diff --git a/common/utils.cc b/common/utils.cc
index 304aba2..5d15da0 100644
--- a/common/utils.cc
+++ b/common/utils.cc
@@ -641,6 +641,30 @@
   return true;
 }
 
+bool SetBlockDeviceReadOnly(const string& device, bool read_only) {
+  int fd = HANDLE_EINTR(open(device.c_str(), O_RDONLY | O_CLOEXEC));
+  if (fd < 0) {
+    PLOG(ERROR) << "Opening block device " << device;
+    return false;
+  }
+  ScopedFdCloser fd_closer(&fd);
+  // We take no action if not needed.
+  int read_only_flag;
+  int expected_flag = read_only ? 1 : 0;
+  int rc = ioctl(fd, BLKROGET, &read_only_flag);
+  // In case of failure reading the setting we will try to set it anyway.
+  if (rc == 0 && read_only_flag == expected_flag)
+    return true;
+
+  rc = ioctl(fd, BLKROSET, &expected_flag);
+  if (rc != 0) {
+    PLOG(ERROR) << "Marking block device " << device << " as read_only="
+                << expected_flag;
+    return false;
+  }
+  return true;
+}
+
 bool MountFilesystem(const string& device,
                      const string& mountpoint,
                      unsigned long mountflags,  // NOLINT(runtime/int)
diff --git a/common/utils.h b/common/utils.h
index 686f117..88c33b7 100644
--- a/common/utils.h
+++ b/common/utils.h
@@ -178,6 +178,10 @@
 // /dev/sda3. Return empty string on error.
 std::string MakePartitionNameForMount(const std::string& part_name);
 
+// Set the read-only attribute on the block device |device| to the value passed
+// in |read_only|. Return whether the operation succeeded.
+bool SetBlockDeviceReadOnly(const std::string& device, bool read_only);
+
 // Synchronously mount or unmount a filesystem. Return true on success.
 // When mounting, it will attempt to mount the device as the passed filesystem
 // type |type|, with the passed |flags| options. If |type| is empty, "ext2",