manifest/raw_bootc: Label / and /boot before running bootc install

[jbtrystram]

When SELinux is enabled, insert a few stages before running bootc install that will make sure the root and boot mount points are labelled. This avoid files under /sysroot created by bootc to be unlabeled_t and this makes sure files under /boot created by bootupd inherit the correct boot_t label.

See #2494
Assisted-by: Opencode.ai <Opus 4.6>

[brlane-rht]

Which image types are you seeing a problem with? Please provide a reproducer if possible. Also, have you tested this? I gave it a quick try and it blows up in your new mkdir stage because mounts already create the mountpoint, not need to do it manually.

[jbtrystram]

@brlane-rht thanks for the review ! I fixed the PR. The mkdir stage is still here because we want to label the mountpoint without anything mounted. So when further files are created in the mounted FS, they inherit the correct SELinux label from the mountpoint.

I am building fedora CoreOS using blueprints defined here : https://github.com/joelcapitao/bib-fcos-experimentation/

So for a QEMU image for x86 I have the following blueprint :

name = "Fedora CoreOS"

[customizations.ignition.firstboot]
empty = true

[customizations.kernel]
append = "mitigations=auto,nosmt $ignition_firstboot ignition.platform.id=qemu console=tty0 console=ttyS0,115200n8"

I am building the image with :

TARGET_FCOS_IMAGE=quay.io/fedora/fedora-coreos:rawhide
BUILDER=quay.io/bootc-devel/fedora-bootc-rawhide-standard

sudo podman run --rm --privileged \
           --network=none \
           -v /var/lib/containers/storage:/var/lib/containers/storage \
           -v ./output:/output \
           -v .:/srv \
           quay.io/jbtrystramtestimages/ib-cli:pr-selinux-labels build qcow2 \
             --bootc-build-ref $BUILDER \
             --bootc-ref $TARGET_FCOS_IMAGE \
             --output-dir fedora-coreos \
             --output-name fedora-coreos-rawhide \
             --with-buildlog \
             --with-manifest \
             --with-metrics \
             --blueprint /srv/blueprints/generated/qemu-x86_64.toml

With this PR, the resulting labels are corrects :

cosa run --qemu-image output/fedora-coreos/fedora-coreos-rawhide.qcow2 -x 'ls -lZ /sysroot'                                                          

drwxr-xr-x. 2 root root system_u:object_r:boot_t:s0  6 Jul 16 13:39 boot
drwxr-xr-x. 6 root root system_u:object_r:usr_t:s0  75 Jul 16 13:43 ostree

# And /boot : 
lrwxrwxrwx. 1 root root unconfined_u:object_r:boot_t:s0       1 Jul 16 13:39 boot -> .
-rw-r--r--. 1 root root unconfined_u:object_r:boot_t:s0    2154 Jul 16 13:39 bootupd-state.json
drwxr-xr-x. 2 root root system_u:object_r:boot_t:s0        1024 Jul 16 13:39 efi
drwxr-xr-x. 5 root root unconfined_u:object_r:boot_t:s0    1024 Jul 16 13:48 grub2
lrwxrwxrwx. 1 root root unconfined_u:object_r:boot_t:s0       8 Jul 16 13:39 loader -> loader.1
drwxr-xr-x. 3 root root unconfined_u:object_r:boot_t:s0    1024 Jul 16 13:39 loader.1
drwx------. 2 root root system_u:object_r:lost_found_t:s0 12288 Jul 16 13:39 lost+found
drwxr-xr-x. 3 root root unconfined_u:object_r:boot_t:s0    1024 Jul 16 13:39 ostree

Here is the generated manifest : fedora-coreos-rawhide.osbuild-manifest.json

See #2494