Patch bootc FIPS dracut boot handling

bootc non-LUKS single-root deployments can fail FIPS boot because
dracut's `01fips` module assumes `/boot` can be mounted read-only
as a separate device. On bootc single-root layouts that mount can
fail before the kernel HMAC check runs.

Patch the image at build time so dracut falls back to bind-mounting
the existing /boot tree when the default mount path fails. This is an
image-side workaround for the current bootc single-root FIPS boot path;
the underlying fix should eventually land upstream in dracut, bootc, or
their interaction.

Signed-off-by: rabi <ramishra@redhat.com>

Author: rabi

bootc/Containerfile

@@ -144,6 +144,10 @@ RUN --mount=type=secret,id=rhsm,dst=/var/tmp/rhsm-script.sh \
     (subscription-manager unregister || true) && \
     systemctl enable $ENABLE_UNITS
 
+COPY patch-dracut-fips.py /usr/local/bin/patch-dracut-fips.py
+RUN python3 /usr/local/bin/patch-dracut-fips.py && \
+    bash -n /usr/lib/dracut/modules.d/01fips/fips.sh
+
 
 # Configure FIPS
 ARG FIPS=1

bootc/README.rst

@@ -28,6 +28,10 @@ then run the following commands::
 To continue using CentOS Stream 9, leave the defaults in place and run
 ``make build`` (the default tag is ``latest``).
 
+FIPS-enabled images include a build-time patch to dracut's ``01fips`` module
+so bootc deployments on single-root layouts can bind-mount the existing
+``/boot`` tree when the standard read-only device mount fails.
+
 To build a RHEL 9 based bootc EDPM container image using internal repositories,
 install the required certificates then run the following commands::
 

bootc/patch-dracut-fips.py

@@ -0,0 +1,52 @@
+#!/usr/bin/env python3
+
+"""Patch dracut's FIPS boot handling for bootc single-root layouts."""
+
+from pathlib import Path
+import re
+import sys
+
+
+FIPS_SH = Path("/usr/lib/dracut/modules.d/01fips/fips.sh")
+PATTERN = re.compile(
+    r'(?ms)^([ \t]*)if ! mount -oro "\$boot" /boot; then\n'
+    r'(?:.*\n)*?^\1FIPS_MOUNTED_BOOT=1\n'
+)
+
+
+def main() -> int:
+    text = FIPS_SH.read_text()
+
+    if 'Device mount failed, bind-mounting ${_bp} to /boot' in text:
+        print(f"{FIPS_SH} already patched")
+        return 0
+
+    match = PATTERN.search(text)
+    if not match:
+        print(f"expected mount_boot block not found in {FIPS_SH}", file=sys.stderr)
+        return 1
+
+    indent = match.group(1)
+    replacement = "\n".join([
+        f'{indent}if ! mount -oro "$boot" /boot; then',
+        f'{indent}    local _bp',
+        f'{indent}    for _bp in /sysroot/sysroot/boot /sysroot/boot; do',
+        f'{indent}        if [ -d "${{_bp}}/ostree" ]; then',
+        f'{indent}            fips_info "Device mount failed, bind-mounting ${{_bp}} to /boot"',
+        f'{indent}            if mount --bind "${{_bp}}" /boot; then',
+        f'{indent}                break',
+        f'{indent}            fi',
+        f'{indent}        fi',
+        f'{indent}    done',
+        f'{indent}    ismounted /boot || return 1',
+        f'{indent}fi',
+        f'{indent}FIPS_MOUNTED_BOOT=1',
+        "",
+    ])
+    FIPS_SH.write_text(PATTERN.sub(replacement, text, count=1))
+    print(f"patched {FIPS_SH}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())