grub-cc: Handle statefile

For grub we store the statefile in `/sysroot/boot/bootupd.json`. For
grub-cc, and in future systemd-boot, we won't have a `/boot`, so we now
store the state pre bootloader.

Grub2: Statefile is still in `/sysroot/boot/bootupd.json`
GrubCC: Statefile is stored in all the ESPs

Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

Author: Johan-Liebert1

src/backend/statefile.rs

@@ -1,5 +1,8 @@
 //! On-disk saved state.
 
+use crate::bootloader::Bootloader;
+use crate::efi::Efi;
+use crate::freezethaw::fsfreeze_thaw_cycle;
 use crate::model::SavedState;
 use crate::util::SignalTerminationGuard;
 use anyhow::{bail, Context, Result};
@@ -10,7 +13,9 @@ use fn_error_context::context;
 use fs2::FileExt;
 use std::fs::File;
 use std::io::prelude::*;
+use std::os::fd::{AsRawFd, FromRawFd};
 use std::path::Path;
+use tempfile::tempdir;
 
 impl SavedState {
     /// System-wide bootupd write lock (relative to sysroot).
@@ -57,13 +62,52 @@ impl SavedState {
 
     /// Load the JSON file containing on-disk state.
     #[context("Loading saved state")]
-    pub(crate) fn load_from_disk(root_path: impl AsRef<Path>) -> Result<Option<SavedState>> {
+    pub(crate) fn load_from_disk(
+        root_path: impl AsRef<Path>,
+        bootloader: Option<Bootloader>,
+    ) -> Result<Option<SavedState>> {
         let root_path = root_path.as_ref();
         let sysroot = Dir::open_ambient_dir(root_path, ambient_authority())
             .with_context(|| format!("opening sysroot '{}'", root_path.display()))?;
 
-        let statefile_path = Path::new(Self::STATEFILE_DIR).join(Self::STATEFILE_NAME);
-        let saved_state = if let Some(statusf) = sysroot.open_optional(&statefile_path)? {
+        let (statefile, _esp_guard) = match bootloader {
+            Some(b) => match b {
+                Bootloader::Grub => {
+                    let path = Path::new(Self::STATEFILE_DIR).join(Self::STATEFILE_NAME);
+                    (sysroot.open_optional(&path)?, None)
+                }
+
+                Bootloader::GrubCC => {
+                    let efi = Efi::default();
+
+                    let dir = Dir::open_ambient_dir(&root_path, ambient_authority())
+                        .with_context(|| format!("Opening filesystem path {root_path:?}"))?;
+                    let device = bootc_internal_blockdev::list_dev_by_dir(&dir)?;
+
+                    // Since we write the state file to all ESPs, it should be enough to get it
+                    // from the first one. Though, we could check the integrity by getting from
+                    // all the ESPs and making sure they're all the same...
+                    let esp = device.find_first_colocated_esp()?;
+
+                    let tmpdir = tempdir()?;
+                    std::fs::create_dir_all(tmpdir.path().join("efi"))
+                        .context("Creating efi inside tmpdir")?;
+
+                    let mounted = efi
+                        .ensure_mounted_esp(tmpdir.path(), &Path::new(&esp.path()))
+                        .context("Mounting ESP")?;
+
+                    let dir = Dir::open_ambient_dir(&mounted, ambient_authority())?;
+
+                    (dir.open_optional(Self::STATEFILE_NAME)?, Some(efi))
+                }
+            },
+
+            // No bootloader, we're probably running inside a container
+            None => (None, None),
+        };
+
+        let saved_state = if let Some(statusf) = statefile {
             let mut bufr = std::io::BufReader::new(statusf);
             let mut s = String::new();
             bufr.read_to_string(&mut s)?;
@@ -85,18 +129,34 @@ impl SavedState {
         } else {
             None
         };
+
         Ok(saved_state)
     }
 
     /// Check whether statefile exists.
-    pub(crate) fn ensure_not_present(root_path: impl AsRef<Path>) -> Result<()> {
-        let statepath = Path::new(root_path.as_ref())
-            .join(Self::STATEFILE_DIR)
-            .join(Self::STATEFILE_NAME);
-        if statepath.exists() {
-            bail!("{} already exists", statepath.display());
+    pub(crate) fn ensure_not_present(
+        root_path: impl AsRef<Path>,
+        bootloader: Bootloader,
+    ) -> Result<()> {
+        let saved_state = SavedState::load_from_disk(&root_path, Some(bootloader))?;
+
+        if saved_state.is_none() {
+            return Ok(());
+        }
+
+        match bootloader {
+            Bootloader::Grub => {
+                let statepath = Path::new(root_path.as_ref())
+                    .join(Self::STATEFILE_DIR)
+                    .join(Self::STATEFILE_NAME);
+
+                bail!("{} already exists", statepath.display());
+            }
+
+            Bootloader::GrubCC => {
+                bail!("{} already exists in the ESP", Self::STATEFILE_NAME);
+            }
         }
-        Ok(())
     }
 }
 
@@ -112,16 +172,59 @@ pub(crate) struct StateLockGuard {
 
 impl StateLockGuard {
     /// Atomically replace the on-disk state with a new version.
-    pub(crate) fn update_state(&mut self, state: &SavedState) -> Result<()> {
-        let subdir = self.sysroot.open_dir(SavedState::STATEFILE_DIR)?;
-
-        subdir
-            .atomic_write_with_perms(
-                SavedState::STATEFILE_NAME,
-                serde_json::to_vec(state).context("Serializing state")?,
-                Permissions::from_mode(0o644),
-            )
-            .context("Writing state file")?;
+    #[context("Updating state")]
+    pub(crate) fn update_state(
+        &mut self,
+        state: &SavedState,
+        bootloader: Bootloader,
+    ) -> Result<()> {
+        if bootloader == Bootloader::Grub {
+            let subdir = self.sysroot.open_dir(SavedState::STATEFILE_DIR)?;
+
+            subdir
+                .atomic_write_with_perms(
+                    SavedState::STATEFILE_NAME,
+                    serde_json::to_vec(state).context("Serializing state")?,
+                    Permissions::from_mode(0o644),
+                )
+                .context("Writing state file")?;
+
+            return Ok(());
+        }
+
+        let dir = unsafe { Dir::from_raw_fd(self.sysroot.as_raw_fd()) };
+        let device = bootc_internal_blockdev::list_dev_by_dir(&dir)?;
+        let all_esps = device
+            .find_colocated_esps()
+            .context("Searching for ESP")?
+            .ok_or_else(|| anyhow::anyhow!("ESP not found"))?;
+
+        let efi = Efi::default();
+
+        let tmpdir = tempdir()?;
+
+        // [`ensure_mounted_esp`] needs this
+        std::fs::create_dir_all(tmpdir.path().join("efi")).context("Creating efi inside tmpdir")?;
+
+        for esp in all_esps {
+            let mounted = efi
+                .ensure_mounted_esp(tmpdir.path(), &Path::new(&esp.path()))
+                .context("Mounting ESP")?;
+
+            let dir = Dir::open_ambient_dir(&mounted, ambient_authority())?;
+
+            dir.atomic_replace_with(SavedState::STATEFILE_NAME, |w| -> std::io::Result<()> {
+                serde_json::to_writer(w, state)?;
+                Ok(())
+            })?;
+
+            // dir.set_permissions(SavedState::STATEFILE_NAME, 0o644)?;
+
+            // Do the sync before unmount
+            fsfreeze_thaw_cycle(dir.reopen_as_ownedfd()?)?;
+            drop(dir);
+            efi.unmount().context("unmount after update")?;
+        }
 
         Ok(())
     }

src/bootupd.rs

@@ -1,6 +1,6 @@
 #[cfg(any(target_arch = "x86_64", target_arch = "powerpc64"))]
 use crate::bios;
-use crate::bootloader::Bootloader;
+use crate::bootloader::{get_bootloader, Bootloader};
 use crate::component;
 use crate::component::{Component, ValidationResult};
 use crate::coreos;
@@ -19,6 +19,7 @@ use crate::freezethaw::fsfreeze_thaw_cycle;
 ))]
 use crate::grubconfigs::{ensure_grub_permissions, GRUB2DIR};
 use crate::model::{ComponentStatus, ComponentUpdatable, ContentMetadata, SavedState, Status};
+use crate::util::running_in_container;
 use crate::{ostreeutil, util};
 use anyhow::{anyhow, Context, Result};
 use camino::{Utf8Path, Utf8PathBuf};
@@ -65,7 +66,7 @@ pub(crate) fn install(
 ) -> Result<()> {
     let source_root_dir =
         Dir::open_ambient_dir(source_root, ambient_authority()).context("Opening source root")?;
-    SavedState::ensure_not_present(dest_root)
+    SavedState::ensure_not_present(dest_root, bootloader)
         .context("failed to install, invalid re-install attempted")?;
 
     let all_components = get_components_impl(auto_components);
@@ -218,7 +219,7 @@ pub(crate) fn install(
     let mut state_guard =
         SavedState::unlocked(sysroot.try_clone()?).context("failed to acquire write lock")?;
     state_guard
-        .update_state(&state)
+        .update_state(&state, bootloader)
         .context("failed to update state")?;
 
     Ok(())
@@ -332,7 +333,9 @@ fn ensure_writable_boot() -> Result<()> {
 
 /// daemon implementation of component update
 pub(crate) fn update(name: &str, rootcxt: &RootContext) -> Result<ComponentUpdateResult> {
-    let mut state = SavedState::load_from_disk("/")?.unwrap_or_default();
+    let bootloader = get_bootloader()?;
+
+    let mut state = SavedState::load_from_disk("/", Some(bootloader))?.unwrap_or_default();
     let component = component::new_from_name(name)?;
     let inst = if let Some(inst) = state.installed.get(name) {
         inst.clone()
@@ -374,15 +377,15 @@ pub(crate) fn update(name: &str, rootcxt: &RootContext) -> Result<ComponentUpdat
     let mut state_guard =
         SavedState::acquire_write_lock(sysroot).context("Failed to acquire write lock")?;
     state_guard
-        .update_state(&state)
+        .update_state(&state, bootloader)
         .context("Failed to update state")?;
 
     let newinst = component
         .run_update(rootcxt, &inst)
         .with_context(|| format!("Failed to update {}", component.name()))?;
     state.installed.insert(component.name().into(), newinst);
     pending_container.remove(component.name());
-    state_guard.update_state(&state)?;
+    state_guard.update_state(&state, bootloader)?;
 
     Ok(ComponentUpdateResult::Updated {
         previous: inst.meta,
@@ -397,8 +400,9 @@ pub(crate) fn adopt_and_update(
     rootcxt: &RootContext,
     with_static_config: bool,
 ) -> Result<Option<ContentMetadata>> {
+    let bootloader = get_bootloader()?;
     let sysroot = &rootcxt.sysroot;
-    let mut state = SavedState::load_from_disk("/")?.unwrap_or_default();
+    let mut state = SavedState::load_from_disk("/", Some(bootloader))?.unwrap_or_default();
     let component = component::new_from_name(name)?;
     if state.installed.contains_key(name) {
         anyhow::bail!("Component {} is already installed", name);
@@ -441,7 +445,7 @@ pub(crate) fn adopt_and_update(
 
             println!("Static GRUB configuration has been adopted successfully.");
         }
-        state_guard.update_state(&state)?;
+        state_guard.update_state(&state, bootloader)?;
         return Ok(Some(update));
     } else {
         // Nothing adopted, skip
@@ -468,7 +472,7 @@ fn list_dev_current_root() -> Result<Device> {
 
 /// daemon implementation of component validate
 pub(crate) fn validate(name: &str) -> Result<ValidationResult> {
-    let state = SavedState::load_from_disk("/")?.unwrap_or_default();
+    let state = SavedState::load_from_disk("/", Some(get_bootloader()?))?.unwrap_or_default();
     let component = component::new_from_name(name)?;
     let Some(inst) = state.installed.get(name) else {
         anyhow::bail!("Component {} is not installed", name);
@@ -477,11 +481,20 @@ pub(crate) fn validate(name: &str) -> Result<ValidationResult> {
     component.validate(inst, &device)
 }
 
+/// Impl for bootupctl status
+/// This function assumes we're not running in a container
 pub(crate) fn status() -> Result<Status> {
     let mut ret: Status = Default::default();
     let mut known_components = get_components();
     let sysroot = Dir::open_ambient_dir("/", ambient_authority())?;
-    let state = SavedState::load_from_disk("/")?;
+
+    let bootloader = if running_in_container() {
+        None
+    } else {
+        Some(get_bootloader()?)
+    };
+
+    let state = SavedState::load_from_disk("/", bootloader)?;
     if let Some(state) = state {
         for (name, ic) in state.installed.iter() {
             log::trace!("Gathering status for installed component: {}", name);

src/efi.rs

@@ -179,7 +179,7 @@ impl Efi {
         Ok(destdir)
     }
 
-    fn unmount(&self) -> Result<()> {
+    pub(crate) fn unmount(&self) -> Result<()> {
         if let Some(mount) = self.mountpoint.borrow_mut().take() {
             Command::new("umount")
                 .arg(&mount)