On Chrome OS and Android, dm-verity is used to verify the system partition. In Chrome OS, since there is no initial RAM disk, the mapping and the root digest are provided on the kernel command line with the
dm parameter. On Android, I don't know if the dm-verity information is included in the boot parameters (I suspect not), but I know that a public key stored in the initial RAM disk is used to verify the root digest of the system partition.
I can see how you might not be able to modify the mapping in Chrome OS while the system is running since it is passed a kernel parameter which may very well make it immutable. Since, as I figure, the mapping in Android is setup in user space, I'd think that I'd also be able to change it, thereby bypassing the security dm-verity provides. So what prevents this from happening in either case?