Comment # 14 on bug 1156421 from Fabian Vogt

(In reply to Franck Bui from comment #13)
> Thanks.
> 
> As the logs are broken due to the unreliable clock on your system (the debug
> logs with printk.devkmsg=on showed that the system switched to rootfs twice
> !), I'm not 100% sure but I can't see any hints on systemd unmounting or
> remounting /var RO after leaving initrd.
> 
> According to our private chat /var is mounted RW just before switching to
> rootfs. So either something in userspace unmount it or remount it RO.
> 
> Can you replace /usr/bin/mount and /usr/bin/umount with wrappers that log
> any attempts to mount/remount/umount /var before doing the actual work in
> order to make sure that the issue leaves in userspace ?

I tried that (but with /run, as /var is not writable all the time...) and
didn't get any call for /var or /etc in there. I added "findmnt" to
systemd-journal-flush.service now, let's see what happens.