Use name space mount for code simplicity#174
Draft
say-paul wants to merge 2 commits into
Draft
Conversation
Leverage Linux mount namespaces to simplify /boot remount logic: - Add PrivateMounts=yes and RequiresMountsFor=/boot to systemd service - Create private mount namespace via unshare(CLONE_NEWNS) for CLI path - Replace /proc/mounts parsing with access(W_OK) writable check - Expose is_boot_writable_at as public API for testability - Remove remount_boot_ro and post-operation read-only restore - Skip read-only permission test when running as root (access(2) lets root bypass permission bits by design) Ref: fedora-iot#120 Made-with: Cursor
Functional tests covering greenboot's own API with mock temp dirs: - ensure_mount_namespace succeeds under test-remount feature - is_boot_writable_at detects writable, read-only, and missing paths - remount_boot_rw succeeds under test-remount feature - Public API surface compile-time validation - Skip read-only permission test when running as root All sensitive paths mocked — no real /boot or mount operations. Ref: fedora-iot#120 Made-with: Cursor
Member
Author
|
/test |
say-paul
marked this pull request as draft
April 14, 2026 11:09
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
POC-e2e agentic workflow
Problem
greenboot currently manages /boot remounts by parsing /proc/mounts to detect mount state, remounting /boot read-write before GRUB operations, and then restoring it to read-only afterward. This creates several issues:
Race conditions: Another process could modify /boot between the RW operation and the RO restore, or the restore could fail leaving /boot permanently writable.
Complex error handling: Every code path that touches /boot must track the original mount state and ensure cleanup, even on failure.
Fragile detection: Parsing /proc/mounts for mount state is brittle and doesn't account for bind mounts or overlay configurations.
Solution
Use Linux mount namespaces to isolate /boot remounts to the greenboot process. When the process exits, the namespace is destroyed and the global mount state is untouched — no restore step needed.
Systemd path: Add PrivateMounts=yes and RequiresMountsFor=/boot to the service unit, so systemd creates the namespace automatically.
CLI path: Call unshare(CLONE_NEWNS) via the nix crate early in main() when not running in a container.
Writable detection: Replace /proc/mounts parsing with access(2) using W_OK, which correctly detects read-only mounts (not just inode permission bits).
Simplify with_boot_rw: Remove the was_rw tracking and remount_boot_ro() call entirely — the namespace handles cleanup.
Resolves #120