say the store check is an allowlist: only ext4, btrfs and xfs pass

hive-priv/src/userns.rs

@@ -51,7 +51,7 @@ const STORE: &str = "/nix/store";
 type FsType = libc::__fsword_t;
 
 /// `f_type` of the filesystems that support idmapped mounts and that a store
-/// can sit on: ext4, btrfs and xfs.
+/// can sit on: ext4, btrfs and xfs. Nothing else is accepted.
 const IDMAP_FS: [FsType; 3] = [0xEF53, 0x9123_683E, 0x5846_5342];
 
 /// The dirs under `<AGENT_STATE_ROOT>/<agent>` the agent writes into. `config`
@@ -111,18 +111,19 @@ fn fs_type(path: &Path) -> std::io::Result<FsType> {
     Ok(buf.f_type)
 }
 
-/// Refuse a store on a filesystem that cannot be idmapped: nspawn clones a
+/// Refuse a store whose filesystem is not ext4, btrfs or xfs. nspawn clones a
 /// namespaced container's `/nix/store` bind with an idmap, which the kernel
-/// refuses there, so the container would not boot.
+/// refuses on other filesystems, so the container would not boot. Others are
+/// refused even where a newer kernel could idmap them.
 fn check_store(agent: &str, f_type: std::io::Result<FsType>) -> Result<()> {
     let f_type = f_type.with_context(|| format!("{agent}: statfs {STORE}"))?;
     if IDMAP_FS.contains(&f_type) {
         return Ok(());
     }
     bail!(
-        "{agent} sets privateUsers, but {STORE} is on a filesystem (f_type {f_type:#x}) that \
-         cannot be idmapped; move {STORE} to ext4, btrfs or xfs, or leave privateUsers off for \
-         this agent"
+        "{agent} sets privateUsers, but {STORE} is on a filesystem (f_type {f_type:#x}) other \
+         than ext4, btrfs or xfs, the only ones accepted; move {STORE} to one of them, or leave \
+         privateUsers off for this agent"
     )
 }