Patch bootc FIPS dracut boot handling

bootc non-LUKS single-root deployments can fail FIPS boot because
dracut's `01fips` module assumes `/boot` can be mounted read-only
as a separate device. On bootc single-root layouts that mount can
fail before the kernel HMAC check runs.

Patch the image at build time so dracut falls back to bind-mounting
the existing /boot tree when the default mount path fails. This is an
image-side workaround for the current bootc single-root FIPS boot path;
the underlying fix should eventually land upstream in dracut, bootc, or
their interaction.

Signed-off-by: rabi <ramishra@redhat.com>

Author: rabi

bootc/Containerfile

@@ -144,6 +144,10 @@ RUN --mount=type=secret,id=rhsm,dst=/var/tmp/rhsm-script.sh \
     (subscription-manager unregister || true) && \
     systemctl enable $ENABLE_UNITS
 
+COPY patch-dracut-fips.py /usr/local/bin/patch-dracut-fips.py
+RUN python3 /usr/local/bin/patch-dracut-fips.py && \
+    bash -n /usr/lib/dracut/modules.d/01fips/fips.sh
+
 
 # Configure FIPS
 ARG FIPS=1

bootc/README.rst

@@ -28,6 +28,10 @@ then run the following commands::
 To continue using CentOS Stream 9, leave the defaults in place and run
 ``make build`` (the default tag is ``latest``).
 
+FIPS-enabled images include a build-time patch to dracut's ``01fips`` module
+so bootc deployments on single-root layouts can bind-mount the existing
+``/boot`` tree when the standard read-only device mount fails.
+
 To build a RHEL 9 based bootc EDPM container image using internal repositories,
 install the required certificates then run the following commands::
 

bootc/patch-dracut-fips.py

@@ -0,0 +1,50 @@
+#!/usr/bin/env python3
+
+"""Patch dracut's FIPS boot handling for bootc single-root layouts."""
+
+from pathlib import Path
+import sys
+
+
+FIPS_SH = Path("/usr/lib/dracut/modules.d/01fips/fips.sh")
+
+OLD = """        if ! mount -oro "$boot" /boot; then
+            return 1
+        fi
+        FIPS_MOUNTED_BOOT=1
+"""
+
+NEW = """        if ! mount -oro "$boot" /boot; then
+            local _bp
+            for _bp in /sysroot/sysroot/boot /sysroot/boot; do
+                if [ -d "${_bp}/ostree" ]; then
+                    fips_info "Device mount failed, bind-mounting ${_bp} to /boot"
+                    if mount --bind "${_bp}" /boot; then
+                        break
+                    fi
+                fi
+            done
+            ismounted /boot || return 1
+        fi
+        FIPS_MOUNTED_BOOT=1
+"""
+
+
+def main() -> int:
+    text = FIPS_SH.read_text()
+
+    if NEW in text:
+        print(f"{FIPS_SH} already patched")
+        return 0
+
+    if OLD not in text:
+        print(f"expected mount_boot block not found in {FIPS_SH}", file=sys.stderr)
+        return 1
+
+    FIPS_SH.write_text(text.replace(OLD, NEW))
+    print(f"patched {FIPS_SH}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())