ROFSTYPE}" ]; then
+ ROOT_ROMOUNTPARAMS="-t $ROOT_ROFSTYPE $ROOT_ROMOUNTPARAMS"
+ fi
+ else
+ log "ROOT_RODEVICE: empty: ${ROOT_RODEVICE}"
+ ROOT_ROMOUNTPARAMS="$ROOT_ROMOUNTPARAMS_BIND"
+ fi
+
+ mountlog=$($MOUNT $ROOT_ROMOUNTPARAMS "$ROOT_ROMOUNT" 2>&1)
+ mountresult=$?
+ if ((mountresult != 0)) ; then
+ log "Failed root mount (result $mountresult): $mountlog"
+ else
+ log "Mounted root: $MOUNT $ROOT_ROMOUNTPARAMS "$ROOT_ROMOUNT": $mountlog"
+ log "Mounted ro root: $(grep "$ROOT_ROMOUNT" /proc/mounts)"
+ fi
+
+ # If future init is the same as current file, use $ROOT_ROINIT
+ # Tries to avoid loop to infinity if init is set to current file via
+ # kernel command line
+ if cmp -s "$0" "$INIT"; then
+ INIT="$ROOT_ROINIT"
+ fi
+
+ # find user_data
+ if [[ -z ${ROOT_RWDEVICE} ]] ; then
+ userdata=$(findfs PARTLABEL=user_data)
+ blkid_out=$(blkid $userdata)
+ if [[ -n $userdata ]] ; then
+ if [[ $blkid_out =~ TYPE=\"([^\"]+)\" ]]; then
+ log "Detected user_data partition with ${BASH_REMATCH[1]} file system"
+ else
+ log "Create new user_data partition ext4 file system"
+ mkfs.ext4 -O 64bit $userdata
+ fi
+ ROOT_RWDEVICE="$userdata"
+ fi # Found user_data GPT partition
+ fi # Empty ROOT_RWDEVICE
+
+ # Build mount options for read write root file system.
+ # If a read-write device was specified via kernel command line
+ # or partition table, use it, otherwise default to tmpfs.
+ if [ -n "${ROOT_RWDEVICE}" ]; then
+ ROOT_RWMOUNTPARAMS="-o $ROOT_RWMOUNTOPTIONS_DEVICE $ROOT_RWDEVICE"
+ if [ -n "${ROOT_RWFSTYPE}" ]; then
+ ROOT_RWMOUNTPARAMS="-t $ROOT_RWFSTYPE $ROOT_RWMOUNTPARAMS"
+ fi
+ else
+ ROOT_RWMOUNTPARAMS="-t tmpfs -o $ROOT_RWMOUNTOPTIONS"
+ fi
+
+ if ((DO_FSCK == 1)) ; then
+ if log_result=$(fsck $FSCKOPT $ROOT_RWDEVICE 2>&1) ; then
+ log "OK fsck user_data: fsck $FSCKOPT $ROOT_RWDEVICE:"
+ log "fsck user_data: $log_result"
+ else
+ log "ERR fsck user_data: fsck $FSCKOPT $ROOT_RWDEVICE:"
+ log "$log_result"
+ fi
+ fi
+
+ log "user_data: $MOUNT $ROOT_RWMOUNTPARAMS $ROOT_RWMOUNT"
+ # Mount read-write file system into initram root file system
+ if ! $MOUNT $ROOT_RWMOUNTPARAMS $ROOT_RWMOUNT ; then
+ fatal "Could not mount read-write rootfs"
+ fi
+
+ # Reset read-write file system if specified
+ log "ROOT_RWRESET=$ROOT_RWRESET ROOT_RWMOUNT=$ROOT_RWMOUNT"
+ if [ "yes" == "$ROOT_RWRESET" -a -n "${ROOT_RWMOUNT}" ]; then # JAK
+ log "Removing user_data files"
+ rm -rf $ROOT_RWMOUNT/*
+ log "Completed removal of user_data files"
+ fi
+
+ # Determine which unification file system to use
+ union_fs_type=""
+ if grep -w "overlay" /proc/filesystems >/dev/null; then
+ union_fs_type="overlay"
+ elif grep -w "aufs" /proc/filesystems >/dev/null; then
+ union_fs_type="aufs"
+ else
+ union_fs_type=""
+ fi
+
+ # Create/Mount overlay root file system
+ case $union_fs_type in
+ "overlay")
+ mkdir -p $ROOT_RWMOUNT/upperdir $ROOT_RWMOUNT/work
+ if ! $MOUNT -t overlay overlay \
+ -o "$(printf "%s%s%s" \
+ "lowerdir=$ROOT_ROMOUNT," \
+ "upperdir=$ROOT_RWMOUNT/upperdir," \
+ "workdir=$ROOT_RWMOUNT/work")" \
+ $ROOT_MOUNT ; then
+ log "$MOUNT -t overlay overlay \
+ -o \"$(printf \"%s%s%s\" \
+ \"lowerdir=$ROOT_ROMOUNT,\" \
+ \"upperdir=$ROOT_RWMOUNT/upperdir,\" \
+ \"workdir=$ROOT_RWMOUNT/work\")\" \
+ $ROOT_MOUNT"
+ fatal "Cound not mount overlay"
+ fi
+ ;;
+ "aufs")
+ $MOUNT -t aufs i\
+ -o "dirs=$ROOT_RWMOUNT=rw:$ROOT_ROMOUNT=ro" \
+ aufs $ROOT_MOUNT
+ ;;
+ "")
+ fatal "No overlay filesystem type available"
+ ;;
+ esac
+
+ # Move read-only and read-write root file system into the overlay
+ # file system
+ mkdir -p $ROOT_MOUNT/$ROOT_ROMOUNT $ROOT_MOUNT/$ROOT_RWMOUNT
+
+ $MOUNT -n --move $ROOT_ROMOUNT ${ROOT_MOUNT}/$ROOT_ROMOUNT
+ $MOUNT -n --move $ROOT_RWMOUNT ${ROOT_MOUNT}/$ROOT_RWMOUNT
+
+
+ # Create persistent storage directory and bind-mount it as /var/persistent.
+ # The directory name starts with "." so "rm -rf" will skip it on read-write file system reset.
+ mkdir -p ${ROOT_MOUNT}/$ROOT_RWMOUNT/.persistent
+ mkdir -p ${ROOT_MOUNT}/var/persistent
+ $MOUNT -n --bind ${ROOT_MOUNT}/$ROOT_RWMOUNT/.persistent ${ROOT_MOUNT}/var/persistent
+
+ if ((DO_STOP)) ; then
+ fatal "Initramfs Shell mode selected -- bash shell"
+ fi
+
+ $MOUNT -n --move /proc ${ROOT_MOUNT}/proc
+ $MOUNT -n --move /sys ${ROOT_MOUNT}/sys
+ $MOUNT -n --move /dev ${ROOT_MOUNT}/dev
+
+ CONSOLE="${ROOT_MOUNT}/dev/kmsg"
+ log "Mounted filesystems:"
+ log "$(cat ${ROOT_MOUNT}/proc/mounts)"
+ cd $ROOT_MOUNT
+
+ # switch to actual init in the overlay root file system
+ exec switch_root $ROOT_MOUNT $INIT ||
+ fatal "Couldn't chroot, dropping to shell"
+}
+
+mount_and_boot
diff --git a/recipes-core/initrdscripts/initramfs-readonly-rootfs-overlay_1.0.bb b/recipes-core/initrdscripts/initramfs-readonly-rootfs-overlay_1.0.bb
new file mode 100644
index 0000000..164d394
--- /dev/null
+++ b/recipes-core/initrdscripts/initramfs-readonly-rootfs-overlay_1.0.bb
@@ -0,0 +1,8 @@
+require readonly-rootfs-overlay-init-script.inc
+
+do_install_append() {
+ install -d ${D}/dev
+ mknod -m 622 ${D}/dev/console c 5 1
+}
+
+FILES_${PN} += "/dev"
diff --git a/recipes-core/initrdscripts/initscripts-readonly-rootfs-overlay_1.0.bb b/recipes-core/initrdscripts/initscripts-readonly-rootfs-overlay_1.0.bb
new file mode 100644
index 0000000..9428356
--- /dev/null
+++ b/recipes-core/initrdscripts/initscripts-readonly-rootfs-overlay_1.0.bb
@@ -0,0 +1 @@
+require readonly-rootfs-overlay-init-script.inc
diff --git a/recipes-core/initrdscripts/readonly-rootfs-overlay-init-script.inc b/recipes-core/initrdscripts/readonly-rootfs-overlay-init-script.inc
new file mode 100644
index 0000000..d1b8104
--- /dev/null
+++ b/recipes-core/initrdscripts/readonly-rootfs-overlay-init-script.inc
@@ -0,0 +1,36 @@
+SUMMARY = "Read only rootfs with overlay init script"
+LICENSE = "MIT"
+LIC_FILES_CHKSUM = "file://${COREBASE}/meta/COPYING.MIT;md5=3da9cfbcb788c80a0384361b4de20420"
+DEPENDS = "virtual/kernel"
+
+# This was derived from https://github.com/cmhe/meta-readonly-rootfs-overlay
+
+# script uses bash, findfs, busybox is problematic, so use real fsck,
+# and add ext4 utilities in case some one needs to try to recover the
+# user_data file system
+RDEPENDS_${PN} = " \
+ bash \
+ util-linux-findfs \
+ util-linux-fsck \
+ e2fsprogs \
+ e2fsprogs-mke2fs \
+ e2fsprogs-badblocks \
+ e2fsprogs-e2fsck \
+ e2fsprogs-tune2fs \
+ e2fsprogs-resize2fs \
+ "
+
+SRC_URI = "file://init-readonly-rootfs-overlay-boot.sh"
+
+S = "${WORKDIR}"
+
+do_install() {
+ install -m 0755 ${WORKDIR}/init-readonly-rootfs-overlay-boot.sh ${D}/init
+ install -d "${D}/run/media/rfs/ro"
+ install -d "${D}/run/media/rfs/rw"
+}
+
+FILES_${PN} += " /init /run"
+
+# Due to kernel dependency
+PACKAGE_ARCH = "${MACHINE_ARCH}"