bootc_lib/

generator.rs

use std::io::BufRead;

use anyhow::{Context, Result};
use camino::{Utf8Path, Utf8PathBuf};
use cap_std::fs::Dir;
use cap_std_ext::{cap_std, dirext::CapStdExtDirExt};
use fn_error_context::context;
use ostree_ext::container_utils::{OSTREE_BOOTED, is_ostree_booted_in};
use ostree_ext::{gio, ostree};
use rustix::{fd::AsFd, fs::StatVfsMountFlags};

use crate::bootc_composefs::{boot::BootType, state::read_boot_type, status::ComposefsCmdline};
use crate::composefs_consts::ABOOT_RECONCILE_SERVICE;
use crate::install::DESTRUCTIVE_CLEANUP;
use linux_kernel_cmdline::utf8::Cmdline;

const STATUS_ONBOOT_UNIT: &str = "bootc-status-updated-onboot.target";
const STATUS_PATH_UNIT: &str = "bootc-status-updated.path";
const CLEANUP_UNIT: &str = "bootc-destructive-cleanup.service";
const MULTI_USER_TARGET: &str = "multi-user.target";
const EDIT_UNIT: &str = "bootc-fstab-edit.service";
const FSTAB_ANACONDA_STAMP: &str = "Created by anaconda";
pub(crate) const BOOTC_EDITED_STAMP: &str = "Updated by bootc-fstab-edit.service";
const TRANSIENT_RELABEL_UNIT: &str = "bootc-early-overlay-relabel.service";
const SYSINIT_TARGET: &str = "sysinit.target";
const SHADOW_SYNC_UNIT: &str = "bootc-sysusers-shadow-sync.service";
const EARLY_TMPFILES_UNIT: &str = "bootc-early-tmpfiles.service";

/// Called when the root is read-only composefs to reconcile /etc/fstab
#[context("bootc generator")]
pub(crate) fn fstab_generator_impl(root: &Dir, unit_dir: &Dir) -> Result<bool> {
    // Do nothing if not ostree-booted
    if !is_ostree_booted_in(root)? {
        return Ok(false);
    }

    if let Some(fd) = root
        .open_optional("etc/fstab")
        .context("Opening /etc/fstab")?
        .map(std::io::BufReader::new)
    {
        let mut from_anaconda = false;
        let mut root_is_readonly = false;
        for line in fd.lines() {
            let line = line.context("Reading /etc/fstab")?;
            if line.contains(BOOTC_EDITED_STAMP) {
                // We're done
                return Ok(false);
            }
            if line.contains(FSTAB_ANACONDA_STAMP) {
                from_anaconda = true;
            }
            let fields = line.split_ascii_whitespace().collect::<Vec<_>>();
            if !line.trim_start().starts_with('#')
                && fields.get(1) == Some(&"/")
                && fields
                    .get(3)
                    .is_some_and(|options| options.split(',').any(|option| option == "ro"))
            {
                root_is_readonly = true;
            }
        }
        if !from_anaconda || root_is_readonly {
            return Ok(false);
        }
        tracing::debug!("/etc/fstab from anaconda: {from_anaconda}");
        if from_anaconda {
            generate_fstab_editor(unit_dir)?;
            return Ok(true);
        }
    }
    Ok(false)
}

pub(crate) fn enable_unit(unitdir: &Dir, name: &str, target: &str) -> Result<()> {
    let wants = Utf8PathBuf::from(format!("{target}.wants"));
    unitdir
        .create_dir_all(&wants)
        .with_context(|| format!("Creating {wants}"))?;
    let source = format!("/usr/lib/systemd/system/{name}");
    let target = wants.join(name);
    unitdir.remove_file_optional(&target)?;
    unitdir
        .symlink_contents(&source, &target)
        .with_context(|| format!("Writing {name}"))?;
    Ok(())
}

/// Enable our units
pub(crate) fn unit_enablement_impl(sysroot: &Dir, unit_dir: &Dir) -> Result<()> {
    for unit in [STATUS_ONBOOT_UNIT, STATUS_PATH_UNIT] {
        enable_unit(unit_dir, unit, MULTI_USER_TARGET)?;
    }

    if sysroot.try_exists(DESTRUCTIVE_CLEANUP)? {
        tracing::debug!("Found {DESTRUCTIVE_CLEANUP}");
        enable_unit(unit_dir, CLEANUP_UNIT, MULTI_USER_TARGET)?;
    } else {
        tracing::debug!("Didn't find {DESTRUCTIVE_CLEANUP}");
    }

    Ok(())
}

/// Main entrypoint for the generator
pub(crate) fn generator(root: &Dir, unit_dir: &Dir) -> Result<()> {
    // Detect composefs and ostree once, reuse across all blocks below.
    //
    // composefs always uses overlayfs, so check the filesystem magic first as
    // a cheap gate.  Then inspect the mount source to distinguish regular
    // composefs ("composefs:<digest>") from transient ("transient:composefs=<digest>").
    let is_overlayfs = rustix::fs::fstatfs(root.as_fd())?.f_type == libc::OVERLAYFS_SUPER_MAGIC;
    let root_source = if is_overlayfs {
        match bootc_mount::inspect_filesystem(camino::Utf8Path::new("/")) {
            Ok(fs) => Some(fs.source),
            Err(e) => {
                tracing::debug!("Could not inspect root filesystem: {e:#}");
                None
            }
        }
    } else {
        None
    };
    let root_is_transient = root_source
        .as_deref()
        .is_some_and(|s| s.starts_with("transient:composefs="));
    let is_composefs = root_is_transient
        || root_source
            .as_deref()
            .is_some_and(|s| s.starts_with("composefs:"));
    let is_ostree = root.try_exists(OSTREE_BOOTED)?;

    // === Relabel unit: runs for transient composefs boots (native or ostree) ===
    // Must be before the ostree-booted guard because native composefs boots do
    // not write /run/ostree-booted, but still need the relabel unit when any
    // transient overlay is active.
    //
    // Two triggering conditions, detected independently:
    //
    // 1. Transient root: the initramfs sets the overlay source to
    //    "transient:composefs=<digest>" in /proc/self/mountinfo.  Detected
    //    via root_is_transient above.
    //
    // 2. Transient /etc: this is mounted by bootc-root-setup.service
    //    which runs *after* the generator, so fstatvfs would see the read-only
    //    composefs at generator time.  Read setup-root-conf.toml directly from
    //    the booted image instead.
    if is_composefs {
        let submounts_are_transient = bootc_initramfs_setup::config_has_transient_submounts(
            std::path::Path::new(bootc_initramfs_setup::SETUP_ROOT_CONF_PATH),
        );
        if root_is_transient || submounts_are_transient {
            tracing::debug!(
                root_is_transient,
                submounts_are_transient,
                "Transient overlay detected; generating relabel unit"
            );
            generate_transient_overlay_relabel(unit_dir)?;
        }
    }

    // === Shadow sync unit: runs for ALL bootc systems (native composefs or ostree) ===
    // Must be before the ostree-booted guard because native composefs boots do
    // not write /run/ostree-booted, but still need the shadow sync to clean up
    // stale shadow/gshadow entries (the rechunk scenario).  Gate on either a
    // composefs mount source (native composefs boot) or the ostree-booted marker.
    if is_composefs || is_ostree {
        let updated = shadow_sync_generator_impl(root, unit_dir)?;
        tracing::trace!("Enabled shadow sync: {updated}");
    }

    // === Early /var/lib/systemd: native composefs boots only ===
    // On ostree boots, ostree-remount.service provides
    //   Before=systemd-tmpfiles-setup.service
    //   Before=systemd-random-seed.service
    // which (together with the generated var.mount unit) ensures tmpfiles
    // creates /var/lib/systemd before any service tries to use it.
    //
    // On native composefs boots neither ostree-remount nor a var.mount unit
    // exist, so systemd-tmpfiles-setup and systemd-random-seed race.  If
    // the container image ships a sparse /var (common after the var-tmpfiles
    // lint), /var/lib/systemd may not exist yet when random-seed starts,
    // causing an SELinux denial or ENOENT.
    //
    // Fix: create /var/lib/systemd from a unit with random-seed's own early
    // ordering.  Ordering all of systemd-tmpfiles-setup (which runs after
    // local-fs.target) before random-seed instead creates an ordering cycle
    // whenever local-fs.target needs random-seed, as with a random-key
    // encrypted swap and tmp.mount (After=swap.target).
    if is_composefs && !is_ostree {
        generate_early_tmpfiles(unit_dir)?;
    }

    aboot_generator_impl(root, unit_dir)?;

    // === Ostree-specific generator logic ===
    // Only run on ostree systems (native composefs boots skip below).
    if !root.try_exists(OSTREE_BOOTED)? {
        return Ok(());
    }

    let Some(ref sysroot) = root.open_dir_optional("sysroot")? else {
        return Ok(());
    };

    unit_enablement_impl(sysroot, unit_dir)?;

    // Only run for overlayfs roots (composefs mounts an overlay, regular or transient).
    let st = rustix::fs::fstatfs(root.as_fd())?;
    if st.f_type != libc::OVERLAYFS_SUPER_MAGIC {
        tracing::trace!("Root is not overlayfs");
        return Ok(());
    }

    // The fstab editor only applies to read-only composefs roots (not transient).
    let st = rustix::fs::fstatvfs(root.as_fd())?;
    if !st.f_flag.contains(StatVfsMountFlags::RDONLY) {
        tracing::trace!("Root is writable, skipping fstab generator");
        return Ok(());
    }

    let updated = fstab_generator_impl(root, unit_dir)?;
    tracing::trace!("Generated fstab: {updated}");

    Ok(())
}

/// Enable the statically-installed shadow sync unit by symlinking it into
/// `sysinit.target.wants/` in the generator output directory.
///
/// The unit file itself lives at `/usr/lib/systemd/system/bootc-sysusers-shadow-sync.service`
/// and is shipped with bootc; the generator only performs conditional enablement.
///
/// We check existence of `/etc/shadow` rather than writability because systemd
/// sandboxes generators in a private read-only mount namespace (see
/// `systemd.generator(7)`), so any writability check would always fail even
/// though `/etc` will be on its own writable mount by the time the service
/// actually runs.  The caller already gates on the ostree-booted marker,
/// which guarantees we are on a bootc system where `/etc` is writable at
/// service-run time.
#[context("shadow sync generator")]
pub(crate) fn shadow_sync_generator_impl(root: &Dir, unit_dir: &Dir) -> Result<bool> {
    if !root.try_exists("etc/shadow")? {
        tracing::trace!("/etc/shadow not found, skipping shadow sync");
        return Ok(false);
    }

    tracing::debug!("/etc/shadow found, enabling {SHADOW_SYNC_UNIT}");
    enable_unit(unit_dir, SHADOW_SYNC_UNIT, "sysinit.target")?;
    Ok(true)
}

fn aboot_generator_impl(root: &Dir, unit_dir: &Dir) -> Result<bool> {
    let Some(cmdline) = root.read_to_string_optional("proc/cmdline")? else {
        return Ok(false);
    };
    let Some(cmdline) = ComposefsCmdline::find_in_cmdline(&Cmdline::from(cmdline.as_str()))? else {
        return Ok(false);
    };
    let Some(sysroot) = root.open_dir_optional("sysroot")? else {
        return Ok(false);
    };
    if read_boot_type(&sysroot, &cmdline.digest)? != Some(BootType::Aboot) {
        return Ok(false);
    }
    enable_unit(unit_dir, ABOOT_RECONCILE_SERVICE, MULTI_USER_TARGET)?;
    Ok(true)
}

/// Parse /etc/fstab and check if the root mount is out of sync with the composefs
/// state, and if so, fix it.
fn generate_fstab_editor(unit_dir: &Dir) -> Result<()> {
    unit_dir.atomic_write(
        EDIT_UNIT,
        "[Unit]\n\
DefaultDependencies=no\n\
After=systemd-fsck-root.service\n\
Before=local-fs-pre.target local-fs.target shutdown.target systemd-remount-fs.service\n\
\n\
[Service]\n\
Type=oneshot\n\
RemainAfterExit=yes\n\
ExecStart=bootc internals fixup-etc-fstab\n\
",
    )?;
    let target = "local-fs-pre.target.wants";
    unit_dir.create_dir_all(target)?;
    unit_dir.symlink(&format!("../{EDIT_UNIT}"), &format!("{target}/{EDIT_UNIT}"))?;
    Ok(())
}

/// On native composefs boots (no ostree-remount), ensure /var/lib/systemd
/// exists before services that need it.
///
/// Without this, systemd-tmpfiles-setup and systemd-random-seed race: both
/// are wanted by sysinit.target with no ordering between them.  If the
/// container image has a sparse /var (e.g. after `rm -rf /var/lib` for the
/// var-tmpfiles lint), /var/lib/systemd won't exist when random-seed starts.
/// A .mount unit (e.g. var-lib-nfs-rpc_pipefs.mount) may even create
/// /var/lib with an unlabeled_t SELinux context before policy loads, causing
/// an AVC denial when random-seed tries to mkdir /var/lib/systemd.
///
/// The generated unit runs `systemd-tmpfiles` for just /var/lib/systemd,
/// ordered only after what random-seed itself is ordered after, so it can't
/// add an ordering cycle; see bootc-dev/bootc#2624.
///
/// On ostree boots, ostree-remount.service already provides this ordering.
fn generate_early_tmpfiles(unit_dir: &Dir) -> Result<()> {
    unit_dir.atomic_write(
        EARLY_TMPFILES_UNIT,
        include_str!("units/bootc-early-tmpfiles.service"),
    )?;
    let wants = format!("{SYSINIT_TARGET}.wants");
    unit_dir.create_dir_all(&wants)?;
    let link = format!("{wants}/{EARLY_TMPFILES_UNIT}");
    unit_dir.remove_file_optional(&link)?;
    unit_dir.symlink(&format!("../{EARLY_TMPFILES_UNIT}"), &link)?;
    tracing::debug!("Generated {EARLY_TMPFILES_UNIT} for composefs boot");
    Ok(())
}

/// Generate a oneshot service that relabels the transient overlay inode
/// after SELinux policy loads, fixing the tmpfs_t label SELinux assigns to
/// overlay upper-dir inodes at policy-load time.
fn generate_transient_overlay_relabel(unit_dir: &Dir) -> Result<()> {
    unit_dir.atomic_write(
        TRANSIENT_RELABEL_UNIT,
        include_str!("units/bootc-early-overlay-relabel.service"),
    )?;
    let wants = format!("{SYSINIT_TARGET}.wants");
    unit_dir.create_dir_all(&wants)?;
    unit_dir.symlink(
        &format!("../{TRANSIENT_RELABEL_UNIT}"),
        &format!("{wants}/{TRANSIENT_RELABEL_UNIT}"),
    )?;
    Ok(())
}

/// Relabel transient overlay mount point inodes using the running SELinux policy.
/// Called by the generated bootc-early-overlay-relabel.service oneshot to fix
/// the tmpfs_t label that fs_use_trans assigns to overlay upper-dir inodes at
/// policy-load time.  Each of /, /etc, /var is relabelled iff it is a writable
/// overlayfs (i.e. a transient overlay, not the read-only composefs).
pub(crate) fn relabel_overlay_mountpoints() -> Result<()> {
    let policy = ostree::SePolicy::new(&gio::File::for_path("/"), gio::Cancellable::NONE)
        .context("Loading SELinux policy")?;
    for path in ["/", "/etc", "/var"] {
        let dir = Dir::open_ambient_dir(path, cap_std::ambient_authority())
            .with_context(|| format!("Opening {path}"))?;
        let st = rustix::fs::fstatfs(dir.as_fd())?;
        if st.f_type != libc::OVERLAYFS_SUPER_MAGIC {
            tracing::trace!("{path} is not an overlayfs mount, skipping relabel");
            continue;
        }
        let stv = rustix::fs::fstatvfs(dir.as_fd())?;
        if stv.f_flag.contains(StatVfsMountFlags::RDONLY) {
            tracing::trace!("{path} is a read-only overlayfs (composefs), skipping relabel");
            continue;
        }
        let metadata = dir.metadata(".").with_context(|| format!("stat {path}"))?;
        crate::lsm::relabel(
            &dir,
            &metadata,
            Utf8Path::new("."),
            Some(Utf8Path::new(path)),
            &policy,
        )
        .with_context(|| format!("Relabelling {path}"))?;
        tracing::debug!("Relabelled {path}");
    }
    Ok(())
}

#[cfg(test)]
mod tests {
    use camino::Utf8Path;

    use super::*;

    fn fixture() -> Result<cap_std_ext::cap_tempfile::TempDir> {
        let tempdir = cap_std_ext::cap_tempfile::tempdir(cap_std::ambient_authority())?;
        tempdir.create_dir("etc")?;
        tempdir.create_dir("run")?;
        tempdir.create_dir("sysroot")?;
        tempdir.create_dir_all("run/systemd/system")?;
        Ok(tempdir)
    }

    #[test]
    fn aboot_reconcile_enablement() -> Result<()> {
        let digest = "ab".repeat(64);
        for boot_type in [None, Some("bls"), Some("uki"), Some("aboot")] {
            let root = fixture()?;
            let units = root.open_dir("run/systemd/system")?;
            assert!(!aboot_generator_impl(&root, &units)?);
            root.create_dir("proc")?;
            root.atomic_write(
                "proc/cmdline",
                format!("composefs=?{digest} androidboot.slot_suffix=_a"),
            )?;
            if let Some(boot_type) = boot_type {
                let path = format!(
                    "sysroot/{}/{digest}",
                    crate::composefs_consts::STATE_DIR_RELATIVE
                );
                root.create_dir_all(&path)?;
                root.atomic_write(
                    format!("{path}/{digest}.origin"),
                    format!("[boot]\nboot_type={boot_type}\n"),
                )?;
            }
            let expected = boot_type == Some("aboot");
            for _ in 0..2 {
                assert_eq!(aboot_generator_impl(&root, &units)?, expected);
            }
            let link = format!("{MULTI_USER_TARGET}.wants/{ABOOT_RECONCILE_SERVICE}");
            if expected {
                assert_eq!(
                    units.read_link_contents(link)?,
                    std::path::Path::new("/usr/lib/systemd/system").join(ABOOT_RECONCILE_SERVICE)
                );
            } else {
                assert_eq!(units.entries()?.count(), 0);
            }
        }
        Ok(())
    }

    #[test]
    fn aboot_reconcile_with_dual_format_cmdline() -> Result<()> {
        use composefs_ctl::composefs::erofs::format::FormatVersion;
        use composefs_ctl::composefs::fsverity::{FsVerityHashValue, Sha512HashValue};

        let root = fixture()?;
        let units = root.open_dir("run/systemd/system")?;
        root.create_dir("proc")?;
        let v1 = Sha512HashValue::from_hex("ab".repeat(64))?;
        let v2 = Sha512HashValue::from_hex("cd".repeat(64))?;
        root.atomic_write(
            "proc/cmdline",
            format!(
                "{} {} androidboot.slot_suffix=_a",
                crate::bootc_composefs::status::build_composefs_karg(
                    v1.clone(),
                    FormatVersion::V1,
                    false,
                ),
                crate::bootc_composefs::status::build_composefs_karg(v2, FormatVersion::V2, false,),
            ),
        )?;
        let digest = v1.to_hex();
        let path = format!(
            "sysroot/{}/{digest}",
            crate::composefs_consts::STATE_DIR_RELATIVE
        );
        root.create_dir_all(&path)?;
        root.atomic_write(
            format!("{path}/{digest}.origin"),
            "[boot]\nboot_type=aboot\n",
        )?;

        assert!(aboot_generator_impl(&root, &units)?);
        Ok(())
    }

    #[test]
    fn test_generator_no_fstab() -> Result<()> {
        let tempdir = fixture()?;
        let unit_dir = &tempdir.open_dir("run/systemd/system")?;
        fstab_generator_impl(&tempdir, &unit_dir).unwrap();

        assert_eq!(unit_dir.entries()?.count(), 0);
        Ok(())
    }

    #[test]
    fn test_units() -> Result<()> {
        let tempdir = &fixture()?;
        let sysroot = &tempdir.open_dir("sysroot").unwrap();
        let unit_dir = &tempdir.open_dir("run/systemd/system")?;

        let verify = |wantsdir: &Dir, n: u32| -> Result<()> {
            assert_eq!(unit_dir.entries()?.count(), 1);
            let r = wantsdir.read_link_contents(STATUS_ONBOOT_UNIT)?;
            let r: Utf8PathBuf = r.try_into().unwrap();
            assert_eq!(r, format!("/usr/lib/systemd/system/{STATUS_ONBOOT_UNIT}"));
            assert_eq!(wantsdir.entries()?.count(), n as usize);
            anyhow::Ok(())
        };

        // Explicitly run this twice to test idempotency

        unit_enablement_impl(sysroot, &unit_dir).unwrap();
        unit_enablement_impl(sysroot, &unit_dir).unwrap();
        let wantsdir = &unit_dir.open_dir("multi-user.target.wants")?;
        verify(wantsdir, 2)?;
        assert!(
            wantsdir
                .symlink_metadata_optional(CLEANUP_UNIT)
                .unwrap()
                .is_none()
        );

        // Now create sysroot and rerun the generator
        unit_enablement_impl(sysroot, &unit_dir).unwrap();
        verify(wantsdir, 2)?;

        // Create the destructive stamp
        sysroot
            .create_dir_all(Utf8Path::new(DESTRUCTIVE_CLEANUP).parent().unwrap())
            .unwrap();
        sysroot.atomic_write(DESTRUCTIVE_CLEANUP, b"").unwrap();
        unit_enablement_impl(sysroot, unit_dir).unwrap();
        verify(wantsdir, 3)?;

        // And now the unit should be enabled
        assert!(
            wantsdir
                .symlink_metadata(CLEANUP_UNIT)
                .unwrap()
                .is_symlink()
        );

        Ok(())
    }

    #[cfg(test)]
    mod test {
        use super::*;

        use ostree_ext::container_utils::OSTREE_BOOTED;

        #[test]
        fn test_generator_fstab() -> Result<()> {
            let tempdir = fixture()?;
            let unit_dir = &tempdir.open_dir("run/systemd/system")?;
            // Should still be a no-op
            tempdir.atomic_write("etc/fstab", "# Some dummy fstab")?;
            fstab_generator_impl(&tempdir, &unit_dir).unwrap();
            assert_eq!(unit_dir.entries()?.count(), 0);

            // Also a no-op, not booted via ostree
            tempdir.atomic_write("etc/fstab", &format!("# {FSTAB_ANACONDA_STAMP}"))?;
            fstab_generator_impl(&tempdir, &unit_dir).unwrap();
            assert_eq!(unit_dir.entries()?.count(), 0);

            // Now it should generate
            tempdir.atomic_write(OSTREE_BOOTED, "ostree booted")?;
            fstab_generator_impl(&tempdir, &unit_dir).unwrap();
            assert_eq!(unit_dir.entries()?.count(), 2);

            Ok(())
        }

        #[test]
        fn test_transient_overlay_relabel_generated() -> Result<()> {
            let tempdir = fixture()?;
            let unit_dir = &tempdir.open_dir("run/systemd/system")?;

            // We can't fake fstatfs or findmnt, so call generate_transient_overlay_relabel directly.
            generate_transient_overlay_relabel(unit_dir)?;

            // The unit file must exist
            assert!(unit_dir.try_exists(TRANSIENT_RELABEL_UNIT)?);
            // The symlink in sysinit.target.wants must point at the generated unit
            let wants = format!("{SYSINIT_TARGET}.wants");
            let link = unit_dir.read_link_contents(format!("{wants}/{TRANSIENT_RELABEL_UNIT}"))?;
            let link: camino::Utf8PathBuf = link.try_into().unwrap();
            assert_eq!(link, format!("../{TRANSIENT_RELABEL_UNIT}"));
            // The unit must invoke bootc internals relabel-overlay-mountpoints
            let content = unit_dir.read_to_string(TRANSIENT_RELABEL_UNIT)?;
            assert!(
                content.contains("ExecStart=bootc internals relabel-overlay-mountpoints"),
                "unexpected unit content: {content}"
            );

            Ok(())
        }

        #[test]
        fn test_transient_overlay_relabel_idempotent() -> Result<()> {
            let tempdir = fixture()?;
            let unit_dir = &tempdir.open_dir("run/systemd/system")?;

            // Calling generate_transient_overlay_relabel twice must succeed
            generate_transient_overlay_relabel(unit_dir)?;
            // Second call: atomic_write overwrites the unit file; symlink already exists
            // (symlink won't be re-created because the dir already contains it).
            // The test just checks the call doesn't error.
            // We need to remove the old symlink first (same as how enable_unit does it).
            let wants = format!("{SYSINIT_TARGET}.wants");
            unit_dir.remove_file_optional(format!("{wants}/{TRANSIENT_RELABEL_UNIT}"))?;
            generate_transient_overlay_relabel(unit_dir)?;

            assert!(unit_dir.try_exists(TRANSIENT_RELABEL_UNIT)?);

            Ok(())
        }

        #[test]
        fn test_generator_fstab_idempotent() -> Result<()> {
            let anaconda_fstab = indoc::indoc! { "
#
# /etc/fstab
# Created by anaconda on Tue Mar 19 12:24:29 2024
#
# Accessible filesystems, by reference, are maintained under '/dev/disk/'.
# See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info.
#
# After editing this file, run 'systemctl daemon-reload' to update systemd
# units generated from this file.
#
# Updated by bootc-fstab-edit.service
UUID=715be2b7-c458-49f2-acec-b2fdb53d9089 /                       xfs     ro              0 0
UUID=341c4712-54e8-4839-8020-d94073b1dc8b /boot                   xfs     defaults        0 0
" };
            let tempdir = fixture()?;
            let unit_dir = &tempdir.open_dir("run/systemd/system")?;

            tempdir.atomic_write("etc/fstab", anaconda_fstab)?;
            tempdir.atomic_write(OSTREE_BOOTED, "ostree booted")?;
            let updated = fstab_generator_impl(&tempdir, &unit_dir).unwrap();
            assert!(!updated);
            assert_eq!(unit_dir.entries()?.count(), 0);

            Ok(())
        }

        #[test]
        fn test_generator_fstab_readonly_root() -> Result<()> {
            let anaconda_fstab = indoc::indoc! { "
# Created by anaconda
UUID=715be2b7-c458-49f2-acec-b2fdb53d9089 / xfs defaults,ro 0 0
" };
            let tempdir = fixture()?;
            let unit_dir = &tempdir.open_dir("run/systemd/system")?;

            tempdir.atomic_write("etc/fstab", anaconda_fstab)?;
            tempdir.atomic_write(OSTREE_BOOTED, "ostree booted")?;
            let updated = fstab_generator_impl(&tempdir, unit_dir)?;
            assert!(!updated);
            assert_eq!(unit_dir.entries()?.count(), 0);

            Ok(())
        }

        /// Values of every `key=` line in the unit, split on whitespace.
        fn unit_values<'a>(unit: &'a str, key: &str) -> Vec<&'a str> {
            unit.lines()
                .filter_map(|l| l.strip_prefix(key)?.strip_prefix('='))
                .flat_map(str::split_ascii_whitespace)
                .collect()
        }

        #[test]
        fn test_early_tmpfiles_unit() -> Result<()> {
            let tempdir = fixture()?;
            let unit_dir = &tempdir.open_dir("run/systemd/system")?;

            // Twice, to check it is idempotent
            for _ in 0..2 {
                generate_early_tmpfiles(unit_dir)?;
            }

            let unit = unit_dir.read_to_string(EARLY_TMPFILES_UNIT)?;
            assert_eq!(
                unit_values(&unit, "ExecStart"),
                ["systemd-tmpfiles", "--create", "--prefix=/var/lib/systemd"]
            );
            assert_eq!(
                unit_values(&unit, "Before"),
                [
                    "systemd-random-seed.service",
                    "systemd-tpm2-setup.service",
                    "sysinit.target",
                    "shutdown.target"
                ]
            );
            // Nothing beyond what systemd-random-seed.service is ordered
            // after itself: in particular not local-fs.target, which
            // random-seed may have to precede (bootc-dev/bootc#2624).
            assert_eq!(unit_values(&unit, "DefaultDependencies"), ["no"]);
            assert_eq!(unit_values(&unit, "After"), ["systemd-remount-fs.service"]);
            assert_eq!(
                unit_values(&unit, "RequiresMountsFor"),
                ["/var/lib/systemd"]
            );

            let link = unit_dir
                .read_link_contents(format!("{SYSINIT_TARGET}.wants/{EARLY_TMPFILES_UNIT}"))?;
            assert_eq!(link, std::path::Path::new("..").join(EARLY_TMPFILES_UNIT));

            Ok(())
        }

        #[test]
        fn test_shadow_sync_no_shadow() -> Result<()> {
            // No /etc/shadow => should not enable (boot detection is caller's job)
            let tempdir = fixture()?;
            let unit_dir = &tempdir.open_dir("run/systemd/system")?;
            let generated = shadow_sync_generator_impl(&tempdir, unit_dir)?;
            assert!(!generated);
            assert_eq!(unit_dir.entries()?.count(), 0);
            Ok(())
        }

        #[test]
        fn test_shadow_sync_enables_when_shadow_present() -> Result<()> {
            // /etc/shadow present => enables the static unit
            let tempdir = fixture()?;
            tempdir.atomic_write("etc/shadow", "root:*:18912:0:99999:7:::\n")?;
            let unit_dir = &tempdir.open_dir("run/systemd/system")?;
            let generated = shadow_sync_generator_impl(&tempdir, unit_dir)?;
            assert!(generated);
            // The generator creates a symlink in sysinit.target.wants/; check the
            // directory entry exists (symlink_contents creates an absolute-path symlink
            // that cap-std won't follow in a tempdir, so we check metadata directly).
            let wants = unit_dir.open_dir("sysinit.target.wants")?;
            let meta = wants.symlink_metadata(SHADOW_SYNC_UNIT)?;
            assert!(meta.is_symlink(), "expected symlink for {SHADOW_SYNC_UNIT}");
            Ok(())
        }

        /// Verify that generator() enables the shadow sync unit on traditional
        /// ostree boots (tmpfs root, OSTREE_BOOTED marker present).
        #[test]
        fn test_generator_shadow_sync_on_non_composefs() -> Result<()> {
            let tempdir = fixture()?;
            tempdir.atomic_write(OSTREE_BOOTED, "")?;
            tempdir.atomic_write("etc/shadow", "root:*:18912:0:99999:7:::\n")?;
            let unit_dir = &tempdir.open_dir("run/systemd/system")?;
            generator(&tempdir, unit_dir)?;
            let wants = unit_dir.open_dir("sysinit.target.wants")?;
            let meta = wants.symlink_metadata(SHADOW_SYNC_UNIT)?;
            assert!(
                meta.is_symlink(),
                "shadow sync unit must be enabled on non-composefs ostree systems"
            );
            Ok(())
        }
    }
}