system-reinstall: Propagate boot mount in container

systemd gpt-auto-generator has automount for /boot which we need to
propagate inside the container for the service to mount the ESP at
/boot on access

Also, before remounting `/boot` as rw, check if it's readonly so we
don't fail the re-mount operation

Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

Author: Johan-Liebert1

crates/lib/src/bootloader.rs

@@ -10,6 +10,7 @@ use cap_std_ext::dirext::CapStdExtDirExt;
 use fn_error_context::context;
 
 use bootc_mount as mount;
+use rustix::fs::statfs;
 
 use crate::bootc_composefs::boot::{MountedImageRoot, SecurebootKeys};
 use crate::utils;
@@ -46,6 +47,18 @@ const BOOTCTL_RANDOM_SEED_MIN_VERSION: u32 = 257;
 /// in place (bootupd will overwrite them during installation).
 // TODO: clean all ESPs on multi-device setups
 pub(crate) fn mount_esp_part(root: &Dir, root_path: &Utf8Path, is_ostree: bool) -> Result<()> {
+    // systemd-gpt-auto-generator automounts ESP at /boot
+    let is_boot_mountpoint = root.is_mountpoint("boot")?;
+
+    if matches!(is_boot_mountpoint, Some(true)) {
+        let statfs = statfs(root_path.join("boot").as_std_path())?;
+
+        // We probably don't need to be this thorough, but no harm done
+        if statfs.f_type == libc::MSDOS_SUPER_MAGIC {
+            return Ok(());
+        }
+    }
+
     let efi_path = Utf8Path::new("boot").join(crate::bootloader::EFI_DIR);
     let Some(esp_fd) = root
         .open_dir_optional(&efi_path)

crates/lib/src/install.rs

@@ -2297,12 +2297,14 @@ fn remove_all_in_dir_no_xdev(d: &Dir, mount_err: bool) -> Result<()> {
         if etype == FileType::dir() {
             if let Some(subdir) = d.open_dir_noxdev(&name)? {
                 remove_all_in_dir_no_xdev(&subdir, mount_err)?;
-                d.remove_dir(&name)?;
+                d.remove_dir(&name)
+                    .with_context(|| format!("Removing dir {name:?}"))?;
             } else if mount_err {
                 anyhow::bail!("Found unexpected mount point {name:?}");
             }
         } else {
-            d.remove_file_optional(&name)?;
+            d.remove_file_optional(&name)
+                .with_context(|| format!("Removing {name:?}"))?;
         }
     }
     anyhow::Ok(())

crates/lib/src/utils.rs

@@ -1,6 +1,6 @@
 use std::future::Future;
 use std::io::Write;
-use std::os::fd::BorrowedFd;
+use std::os::fd::{AsFd, BorrowedFd};
 use std::path::{Component, Path, PathBuf};
 use std::process::Command;
 use std::time::Duration;
@@ -17,6 +17,7 @@ use libsystemd::logging::journal_print;
 use ostree::glib;
 use ostree_ext::container::SignatureSource;
 use ostree_ext::ostree;
+use rustix::fs::StatVfsMountFlags;
 
 /// Try to look for keys injected by e.g. rpm-ostree requesting machine-local
 /// changes; if any are present, return `true`.
@@ -83,7 +84,16 @@ pub fn have_executable(name: &str) -> Result<bool> {
 /// Given a target directory, if it's a read-only mount, then remount it writable
 #[context("Opening {target} with writable mount")]
 pub(crate) fn open_dir_remount_rw(root: &Dir, target: &Utf8Path) -> Result<Dir> {
-    if matches!(root.is_mountpoint(target), Ok(Some(true))) {
+    let target_dir = root.open_dir(target).with_context(|| format!("Opening {target}"))?;
+
+    if matches!(target_dir.is_mountpoint("."), Ok(Some(true))) {
+        let st = rustix::fs::fstatvfs(target_dir.as_fd())
+            .with_context(|| format!("Getting filesystem info for {target}"))?;
+
+        if !st.f_flag.contains(StatVfsMountFlags::RDONLY) {
+            return Ok(target_dir);
+        };
+
         tracing::debug!("Target {target} is a mountpoint, remounting rw");
         let st = Command::new("mount")
             .args(["-o", "remount,rw", target.as_str()])
@@ -92,7 +102,8 @@ pub(crate) fn open_dir_remount_rw(root: &Dir, target: &Utf8Path) -> Result<Dir>
 
         anyhow::ensure!(st.success(), "Failed to remount: {st:?}");
     }
-    root.open_dir(target).map_err(anyhow::Error::new)
+
+    Ok(target_dir)
 }
 
 /// Given a target path, remove its immutability if present

crates/system-reinstall-bootc/src/podman.rs

@@ -50,7 +50,9 @@ pub(crate) fn reinstall_command(
         "--security-opt",
         "label=type:unconfined_t",
         "-v",
-        "/:/target",
+        // systemd gpt-auto-generator has boot.mount autofs mounted on /boot
+        // We want to propage that inside the container
+        "/:/target:rslave",
     ]
     .map(String::from)
     .to_vec();