switchroot: Stop making /sysroot mount private

[dbnicholson]

Back in 2b8d586, /sysroot was changed to be a private mount so that
submounts of /var do not propagate back to the stateroot /var. That's
laudible, but it makes /sysroot different than every other shared mount
in the root namespace. In particular, it means that submounts of
/sysroot do not propagate into separate mount namespaces.

Rather than make /sysroot private, make /var a slave+shared mount so
that it receives mount events from /sysroot but not vice versa. That
achieves the same effect of preventing /var submount events from
propagating back to /sysroot while allowing /sysroot mount events to
propagate forward like every other system mount.

The mount propagation flags are applied as options in the generated
var.mount unit. This depends on a mount(8) feature that has been present
since util-linux 2.23. That's available in RHEL 7 and every non-EOL
Debian and Ubuntu release. Applying the propagation from var.mount fixes
a small race, too. Previously, if a /var submount was added before
/sysroot was made private, it would have propagated back into /sysroot.
That was possible since ostree-remount.service orders itself after
var.mount but not before any /var submounts.

Fixes: #2086

---

I included the added test separately in the first commit so you can see the difference in behavior.

[dbnicholson]

Here's a comparison of mount propagation before and after this change using a cosa built VM. I mounted a tmpfs on /var/foo and /sysroot/boot to compare how those would propagate.

Current:

[core@cosa-devsh ~]$ findmnt -l -o TARGET,PROPAGATION,OPT-FIELDS
TARGET                                   PROPAGATION OPT-FIELDS
/sysroot                                 private     
/                                        shared      shared:1
/etc                                     shared      shared:2
/usr                                     shared      shared:3
/sysroot/ostree/deploy/fedora-coreos/var private     
/dev                                     shared      shared:6
/dev/shm                                 shared      shared:7
/dev/pts                                 shared      shared:8
/sys                                     shared      shared:9
/sys/kernel/security                     shared      shared:10
/sys/fs/cgroup                           shared      shared:11
/sys/fs/pstore                           shared      shared:12
/sys/fs/bpf                              shared      shared:13
/sys/kernel/config                       shared      shared:14
/proc                                    shared      shared:16
/run                                     shared      shared:17
/sys/fs/selinux                          shared      shared:15
/proc/sys/fs/binfmt_misc                 shared      shared:18
/dev/hugepages                           shared      shared:19
/dev/mqueue                              shared      shared:20
/sys/kernel/debug                        shared      shared:21
/sys/kernel/tracing                      shared      shared:22
/tmp                                     shared      shared:23
/sys/fs/fuse/connections                 shared      shared:24
/var                                     shared      shared:5
/boot                                    shared      shared:84
/var/mnt/workdir-tmp                     shared      shared:27
/var/mnt/workdir                         shared      shared:91
/var/lib/nfs/rpc_pipefs                  shared      shared:95
/run/user/1000                           shared      shared:401
/var/foo                                 shared      shared:362
/sysroot/boot                            private     

With this PR:

[core@cosa-devsh ~]$ findmnt -l -o TARGET,PROPAGATION,OPT-FIELDS
TARGET                                   PROPAGATION  OPT-FIELDS
/sysroot                                 shared       shared:4
/                                        shared       shared:1
/etc                                     shared       shared:2
/usr                                     shared       shared:3
/sysroot/ostree/deploy/fedora-coreos/var shared       shared:5
/dev                                     shared       shared:6
/dev/shm                                 shared       shared:7
/dev/pts                                 shared       shared:8
/sys                                     shared       shared:9
/sys/kernel/security                     shared       shared:10
/sys/fs/cgroup                           shared       shared:11
/sys/fs/pstore                           shared       shared:12
/sys/fs/bpf                              shared       shared:13
/sys/kernel/config                       shared       shared:14
/proc                                    shared       shared:16
/run                                     shared       shared:17
/sys/fs/selinux                          shared       shared:15
/proc/sys/fs/binfmt_misc                 shared       shared:18
/dev/hugepages                           shared       shared:19
/dev/mqueue                              shared       shared:20
/sys/kernel/debug                        shared       shared:21
/sys/kernel/tracing                      shared       shared:22
/tmp                                     shared       shared:23
/sys/fs/fuse/connections                 shared       shared:24
/var                                     shared,slave shared:58 master:5
/boot                                    shared       shared:86
/var/lib/nfs/rpc_pipefs                  shared       shared:163
/run/user/1000                           shared       shared:379
/var/foo                                 shared       shared:432
/sysroot/boot                            shared       shared:442

[cgwalters]

I think I need some quality time with this, but overall makes sense to me enough that I think it's better to merge and give this some soak time in git main, for the very few people that run from git main (happens to include my workstation though).

Thanks for this!