readonly: do not check for "forensic" boot option