Comment # 13 on bug 1156421 from Franck Bui

Thanks.

As the logs are broken due to the unreliable clock on your system (the debug
logs with printk.devkmsg=on showed that the system switched to rootfs twice !),
I'm not 100% sure but I can't see any hints on systemd unmounting or remounting
/var RO after leaving initrd.

According to our private chat /var is mounted RW just before switching to
rootfs. So either something in userspace unmount it or remount it RO.

Can you replace /usr/bin/mount and /usr/bin/umount with wrappers that log any
attempts to mount/remount/umount /var before doing the actual work in order to
make sure that the issue leaves in userspace ?