lsm: Use walk API with noxdev for recursive SELinux relabeling

Rewrite ensure_dir_labeled_recurse to use the cap_std_ext walk API
with noxdev instead of manually recursing through directories. This
prevents the recursive labeling from crossing mount point boundaries,
avoiding failures when pseudo-filesystems like sysfs are mounted
under the target root.

Assisted-by: OpenCode (claude-opus-4-6)
Signed-off-by: John Eckersberg <jeckersb@redhat.com>

Author: jeckersb

crates/lib/src/lsm.rs

@@ -387,14 +387,20 @@ pub(crate) fn relabel_recurse(
     relabel_recurse_inner(root, &mut path, as_path.as_mut(), policy)
 }
 
-/// A wrapper for creating a directory, also optionally setting a SELinux label.
-/// The provided `skip` parameter is a device/inode that we will ignore (and not traverse).
+/// Recursively ensure all files under a directory have SELinux labels.
+/// Uses the `walk` API with `noxdev` to avoid crossing mount point boundaries
+/// (e.g. into sysfs, procfs, etc.).
+/// The provided `skip` parameter is a device/inode pair that we will ignore
+/// (and not traverse into).
 pub(crate) fn ensure_dir_labeled_recurse(
     root: &Dir,
     path: &mut Utf8PathBuf,
     policy: &ostree::SePolicy,
     skip: Option<(libc::dev_t, libc::ino64_t)>,
 ) -> Result<()> {
+    use cap_std_ext::dirext::WalkConfiguration;
+    use std::ops::ControlFlow;
+
     // Juggle the cap-std requirement for relative paths vs the libselinux
     // requirement for absolute paths by special casing the empty string "" as "."
     // just for the initial directory enumeration.
@@ -406,43 +412,68 @@ pub(crate) fn ensure_dir_labeled_recurse(
 
     let mut n = 0u64;
 
+    // Label the starting directory itself; the walk API only visits children.
     let metadata = root.symlink_metadata(path_for_read)?;
     match ensure_labeled(root, path, &metadata, policy)? {
+        SELinuxLabelState::Unsupported => return Ok(()),
         SELinuxLabelState::Unlabeled => {
             n += 1;
         }
-        SELinuxLabelState::Unsupported => return Ok(()),
         SELinuxLabelState::Labeled => {}
     }
-
-    for ent in root.read_dir(path_for_read)? {
-        let ent = ent?;
-        let metadata = ent.metadata()?;
-        if let Some((skip_dev, skip_ino)) = skip.as_ref().copied() {
-            if (metadata.dev(), metadata.ino()) == (skip_dev, skip_ino) {
-                tracing::debug!("Skipping dev={skip_dev} inode={skip_ino}");
-                continue;
+    let config = WalkConfiguration::default()
+        .noxdev()
+        .path_base(path_for_read.as_std_path());
+
+    root.open_dir(path_for_read)?
+        .walk::<_, anyhow::Error>(&config, |component| {
+            let metadata = component.entry.metadata()?;
+
+            // Check if this entry should be skipped
+            if let Some((skip_dev, skip_ino)) = skip {
+                if (metadata.dev(), metadata.ino()) == (skip_dev, skip_ino) {
+                    tracing::debug!("Skipping dev={skip_dev} inode={skip_ino}");
+                    // For directories, Break skips traversal into the directory
+                    // but continues with the next sibling. For non-directories,
+                    // Break would skip all remaining siblings, so use Continue
+                    // to skip only this entry.
+                    if component.file_type.is_dir() {
+                        return Ok(ControlFlow::Break(()));
+                    } else {
+                        return Ok(ControlFlow::Continue(()));
+                    }
+                }
             }
-        }
-        let name = ent.file_name();
-        let name = name
-            .to_str()
-            .ok_or_else(|| anyhow::anyhow!("Invalid non-UTF-8 filename: {name:?}"))?;
-        path.push(name);
 
-        if metadata.is_dir() {
-            ensure_dir_labeled_recurse(root, path, policy, skip)?;
-        } else {
+            let path = Utf8Path::from_path(component.path)
+                .ok_or_else(|| anyhow::anyhow!("Invalid non-UTF-8 path: {:?}", component.path))?;
+
             match ensure_labeled(root, path, &metadata, policy)? {
                 SELinuxLabelState::Unlabeled => {
                     n += 1;
                 }
-                SELinuxLabelState::Unsupported => break,
+                // We check for Unsupported on the starting directory above,
+                // and the walk uses noxdev to stay on the same filesystem,
+                // so hitting Unsupported here would be unexpected unless
+                // this entry is a mountpoint on a filesystem that doesn't
+                // support xattrs (e.g. the vfat EFI system partition).
+                SELinuxLabelState::Unsupported => {
+                    match component.dir.is_mountpoint(component.filename)? {
+                        // Definitely a mountpoint, or can't determine; skip it
+                        Some(true) | None => return Ok(ControlFlow::Break(())),
+                        // Definitely not a mountpoint; this is unexpected
+                        Some(false) => {
+                            anyhow::bail!(
+                                "Unexpected SELinuxLabelState::Unsupported during walk at {path}"
+                            );
+                        }
+                    }
+                }
                 SELinuxLabelState::Labeled => {}
             }
-        }
-        path.pop();
-    }
+
+            Ok(ControlFlow::Continue(()))
+        })?;
 
     if n > 0 {
         tracing::debug!("Relabeled {n} objects in {path}");