V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

func/cdi_4000_debootstrap/4010_prepare_mounts.sh

@@ -60,103 +60,65 @@ prepare_mounts() {
 #-------------------------------------------------------------------------------
 # Helpers: mount detection and conditional umount (idempotent).
 
-cdi_is_mounted() {
+# Detect if PATH is an exact mountpoint (not just covered by a parent mount).
+cdi_is_mountpoint() {
   declare path="${1:?target path required}"
 
-  # Prefer findmnt, fall back to mountpoint, then /proc/self/mountinfo.
-  if command -v findmnt >/dev/null 2>&1; then
-
-    if findmnt -rn --target "${path}" >/dev/null 2>&1; then
-
-      return 0
-
-    else
-
-      return 1
-
-    fi
-
-  fi
-
   if command -v mountpoint >/dev/null 2>&1; then
 
-    if mountpoint -q -- "${path}"; then
+    mountpoint -q -- "${path}"
 
-      return 0
+    return $?
-
-    else
-
-      return 1
-
-    fi
 
   fi
 
-  # Last resort: grep mountinfo.
+  if command -v findmnt >/dev/null 2>&1; then
-  if grep -Fq " $(readlink -f -- "${path}") " /proc/self/mountinfo 2>/dev/null; then
 
-    return 0
+    # Exact mountpoint check (not -T which matches enclosing mounts).
+    findmnt -rn --mountpoint "${path}" >/dev/null 2>&1 && return 0 || return 1
 
   fi
 
-  return 1
+  # Fallback: parse /proc/self/mountinfo (field 5 = mountpoint, no spaces here).
+  awk -v p="${path}" '$5==p {found=1; exit} END{exit (found?0:1)}' /proc/self/mountinfo 2>/dev/null
 }
 
-cdi_umount_if_mounted() {
+cdi_umount_if_mountpoint() {
   declare path="${1:?target path required}"
 
-  if cdi_is_mounted "${path}"; then
+  if cdi_is_mountpoint "${path}"; then
 
-    # Lazy umount to avoid EBUSY in edge cases.
+    umount -l -- "${path}" || { printf 'ERROR: cannot umount %s\n' "${path}" >&2; return 128; }
-    if ! umount -l -- "${path}"; then
-
-      printf 'ERROR: cannot umount %s\n' "${path}" >&2
-      return 128
-
-    fi
 
   fi
 
   return 0
 }
 
-# ENTER: mask '/sys' without a host hardware view.
 cdi_sys_mask_enter() {
   declare state="/run/.ciss_sysmask"
   mkdir -p /run
 
-  # Remember the pre-state, so we can restore exactly what was present.
+  # Record only true mountpoints.
   declare had_sys="0"
   declare had_cg="0"
 
-  if cdi_is_mounted /sys; then
+  cdi_is_mountpoint /sys && had_sys="1"
-    had_sys="1"
+  cdi_is_mountpoint /sys/fs/cgroup && had_cg="1"
-  fi
-
-  if cdi_is_mounted /sys/fs/cgroup; then
-    had_cg="1"
-  fi
 
   printf 'HAD_SYS=%s\nHAD_CG=%s\n' "${had_sys}" "${had_cg}" >| "${state}"
 
-  # Unmount existing mounts if present; do not error if they were absent.
+  # Unmount only if exact mountpoints exist.
-  cdi_umount_if_mounted /sys/fs/cgroup || return 129
+  cdi_umount_if_mountpoint /sys/fs/cgroup || return 129
-  cdi_umount_if_mounted /sys || return 130
+  cdi_umount_if_mountpoint /sys || return 130
 
-  # Mask '/sys' with a tiny read-only tmpfs; directory must exist.
   mkdir -p /sys
-
+  mount -t tmpfs -o ro,nosuid,nodev,noexec,mode=0555,size=1M tmpfs /sys \
-  if ! mount -t tmpfs -o ro,nosuid,nodev,noexec,mode=0555,size=1M tmpfs /sys; then
+    || { printf 'ERROR: cannot mount tmpfs on /sys\n' >&2; return 131; }
-
-    printf 'ERROR: cannot mount tmpfs on /sys\n' >&2
-    return 131
-
-  fi
 
   return 0
 }
 
-# LEAVE: restore pre-enter state exactly as it was.
 cdi_sys_mask_leave() {
   declare state="/run/.ciss_sysmask"
   declare had_sys="0"
@@ -172,32 +134,21 @@ cdi_sys_mask_leave() {
 
   fi
 
-  # Drop the mask (tmpfs on /sys) if still mounted.
+  # Drop the mask if present (it is an exact mountpoint).
-  cdi_umount_if_mounted /sys || return 132
+  cdi_umount_if_mountpoint /sys || return 132
 
-  # Restore '/sys' only if it was mounted before entering.
   if [[ "${had_sys}" == "1" ]]; then
 
-    if ! mount -t sysfs -o nosuid,nodev,noexec sysfs /sys; then
+    mount -t sysfs -o nosuid,nodev,noexec sysfs /sys \
-
+      || { printf 'ERROR: cannot mount sysfs on /sys\n' >&2; return 133; }
-      printf 'ERROR: cannot mount sysfs on /sys\n' >&2
-      return 133
-
-    fi
 
   fi
 
-  # Restore 'cgroup2' only if it was mounted before entering.
   if [[ "${had_cg}" == "1" ]]; then
 
     mkdir -p /sys/fs/cgroup
-
+    mount -t cgroup2 -o rw,nosuid,nodev,noexec,relatime cgroup2 /sys/fs/cgroup \
-    if ! mount -t cgroup2 -o rw,nosuid,nodev,noexec,relatime cgroup2 /sys/fs/cgroup; then
+      || { printf 'ERROR: cannot mount cgroup2 on /sys/fs/cgroup\n' >&2; return 134; }
-
-      printf 'ERROR: cannot mount cgroup2 on /sys/fs/cgroup\n' >&2
-      return 134
-
-    fi
 
   fi