If mode= is not set in rootflags= add mode=0755 when a tmpfs is used on the rootfs, otherwise it will be group/world writable as that's the default mode for tmpfs filesystems. Follow-up for 725ad3b062
725ad3b062