Move romount to mount-ro and use the umount -r option as it's more reliable for / --bind mounts, Gentoo #239922. Thanks to Duncan.

init.d/.gitignore

@@ -7,8 +7,8 @@ hostname
 killprocs
 local
 localmount
+mount-ro
 netmount
-romount
 root
 savecache
 swap

init.d/Makefile.Linux

@@ -1,7 +1,7 @@
 NET_LO=	net.lo
 
 SRCS+=	devfs.in dmesg.in hwclock.in consolefont.in keymaps.in killprocs.in \
-	modules.in mtab.in numlock.in procfs.in romount.in sysfs.in \
+	modules.in mount-ro.in mtab.in numlock.in procfs.in sysfs.in \
 	termencoding.in
 
 # This really belongs with sysvinit

init.d/mount-ro.in

@@ -37,7 +37,7 @@ start()
 		fs="${fs}${fs:+|}${x}"
 	done
 	[ -n "${fs}" ] && fs="^(${fs})$"
-	do_unmount "mount -n -o remount,ro" \
+	do_unmount "umount -r" \
 		--skip-point-regex "${m}" \
 		${fs:+--skip-fstype-regex} ${fs} --nonetdev
 	eoutdent

runlevels/Makefile.Linux

@@ -1,6 +1,6 @@
 SYSINIT+=	devfs dmesg
 BOOT+=		hwclock keymaps modules mtab net.lo procfs termencoding
-SHUTDOWN+=	killprocs romount
+SHUTDOWN+=	killprocs mount-ro
 
 # This really belongs with sysvinit
 SHUTDOWN+=	halt

sh/rc-mount.sh

@@ -28,11 +28,11 @@ do_unmount()
 		mountinfo --quiet "${mnt}" || continue
 
 		case "${cmd}" in
-			umount*)
+			umount)
 				ebegin "Unmounting ${mnt}"
 				;;
 			*)
-				ebegin "Remounting ${mnt}"
+				ebegin "Remounting ${mnt} read only"
 				;;
 		esac