prepare-root: bind mount var under deployment for compatibility

src/switchroot/ostree-prepare-root.c

@@ -610,13 +610,23 @@ main (int argc, char *argv[])
 
   const char *var_dir = OTCORE_RUN_OSTREE_PRIVATE "/var";
 
-  /* Bind-mount /var, and remount as writable. */
-  if (mkdirat (AT_FDCWD, var_dir, 0) < 0)
-    err (EXIT_FAILURE, "failed to mkdir %s", var_dir);
-  if (mount ("../../var", var_dir, NULL, MS_BIND | MS_SILENT, NULL) < 0)
-    err (EXIT_FAILURE, "failed to prepare /var bind-mount at %s", var_dir);
-  if (mount (var_dir, var_dir, NULL, MS_BIND | MS_REMOUNT | MS_SILENT, NULL) < 0)
-    err (EXIT_FAILURE, "failed to make writable /var bind-mount at %s", var_dir);
+  /* Prepare /var.
+   * When a read-only sysroot is configured, this adds a dedicated bind-mount (to itself)
+   * so that the stateroot location stays writable. */
+  if (sysroot_readonly)
+    {
+      /* Bind-mount /var (at stateroot path), and remount as writable. */
+      if (mount ("../../var", "../../var", NULL, MS_BIND | MS_SILENT, NULL) < 0)
+        err (EXIT_FAILURE, "failed to prepare /var bind-mount at %s", srcpath);
+      if (mount ("../../var", "../../var", NULL, MS_BIND | MS_REMOUNT | MS_SILENT, NULL) < 0)
+        err (EXIT_FAILURE, "failed to make writable /var bind-mount at %s", srcpath);
+    }
+
+  /* Bind-mount var to var_dir */
+  if (mount ("../../var", var_dir, MS_BIND | MS_SILENT, NULL) < 0)
+    err (EXIT_FAILURE, "failed to bind mount %s", var_dir);
+  if (mount (NULL, var_dir, MS_SLAVE | MS_SILENT, NULL) < 0)
+    err (EXIT_FAILURE, "failed to change %s to slave mount", var_dir);
 
     /* When running under systemd, /var will be handled by a 'var.mount' unit outside
      * of initramfs.