root the build the pre-start check names

hive-priv/src/prestart.rs

@@ -13,14 +13,21 @@
 //! never followed. Nothing is deleted or repaired, so whatever is there stays
 //! for the operator.
 //!
+//! The drop-in names the running hive-priv binary, which nothing else roots
+//! once the system has moved on to a newer build. [`pin_binary`] keeps a GC
+//! root on it for as long as the drop-in exists, and [`unpin_binary`] drops
+//! the root with the drop-in.
+//!
 //! The entry point is [`run`]; [`check`] holds the rules.
 
 use std::fs::{FileType, Metadata};
+use std::os::unix::fs::{DirBuilderExt as _, symlink};
 use std::path::{Path, PathBuf};
 
 use anyhow::{Context as _, Result, bail};
 
 use crate::container_config::{container_rootfs, validate_container_system_name};
+use crate::shared::partial_name;
 
 /// The sub-command the drop-in's `ExecStartPre=` names.
 pub(crate) const SUBCOMMAND: &str = "check-rootfs";
@@ -57,6 +64,74 @@ const REGULAR_ONLY: [&str; 2] = ["etc/machine-id", "etc/resolv.conf"];
 /// `/etc/static` once it has booted.
 const OS_RELEASE: &str = "etc/os-release";
 
+/// Where hive-priv roots the build named by each container's `ExecStartPre=`:
+/// `<container>` is a symlink to that build's store path. The directory is
+/// under the host's `/nix/var/nix/gcroots`, not `per-container`, which is the
+/// only part of it a container is given (`--bind=.../gcroots/per-container/<c>`
+/// in the nixpkgs start script), so a container can't reach it.
+const GCROOTS: &str = "/nix/var/nix/gcroots/hyperhive-check-rootfs";
+
+/// Root the store path of `exe` for `container`, replacing the root a previous
+/// write left, so the build a drop-in names outlives a garbage collection for
+/// as long as the drop-in does. One link per container, so they don't pile up.
+pub(crate) fn pin_binary(container: &str, exe: &Path) -> Result<()> {
+    pin_binary_in(Path::new(GCROOTS), Path::new(STORE), container, exe)
+}
+
+/// Drop the root [`pin_binary`] left for `container`, once its drop-in is gone.
+/// A name that holds anything but a link is left alone and reported.
+pub(crate) fn unpin_binary(container: &str) -> Result<()> {
+    unpin_binary_in(Path::new(GCROOTS), container)
+}
+
+/// [`pin_binary`] with the roots directory and the store as parameters.
+///
+/// A binary outside `store` can't be collected, so it gets no root. The link
+/// is made under a temporary name and renamed over `<container>`: `rename`
+/// replaces whatever link is there without following it.
+fn pin_binary_in(roots: &Path, store: &Path, container: &str, exe: &Path) -> Result<()> {
+    let Some(entry) = exe
+        .strip_prefix(store)
+        .ok()
+        .and_then(|rest| rest.components().next())
+    else {
+        return Ok(());
+    };
+    let target = store.join(entry);
+    std::fs::DirBuilder::new()
+        .recursive(true)
+        .mode(0o755)
+        .create(roots)
+        .with_context(|| format!("create {}", roots.display()))?;
+    if !lstat(roots)?.is_some_and(|m| m.file_type().is_dir()) {
+        bail!("{} is not a real directory", roots.display());
+    }
+    let tmp = roots.join(partial_name(container));
+    symlink(&target, &tmp).with_context(|| format!("create {}", tmp.display()))?;
+    let root = roots.join(container);
+    std::fs::rename(&tmp, &root).map_err(|e| {
+        // Best effort: a leftover temp is a root too, but a harmless one.
+        let _ = std::fs::remove_file(&tmp);
+        anyhow::Error::new(e).context(format!("replace {}", root.display()))
+    })
+}
+
+/// [`unpin_binary`] with the roots directory as a parameter.
+fn unpin_binary_in(roots: &Path, container: &str) -> Result<()> {
+    let root = roots.join(container);
+    match lstat(&root)? {
+        None => Ok(()),
+        Some(meta) if meta.file_type().is_symlink() => {
+            std::fs::remove_file(&root).with_context(|| format!("remove {}", root.display()))
+        }
+        Some(meta) => bail!(
+            "{} is {}, not a link: left alone",
+            root.display(),
+            kind(meta.file_type())
+        ),
+    }
+}
+
 /// Handle `hive-priv <subcommand> ...` when the first argument names one.
 /// `None` means it is not a sub-command and the daemon starts.
 ///
@@ -210,8 +285,8 @@ mod tests {
     use std::os::unix::fs::symlink;
     use std::path::PathBuf;
 
-    use super::{check, run};
-    use crate::shared::test_support::scratch;
+    use super::{check, pin_binary_in, run, unpin_binary_in};
+    use crate::shared::test_support::{entries, scratch};
 
     /// A scratch container: root, the profile link's path and a store with one
     /// toplevel in it. Nothing is linked yet.
@@ -439,6 +514,100 @@ mod tests {
         assert!(target.is_dir());
     }
 
+    /// A scratch store holding one build with a binary in it, a roots dir and
+    /// the binary's path.
+    fn pin_fixture() -> (PathBuf, PathBuf, PathBuf, PathBuf) {
+        let base = scratch();
+        let store = base.join("store");
+        let build = store.join("abc-hive-priv");
+        std::fs::create_dir_all(build.join("bin")).unwrap();
+        let exe = build.join("bin/hive-priv");
+        std::fs::write(&exe, "").unwrap();
+        (base.join("roots"), store, build, exe)
+    }
+
+    #[test]
+    fn the_root_points_at_the_store_path_the_drop_in_names() {
+        let (roots, store, build, exe) = pin_fixture();
+        pin_binary_in(&roots, &store, "h-iris", &exe).unwrap();
+        let root = roots.join("h-iris");
+        assert!(std::fs::symlink_metadata(&root).unwrap().is_symlink());
+        // The build, not the binary inside it.
+        assert_eq!(std::fs::read_link(&root).unwrap(), build);
+        assert_eq!(std::fs::read_dir(&roots).unwrap().count(), 1);
+    }
+
+    #[test]
+    fn a_rewrite_replaces_the_root_and_leaves_no_temp() {
+        let (roots, store, build, exe) = pin_fixture();
+        let newer = store.join("def-hive-priv");
+        std::fs::create_dir_all(newer.join("bin")).unwrap();
+        pin_binary_in(&roots, &store, "h-iris", &exe).unwrap();
+        pin_binary_in(&roots, &store, "h-iris", &newer.join("bin/hive-priv")).unwrap();
+        pin_binary_in(&roots, &store, "h-bob", &exe).unwrap();
+        assert_eq!(std::fs::read_link(roots.join("h-iris")).unwrap(), newer);
+        assert_eq!(std::fs::read_link(roots.join("h-bob")).unwrap(), build);
+        assert_eq!(entries(&roots), ["h-bob", "h-iris"]);
+    }
+
+    #[test]
+    fn a_link_planted_at_the_root_name_is_replaced_not_followed() {
+        let (roots, store, build, exe) = pin_fixture();
+        let victim = victim();
+        std::fs::write(victim.join("keep"), "data").unwrap();
+        std::fs::create_dir_all(&roots).unwrap();
+        symlink(&victim, roots.join("h-iris")).unwrap();
+        pin_binary_in(&roots, &store, "h-iris", &exe).unwrap();
+        assert_eq!(std::fs::read_link(roots.join("h-iris")).unwrap(), build);
+        assert_eq!(
+            std::fs::read_to_string(victim.join("keep")).unwrap(),
+            "data"
+        );
+        assert_eq!(std::fs::read_dir(&victim).unwrap().count(), 1);
+    }
+
+    #[test]
+    fn a_roots_dir_that_is_a_link_is_refused() {
+        let (roots, store, _, exe) = pin_fixture();
+        let victim = victim();
+        symlink(&victim, &roots).unwrap();
+        let msg = format!(
+            "{:#}",
+            pin_binary_in(&roots, &store, "h-iris", &exe).unwrap_err()
+        );
+        assert!(msg.contains("is not a real directory"), "{msg}");
+        assert_eq!(std::fs::read_dir(&victim).unwrap().count(), 0);
+    }
+
+    #[test]
+    fn a_binary_outside_the_store_gets_no_root() {
+        let (roots, store, _, _) = pin_fixture();
+        let elsewhere = scratch().join("hive-priv");
+        pin_binary_in(&roots, &store, "h-iris", &elsewhere).unwrap();
+        assert!(!roots.exists());
+    }
+
+    #[test]
+    fn unpinning_removes_the_container_root_and_nothing_else() {
+        let (roots, store, build, exe) = pin_fixture();
+        pin_binary_in(&roots, &store, "h-iris", &exe).unwrap();
+        pin_binary_in(&roots, &store, "h-bob", &exe).unwrap();
+        unpin_binary_in(&roots, "h-iris").unwrap();
+        assert_eq!(entries(&roots), ["h-bob"]);
+        // Already gone: fine. The build it named is untouched.
+        unpin_binary_in(&roots, "h-iris").unwrap();
+        assert!(build.join("bin/hive-priv").is_file());
+    }
+
+    #[test]
+    fn unpinning_leaves_a_name_that_is_not_a_link_alone() {
+        let (roots, _, _, _) = pin_fixture();
+        std::fs::create_dir_all(roots.join("h-iris")).unwrap();
+        std::fs::write(roots.join("h-iris/keep"), "").unwrap();
+        let msg = format!("{:#}", unpin_binary_in(&roots, "h-iris").unwrap_err());
+        assert!(msg.contains("left alone"), "{msg}");
+        assert!(roots.join("h-iris/keep").exists());
+    }
     #[test]
     fn only_the_check_rootfs_sub_command_is_taken() {
         assert_eq!(run(&[]), None);