Merge branch 'next/patch' of github.com:Start9Labs/start-os into next/minor

core/startos/src/disk/mount/backup.rs

@@ -0,0 +1,262 @@
+use std::path::{Path, PathBuf};
+
+use color_eyre::eyre::eyre;
+use helpers::AtomicFile;
+use tokio::io::AsyncWriteExt;
+use tracing::instrument;
+
+use super::filesystem::ecryptfs::EcryptFS;
+use super::guard::{GenericMountGuard, TmpMountGuard};
+use super::util::{bind, unmount};
+use crate::auth::check_password;
+use crate::backup::target::BackupInfo;
+use crate::disk::mount::filesystem::ReadWrite;
+use crate::disk::util::EmbassyOsRecoveryInfo;
+use crate::middleware::encrypt::{decrypt_slice, encrypt_slice};
+use crate::s9pk::manifest::PackageId;
+use crate::util::serde::IoFormat;
+use crate::util::FileLock;
+use crate::volume::BACKUP_DIR;
+use crate::{Error, ErrorKind, ResultExt};
+
+pub struct BackupMountGuard<G: GenericMountGuard> {
+    backup_disk_mount_guard: Option<G>,
+    encrypted_guard: Option<TmpMountGuard>,
+    enc_key: String,
+    pub unencrypted_metadata: EmbassyOsRecoveryInfo,
+    pub metadata: BackupInfo,
+}
+impl<G: GenericMountGuard> BackupMountGuard<G> {
+    fn backup_disk_path(&self) -> &Path {
+        if let Some(guard) = &self.backup_disk_mount_guard {
+            guard.as_ref()
+        } else {
+            unreachable!()
+        }
+    }
+
+    #[instrument(skip_all)]
+    pub async fn mount(backup_disk_mount_guard: G, password: &str) -> Result<Self, Error> {
+        let backup_disk_path = backup_disk_mount_guard.as_ref();
+        let unencrypted_metadata_path =
+            backup_disk_path.join("EmbassyBackups/unencrypted-metadata.cbor");
+        let mut unencrypted_metadata: EmbassyOsRecoveryInfo =
+            if tokio::fs::metadata(&unencrypted_metadata_path)
+                .await
+                .is_ok()
+            {
+                IoFormat::Cbor.from_slice(
+                    &tokio::fs::read(&unencrypted_metadata_path)
+                        .await
+                        .with_ctx(|_| {
+                            (
+                                crate::ErrorKind::Filesystem,
+                                unencrypted_metadata_path.display().to_string(),
+                            )
+                        })?,
+                )?
+            } else {
+                Default::default()
+            };
+        let enc_key = if let (Some(hash), Some(wrapped_key)) = (
+            unencrypted_metadata.password_hash.as_ref(),
+            unencrypted_metadata.wrapped_key.as_ref(),
+        ) {
+            let wrapped_key =
+                base32::decode(base32::Alphabet::RFC4648 { padding: true }, wrapped_key)
+                    .ok_or_else(|| {
+                        Error::new(
+                            eyre!("failed to decode wrapped key"),
+                            crate::ErrorKind::Backup,
+                        )
+                    })?;
+            check_password(hash, password)?;
+            String::from_utf8(decrypt_slice(wrapped_key, password))?
+        } else {
+            base32::encode(
+                base32::Alphabet::RFC4648 { padding: false },
+                &rand::random::<[u8; 32]>()[..],
+            )
+        };
+
+        if unencrypted_metadata.password_hash.is_none() {
+            unencrypted_metadata.password_hash = Some(
+                argon2::hash_encoded(
+                    password.as_bytes(),
+                    &rand::random::<[u8; 16]>()[..],
+                    &argon2::Config::rfc9106_low_mem(),
+                )
+                .with_kind(crate::ErrorKind::PasswordHashGeneration)?,
+            );
+        }
+        if unencrypted_metadata.wrapped_key.is_none() {
+            unencrypted_metadata.wrapped_key = Some(base32::encode(
+                base32::Alphabet::RFC4648 { padding: true },
+                &encrypt_slice(&enc_key, password),
+            ));
+        }
+
+        let crypt_path = backup_disk_path.join("EmbassyBackups/crypt");
+        if tokio::fs::metadata(&crypt_path).await.is_err() {
+            tokio::fs::create_dir_all(&crypt_path).await.with_ctx(|_| {
+                (
+                    crate::ErrorKind::Filesystem,
+                    crypt_path.display().to_string(),
+                )
+            })?;
+        }
+        let encrypted_guard =
+            TmpMountGuard::mount(&EcryptFS::new(&crypt_path, &enc_key), ReadWrite).await?;
+
+        let metadata_path = encrypted_guard.as_ref().join("metadata.cbor");
+        let metadata: BackupInfo = if tokio::fs::metadata(&metadata_path).await.is_ok() {
+            IoFormat::Cbor.from_slice(&tokio::fs::read(&metadata_path).await.with_ctx(|_| {
+                (
+                    crate::ErrorKind::Filesystem,
+                    metadata_path.display().to_string(),
+                )
+            })?)?
+        } else {
+            Default::default()
+        };
+
+        Ok(Self {
+            backup_disk_mount_guard: Some(backup_disk_mount_guard),
+            encrypted_guard: Some(encrypted_guard),
+            enc_key,
+            unencrypted_metadata,
+            metadata,
+        })
+    }
+
+    pub fn change_password(&mut self, new_password: &str) -> Result<(), Error> {
+        self.unencrypted_metadata.password_hash = Some(
+            argon2::hash_encoded(
+                new_password.as_bytes(),
+                &rand::random::<[u8; 16]>()[..],
+                &argon2::Config::rfc9106_low_mem(),
+            )
+            .with_kind(crate::ErrorKind::PasswordHashGeneration)?,
+        );
+        self.unencrypted_metadata.wrapped_key = Some(base32::encode(
+            base32::Alphabet::RFC4648 { padding: false },
+            &encrypt_slice(&self.enc_key, new_password),
+        ));
+        Ok(())
+    }
+
+    #[instrument(skip_all)]
+    pub async fn mount_package_backup(
+        &self,
+        id: &PackageId,
+    ) -> Result<PackageBackupMountGuard, Error> {
+        let lock = FileLock::new(Path::new(BACKUP_DIR).join(format!("{}.lock", id)), false).await?;
+        let mountpoint = Path::new(BACKUP_DIR).join(id);
+        bind(self.as_ref().join(id), &mountpoint, false).await?;
+        Ok(PackageBackupMountGuard {
+            mountpoint: Some(mountpoint),
+            lock: Some(lock),
+        })
+    }
+
+    #[instrument(skip_all)]
+    pub async fn save(&self) -> Result<(), Error> {
+        let metadata_path = self.as_ref().join("metadata.cbor");
+        let backup_disk_path = self.backup_disk_path();
+        let mut file = AtomicFile::new(&metadata_path, None::<PathBuf>)
+            .await
+            .with_kind(ErrorKind::Filesystem)?;
+        file.write_all(&IoFormat::Cbor.to_vec(&self.metadata)?)
+            .await?;
+        file.save().await.with_kind(ErrorKind::Filesystem)?;
+        let unencrypted_metadata_path =
+            backup_disk_path.join("EmbassyBackups/unencrypted-metadata.cbor");
+        let mut file = AtomicFile::new(&unencrypted_metadata_path, None::<PathBuf>)
+            .await
+            .with_kind(ErrorKind::Filesystem)?;
+        file.write_all(&IoFormat::Cbor.to_vec(&self.unencrypted_metadata)?)
+            .await?;
+        file.save().await.with_kind(ErrorKind::Filesystem)?;
+        Ok(())
+    }
+
+    #[instrument(skip_all)]
+    pub async fn unmount(mut self) -> Result<(), Error> {
+        if let Some(guard) = self.encrypted_guard.take() {
+            guard.unmount().await?;
+        }
+        if let Some(guard) = self.backup_disk_mount_guard.take() {
+            guard.unmount().await?;
+        }
+        Ok(())
+    }
+
+    #[instrument(skip_all)]
+    pub async fn save_and_unmount(self) -> Result<(), Error> {
+        self.save().await?;
+        self.unmount().await?;
+        Ok(())
+    }
+}
+impl<G: GenericMountGuard> AsRef<Path> for BackupMountGuard<G> {
+    fn as_ref(&self) -> &Path {
+        if let Some(guard) = &self.encrypted_guard {
+            guard.as_ref()
+        } else {
+            unreachable!()
+        }
+    }
+}
+impl<G: GenericMountGuard> Drop for BackupMountGuard<G> {
+    fn drop(&mut self) {
+        let first = self.encrypted_guard.take();
+        let second = self.backup_disk_mount_guard.take();
+        tokio::spawn(async move {
+            if let Some(guard) = first {
+                guard.unmount().await.unwrap();
+            }
+            if let Some(guard) = second {
+                guard.unmount().await.unwrap();
+            }
+        });
+    }
+}
+
+pub struct PackageBackupMountGuard {
+    mountpoint: Option<PathBuf>,
+    lock: Option<FileLock>,
+}
+impl PackageBackupMountGuard {
+    pub async fn unmount(mut self) -> Result<(), Error> {
+        if let Some(mountpoint) = self.mountpoint.take() {
+            unmount(&mountpoint).await?;
+        }
+        if let Some(lock) = self.lock.take() {
+            lock.unlock().await?;
+        }
+        Ok(())
+    }
+}
+impl AsRef<Path> for PackageBackupMountGuard {
+    fn as_ref(&self) -> &Path {
+        if let Some(mountpoint) = &self.mountpoint {
+            mountpoint
+        } else {
+            unreachable!()
+        }
+    }
+}
+impl Drop for PackageBackupMountGuard {
+    fn drop(&mut self) {
+        let mountpoint = self.mountpoint.take();
+        let lock = self.lock.take();
+        tokio::spawn(async move {
+            if let Some(mountpoint) = mountpoint {
+                unmount(&mountpoint).await.unwrap();
+            }
+            if let Some(lock) = lock {
+                lock.unlock().await.unwrap();
+            }
+        });
+    }
+}

core/startos/src/disk/mount/filesystem/bind.rs

@@ -0,0 +1,54 @@
+use std::os::unix::ffi::OsStrExt;
+use std::path::Path;
+
+use async_trait::async_trait;
+use digest::generic_array::GenericArray;
+use digest::{Digest, OutputSizeUser};
+use sha2::Sha256;
+
+use super::{FileSystem, MountType, ReadOnly};
+use crate::disk::mount::util::bind;
+use crate::{Error, ResultExt};
+
+pub struct Bind<SrcDir: AsRef<Path>> {
+    src_dir: SrcDir,
+}
+impl<SrcDir: AsRef<Path>> Bind<SrcDir> {
+    pub fn new(src_dir: SrcDir) -> Self {
+        Self { src_dir }
+    }
+}
+#[async_trait]
+impl<SrcDir: AsRef<Path> + Send + Sync> FileSystem for Bind<SrcDir> {
+    async fn mount<P: AsRef<Path> + Send + Sync>(
+        &self,
+        mountpoint: P,
+        mount_type: MountType,
+    ) -> Result<(), Error> {
+        bind(
+            self.src_dir.as_ref(),
+            mountpoint,
+            matches!(mount_type, ReadOnly),
+        )
+        .await
+    }
+    async fn source_hash(
+        &self,
+    ) -> Result<GenericArray<u8, <Sha256 as OutputSizeUser>::OutputSize>, Error> {
+        let mut sha = Sha256::new();
+        sha.update("Bind");
+        sha.update(
+            tokio::fs::canonicalize(self.src_dir.as_ref())
+                .await
+                .with_ctx(|_| {
+                    (
+                        crate::ErrorKind::Filesystem,
+                        self.src_dir.as_ref().display().to_string(),
+                    )
+                })?
+                .as_os_str()
+                .as_bytes(),
+        );
+        Ok(sha.finalize())
+    }
+}

core/startos/src/disk/mount/filesystem/block_dev.rs

@@ -0,0 +1,67 @@
+use std::os::unix::ffi::OsStrExt;
+use std::path::Path;
+
+use async_trait::async_trait;
+use digest::generic_array::GenericArray;
+use digest::{Digest, OutputSizeUser};
+use serde::{Deserialize, Serialize};
+use sha2::Sha256;
+
+use super::{FileSystem, MountType, ReadOnly};
+use crate::util::Invoke;
+use crate::{Error, ResultExt};
+
+pub async fn mount(
+    logicalname: impl AsRef<Path>,
+    mountpoint: impl AsRef<Path>,
+    mount_type: MountType,
+) -> Result<(), Error> {
+    tokio::fs::create_dir_all(mountpoint.as_ref()).await?;
+    let mut cmd = tokio::process::Command::new("mount");
+    cmd.arg(logicalname.as_ref()).arg(mountpoint.as_ref());
+    if mount_type == ReadOnly {
+        cmd.arg("-o").arg("ro");
+    }
+    cmd.invoke(crate::ErrorKind::Filesystem).await?;
+    Ok(())
+}
+
+#[derive(Debug, Deserialize, Serialize)]
+#[serde(rename_all = "kebab-case")]
+pub struct BlockDev<LogicalName: AsRef<Path>> {
+    logicalname: LogicalName,
+}
+impl<LogicalName: AsRef<Path>> BlockDev<LogicalName> {
+    pub fn new(logicalname: LogicalName) -> Self {
+        BlockDev { logicalname }
+    }
+}
+#[async_trait]
+impl<LogicalName: AsRef<Path> + Send + Sync> FileSystem for BlockDev<LogicalName> {
+    async fn mount<P: AsRef<Path> + Send + Sync>(
+        &self,
+        mountpoint: P,
+        mount_type: MountType,
+    ) -> Result<(), Error> {
+        mount(self.logicalname.as_ref(), mountpoint, mount_type).await
+    }
+    async fn source_hash(
+        &self,
+    ) -> Result<GenericArray<u8, <Sha256 as OutputSizeUser>::OutputSize>, Error> {
+        let mut sha = Sha256::new();
+        sha.update("BlockDev");
+        sha.update(
+            tokio::fs::canonicalize(self.logicalname.as_ref())
+                .await
+                .with_ctx(|_| {
+                    (
+                        crate::ErrorKind::Filesystem,
+                        self.logicalname.as_ref().display().to_string(),
+                    )
+                })?
+                .as_os_str()
+                .as_bytes(),
+        );
+        Ok(sha.finalize())
+    }
+}

core/startos/src/disk/mount/filesystem/cifs.rs

@@ -0,0 +1,107 @@
+use std::net::IpAddr;
+use std::os::unix::ffi::OsStrExt;
+use std::path::{Path, PathBuf};
+
+use async_trait::async_trait;
+use digest::generic_array::GenericArray;
+use digest::{Digest, OutputSizeUser};
+use serde::{Deserialize, Serialize};
+use sha2::Sha256;
+use tokio::process::Command;
+use tracing::instrument;
+
+use super::{FileSystem, MountType, ReadOnly};
+use crate::disk::mount::guard::TmpMountGuard;
+use crate::util::Invoke;
+use crate::Error;
+
+async fn resolve_hostname(hostname: &str) -> Result<IpAddr, Error> {
+    if let Ok(addr) = hostname.parse() {
+        return Ok(addr);
+    }
+    if hostname.ends_with(".local") {
+        return Ok(IpAddr::V4(crate::net::mdns::resolve_mdns(hostname).await?));
+    }
+    Ok(String::from_utf8(
+        Command::new("nmblookup")
+            .arg(hostname)
+            .invoke(crate::ErrorKind::Network)
+            .await?,
+    )?
+    .split(" ")
+    .next()
+    .unwrap()
+    .trim()
+    .parse()?)
+}
+
+#[instrument(skip_all)]
+pub async fn mount_cifs(
+    hostname: &str,
+    path: impl AsRef<Path>,
+    username: &str,
+    password: Option<&str>,
+    mountpoint: impl AsRef<Path>,
+    mount_type: MountType,
+) -> Result<(), Error> {
+    tokio::fs::create_dir_all(mountpoint.as_ref()).await?;
+    let ip: IpAddr = resolve_hostname(hostname).await?;
+    let absolute_path = Path::new("/").join(path.as_ref());
+    let mut cmd = Command::new("mount");
+    cmd.arg("-t")
+        .arg("cifs")
+        .env("USER", username)
+        .env("PASSWD", password.unwrap_or_default())
+        .arg(format!("//{}{}", ip, absolute_path.display()))
+        .arg(mountpoint.as_ref());
+    if mount_type == ReadOnly {
+        cmd.arg("-o").arg("ro,noserverino");
+    } else {
+        cmd.arg("-o").arg("noserverino");
+    }
+    cmd.invoke(crate::ErrorKind::Filesystem).await?;
+    Ok(())
+}
+
+#[derive(Debug, Deserialize, Serialize)]
+#[serde(rename_all = "kebab-case")]
+pub struct Cifs {
+    pub hostname: String,
+    pub path: PathBuf,
+    pub username: String,
+    pub password: Option<String>,
+}
+impl Cifs {
+    pub async fn mountable(&self) -> Result<(), Error> {
+        let guard = TmpMountGuard::mount(self, ReadOnly).await?;
+        guard.unmount().await?;
+        Ok(())
+    }
+}
+#[async_trait]
+impl FileSystem for Cifs {
+    async fn mount<P: AsRef<std::path::Path> + Send + Sync>(
+        &self,
+        mountpoint: P,
+        mount_type: MountType,
+    ) -> Result<(), Error> {
+        mount_cifs(
+            &self.hostname,
+            &self.path,
+            &self.username,
+            self.password.as_ref().map(|p| p.as_str()),
+            mountpoint,
+            mount_type,
+        )
+        .await
+    }
+    async fn source_hash(
+        &self,
+    ) -> Result<GenericArray<u8, <Sha256 as OutputSizeUser>::OutputSize>, Error> {
+        let mut sha = Sha256::new();
+        sha.update("Cifs");
+        sha.update(self.hostname.as_bytes());
+        sha.update(self.path.as_os_str().as_bytes());
+        Ok(sha.finalize())
+    }
+}

core/startos/src/disk/mount/filesystem/ecryptfs.rs

@@ -0,0 +1,71 @@
+use std::os::unix::ffi::OsStrExt;
+use std::path::Path;
+
+use async_trait::async_trait;
+use digest::generic_array::GenericArray;
+use digest::{Digest, OutputSizeUser};
+use sha2::Sha256;
+
+use super::{FileSystem, MountType};
+use crate::util::Invoke;
+use crate::{Error, ResultExt};
+
+pub async fn mount_ecryptfs<P0: AsRef<Path>, P1: AsRef<Path>>(
+    src: P0,
+    dst: P1,
+    key: &str,
+) -> Result<(), Error> {
+    tokio::fs::create_dir_all(dst.as_ref()).await?;
+    tokio::process::Command::new("mount")
+        .arg("-t")
+        .arg("ecryptfs")
+        .arg(src.as_ref())
+        .arg(dst.as_ref())
+        .arg("-o")
+        // for more information `man ecryptfs` 
+        .arg(format!("key=passphrase:passphrase_passwd={},ecryptfs_cipher=aes,ecryptfs_key_bytes=32,ecryptfs_passthrough=n,ecryptfs_enable_filename_crypto=y,no_sig_cache", key))
+        .input(Some(&mut std::io::Cursor::new(b"\n")))
+        .invoke(crate::ErrorKind::Filesystem).await?;
+    Ok(())
+}
+
+pub struct EcryptFS<EncryptedDir: AsRef<Path>, Key: AsRef<str>> {
+    encrypted_dir: EncryptedDir,
+    key: Key,
+}
+impl<EncryptedDir: AsRef<Path>, Key: AsRef<str>> EcryptFS<EncryptedDir, Key> {
+    pub fn new(encrypted_dir: EncryptedDir, key: Key) -> Self {
+        EcryptFS { encrypted_dir, key }
+    }
+}
+#[async_trait]
+impl<EncryptedDir: AsRef<Path> + Send + Sync, Key: AsRef<str> + Send + Sync> FileSystem
+    for EcryptFS<EncryptedDir, Key>
+{
+    async fn mount<P: AsRef<Path> + Send + Sync>(
+        &self,
+        mountpoint: P,
+        _mount_type: MountType, // ignored - inherited from parent fs
+    ) -> Result<(), Error> {
+        mount_ecryptfs(self.encrypted_dir.as_ref(), mountpoint, self.key.as_ref()).await
+    }
+    async fn source_hash(
+        &self,
+    ) -> Result<GenericArray<u8, <Sha256 as OutputSizeUser>::OutputSize>, Error> {
+        let mut sha = Sha256::new();
+        sha.update("EcryptFS");
+        sha.update(
+            tokio::fs::canonicalize(self.encrypted_dir.as_ref())
+                .await
+                .with_ctx(|_| {
+                    (
+                        crate::ErrorKind::Filesystem,
+                        self.encrypted_dir.as_ref().display().to_string(),
+                    )
+                })?
+                .as_os_str()
+                .as_bytes(),
+        );
+        Ok(sha.finalize())
+    }
+}

core/startos/src/disk/mount/filesystem/efivarfs.rs

@@ -0,0 +1,39 @@
+use std::path::Path;
+
+use async_trait::async_trait;
+use digest::generic_array::GenericArray;
+use digest::{Digest, OutputSizeUser};
+use sha2::Sha256;
+
+use super::{FileSystem, MountType, ReadOnly};
+use crate::util::Invoke;
+use crate::Error;
+
+pub struct EfiVarFs;
+#[async_trait]
+impl FileSystem for EfiVarFs {
+    async fn mount<P: AsRef<Path> + Send + Sync>(
+        &self,
+        mountpoint: P,
+        mount_type: MountType,
+    ) -> Result<(), Error> {
+        tokio::fs::create_dir_all(mountpoint.as_ref()).await?;
+        let mut cmd = tokio::process::Command::new("mount");
+        cmd.arg("-t")
+            .arg("efivarfs")
+            .arg("efivarfs")
+            .arg(mountpoint.as_ref());
+        if mount_type == ReadOnly {
+            cmd.arg("-o").arg("ro");
+        }
+        cmd.invoke(crate::ErrorKind::Filesystem).await?;
+        Ok(())
+    }
+    async fn source_hash(
+        &self,
+    ) -> Result<GenericArray<u8, <Sha256 as OutputSizeUser>::OutputSize>, Error> {
+        let mut sha = Sha256::new();
+        sha.update("EfiVarFs");
+        Ok(sha.finalize())
+    }
+}

core/startos/src/disk/mount/filesystem/httpdirfs.rs

@@ -0,0 +1,52 @@
+use std::path::Path;
+
+use async_trait::async_trait;
+use digest::generic_array::GenericArray;
+use digest::{Digest, OutputSizeUser};
+use reqwest::Url;
+use serde::{Deserialize, Serialize};
+use sha2::Sha256;
+
+use super::{FileSystem, MountType};
+use crate::util::Invoke;
+use crate::Error;
+
+pub async fn mount_httpdirfs(url: &Url, mountpoint: impl AsRef<Path>) -> Result<(), Error> {
+    tokio::fs::create_dir_all(mountpoint.as_ref()).await?;
+    let mut cmd = tokio::process::Command::new("httpdirfs");
+    cmd.arg("--cache")
+        .arg("--single-file-mode")
+        .arg(url.as_str())
+        .arg(mountpoint.as_ref());
+    cmd.invoke(crate::ErrorKind::Filesystem).await?;
+    Ok(())
+}
+
+#[derive(Debug, Deserialize, Serialize)]
+#[serde(rename_all = "kebab-case")]
+pub struct HttpDirFS {
+    url: Url,
+}
+impl HttpDirFS {
+    pub fn new(url: Url) -> Self {
+        HttpDirFS { url }
+    }
+}
+#[async_trait]
+impl FileSystem for HttpDirFS {
+    async fn mount<P: AsRef<Path> + Send + Sync>(
+        &self,
+        mountpoint: P,
+        _mount_type: MountType,
+    ) -> Result<(), Error> {
+        mount_httpdirfs(&self.url, mountpoint).await
+    }
+    async fn source_hash(
+        &self,
+    ) -> Result<GenericArray<u8, <Sha256 as OutputSizeUser>::OutputSize>, Error> {
+        let mut sha = Sha256::new();
+        sha.update("HttpDirFS");
+        sha.update(self.url.as_str());
+        Ok(sha.finalize())
+    }
+}

core/startos/src/disk/mount/filesystem/label.rs

@@ -0,0 +1,52 @@
+use std::path::Path;
+
+use async_trait::async_trait;
+use digest::generic_array::GenericArray;
+use digest::{Digest, OutputSizeUser};
+use sha2::Sha256;
+
+use super::{FileSystem, MountType, ReadOnly};
+use crate::util::Invoke;
+use crate::Error;
+
+pub async fn mount_label(
+    label: &str,
+    mountpoint: impl AsRef<Path>,
+    mount_type: MountType,
+) -> Result<(), Error> {
+    tokio::fs::create_dir_all(mountpoint.as_ref()).await?;
+    let mut cmd = tokio::process::Command::new("mount");
+    cmd.arg("-L").arg(label).arg(mountpoint.as_ref());
+    if mount_type == ReadOnly {
+        cmd.arg("-o").arg("ro");
+    }
+    cmd.invoke(crate::ErrorKind::Filesystem).await?;
+    Ok(())
+}
+
+pub struct Label<S: AsRef<str>> {
+    label: S,
+}
+impl<S: AsRef<str>> Label<S> {
+    pub fn new(label: S) -> Self {
+        Label { label }
+    }
+}
+#[async_trait]
+impl<S: AsRef<str> + Send + Sync> FileSystem for Label<S> {
+    async fn mount<P: AsRef<Path> + Send + Sync>(
+        &self,
+        mountpoint: P,
+        mount_type: MountType,
+    ) -> Result<(), Error> {
+        mount_label(self.label.as_ref(), mountpoint, mount_type).await
+    }
+    async fn source_hash(
+        &self,
+    ) -> Result<GenericArray<u8, <Sha256 as OutputSizeUser>::OutputSize>, Error> {
+        let mut sha = Sha256::new();
+        sha.update("Label");
+        sha.update(self.label.as_ref().as_bytes());
+        Ok(sha.finalize())
+    }
+}

core/startos/src/disk/mount/filesystem/loop_dev.rs

@@ -0,0 +1,89 @@
+use std::os::unix::ffi::OsStrExt;
+use std::path::Path;
+
+use async_trait::async_trait;
+use digest::generic_array::GenericArray;
+use digest::{Digest, OutputSizeUser};
+use serde::{Deserialize, Serialize};
+use sha2::Sha256;
+
+use super::{FileSystem, MountType, ReadOnly};
+use crate::util::Invoke;
+use crate::{Error, ResultExt};
+
+pub async fn mount(
+    logicalname: impl AsRef<Path>,
+    offset: u64,
+    size: u64,
+    mountpoint: impl AsRef<Path>,
+    mount_type: MountType,
+) -> Result<(), Error> {
+    tokio::fs::create_dir_all(mountpoint.as_ref()).await?;
+    let mut opts = format!("loop,offset={offset},sizelimit={size}");
+    if mount_type == ReadOnly {
+        opts += ",ro";
+    }
+
+    tokio::process::Command::new("mount")
+        .arg(logicalname.as_ref())
+        .arg(mountpoint.as_ref())
+        .arg("-o")
+        .arg(opts)
+        .invoke(crate::ErrorKind::Filesystem)
+        .await?;
+    Ok(())
+}
+
+#[derive(Debug, Deserialize, Serialize)]
+#[serde(rename_all = "kebab-case")]
+pub struct LoopDev<LogicalName: AsRef<Path>> {
+    logicalname: LogicalName,
+    offset: u64,
+    size: u64,
+}
+impl<LogicalName: AsRef<Path>> LoopDev<LogicalName> {
+    pub fn new(logicalname: LogicalName, offset: u64, size: u64) -> Self {
+        Self {
+            logicalname,
+            offset,
+            size,
+        }
+    }
+}
+#[async_trait]
+impl<LogicalName: AsRef<Path> + Send + Sync> FileSystem for LoopDev<LogicalName> {
+    async fn mount<P: AsRef<Path> + Send + Sync>(
+        &self,
+        mountpoint: P,
+        mount_type: MountType,
+    ) -> Result<(), Error> {
+        mount(
+            self.logicalname.as_ref(),
+            self.offset,
+            self.size,
+            mountpoint,
+            mount_type,
+        )
+        .await
+    }
+    async fn source_hash(
+        &self,
+    ) -> Result<GenericArray<u8, <Sha256 as OutputSizeUser>::OutputSize>, Error> {
+        let mut sha = Sha256::new();
+        sha.update("LoopDev");
+        sha.update(
+            tokio::fs::canonicalize(self.logicalname.as_ref())
+                .await
+                .with_ctx(|_| {
+                    (
+                        crate::ErrorKind::Filesystem,
+                        self.logicalname.as_ref().display().to_string(),
+                    )
+                })?
+                .as_os_str()
+                .as_bytes(),
+        );
+        sha.update(&u64::to_be_bytes(self.offset)[..]);
+        Ok(sha.finalize())
+    }
+}

core/startos/src/disk/mount/filesystem/mod.rs

@@ -0,0 +1,37 @@
+use std::path::Path;
+
+use async_trait::async_trait;
+use digest::generic_array::GenericArray;
+use digest::OutputSizeUser;
+use sha2::Sha256;
+
+use crate::Error;
+
+pub mod bind;
+pub mod block_dev;
+pub mod cifs;
+pub mod ecryptfs;
+pub mod efivarfs;
+pub mod httpdirfs;
+pub mod label;
+pub mod loop_dev;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum MountType {
+    ReadOnly,
+    ReadWrite,
+}
+
+pub use MountType::*;
+
+#[async_trait]
+pub trait FileSystem {
+    async fn mount<P: AsRef<Path> + Send + Sync>(
+        &self,
+        mountpoint: P,
+        mount_type: MountType,
+    ) -> Result<(), Error>;
+    async fn source_hash(
+        &self,
+    ) -> Result<GenericArray<u8, <Sha256 as OutputSizeUser>::OutputSize>, Error>;
+}

core/startos/src/disk/mount/guard.rs

@@ -0,0 +1,142 @@
+use std::collections::BTreeMap;
+use std::path::{Path, PathBuf};
+use std::sync::{Arc, Weak};
+
+use lazy_static::lazy_static;
+use models::ResultExt;
+use tokio::sync::Mutex;
+use tracing::instrument;
+
+use super::filesystem::{FileSystem, MountType, ReadOnly, ReadWrite};
+use super::util::unmount;
+use crate::util::Invoke;
+use crate::Error;
+
+pub const TMP_MOUNTPOINT: &'static str = "/media/embassy/tmp";
+
+#[async_trait::async_trait]
+pub trait GenericMountGuard: AsRef<Path> + std::fmt::Debug + Send + Sync + 'static {
+    async fn unmount(mut self) -> Result<(), Error>;
+}
+
+#[derive(Debug)]
+pub struct MountGuard {
+    mountpoint: PathBuf,
+    mounted: bool,
+}
+impl MountGuard {
+    pub async fn mount(
+        filesystem: &impl FileSystem,
+        mountpoint: impl AsRef<Path>,
+        mount_type: MountType,
+    ) -> Result<Self, Error> {
+        let mountpoint = mountpoint.as_ref().to_owned();
+        filesystem.mount(&mountpoint, mount_type).await?;
+        Ok(MountGuard {
+            mountpoint,
+            mounted: true,
+        })
+    }
+    pub async fn unmount(mut self, delete_mountpoint: bool) -> Result<(), Error> {
+        if self.mounted {
+            unmount(&self.mountpoint).await?;
+            if delete_mountpoint {
+                match tokio::fs::remove_dir(&self.mountpoint).await {
+                    Err(e) if e.raw_os_error() == Some(39) => Ok(()), // directory not empty
+                    a => a,
+                }
+                .with_ctx(|_| {
+                    (
+                        crate::ErrorKind::Filesystem,
+                        format!("rm {}", self.mountpoint.display()),
+                    )
+                })?;
+            }
+            self.mounted = false;
+        }
+        Ok(())
+    }
+}
+impl AsRef<Path> for MountGuard {
+    fn as_ref(&self) -> &Path {
+        &self.mountpoint
+    }
+}
+impl Drop for MountGuard {
+    fn drop(&mut self) {
+        if self.mounted {
+            let mountpoint = std::mem::take(&mut self.mountpoint);
+            tokio::spawn(async move { unmount(mountpoint).await.unwrap() });
+        }
+    }
+}
+#[async_trait::async_trait]
+impl GenericMountGuard for MountGuard {
+    async fn unmount(mut self) -> Result<(), Error> {
+        MountGuard::unmount(self, false).await
+    }
+}
+
+async fn tmp_mountpoint(source: &impl FileSystem) -> Result<PathBuf, Error> {
+    Ok(Path::new(TMP_MOUNTPOINT).join(base32::encode(
+        base32::Alphabet::RFC4648 { padding: false },
+        &source.source_hash().await?,
+    )))
+}
+
+lazy_static! {
+    static ref TMP_MOUNTS: Mutex<BTreeMap<PathBuf, (MountType, Weak<MountGuard>)>> =
+        Mutex::new(BTreeMap::new());
+}
+
+#[derive(Debug)]
+pub struct TmpMountGuard {
+    guard: Arc<MountGuard>,
+}
+impl TmpMountGuard {
+    /// DRAGONS: if you try to mount something as ro and rw at the same time, the ro mount will be upgraded to rw.
+    #[instrument(skip_all)]
+    pub async fn mount(filesystem: &impl FileSystem, mount_type: MountType) -> Result<Self, Error> {
+        let mountpoint = tmp_mountpoint(filesystem).await?;
+        let mut tmp_mounts = TMP_MOUNTS.lock().await;
+        if !tmp_mounts.contains_key(&mountpoint) {
+            tmp_mounts.insert(mountpoint.clone(), (mount_type, Weak::new()));
+        }
+        let (prev_mt, weak_slot) = tmp_mounts.get_mut(&mountpoint).unwrap();
+        if let Some(guard) = weak_slot.upgrade() {
+            // upgrade to rw
+            if *prev_mt == ReadOnly && mount_type == ReadWrite {
+                tokio::process::Command::new("mount")
+                    .arg("-o")
+                    .arg("remount,rw")
+                    .arg(&mountpoint)
+                    .invoke(crate::ErrorKind::Filesystem)
+                    .await?;
+                *prev_mt = ReadWrite;
+            }
+            Ok(TmpMountGuard { guard })
+        } else {
+            let guard = Arc::new(MountGuard::mount(filesystem, &mountpoint, mount_type).await?);
+            *weak_slot = Arc::downgrade(&guard);
+            *prev_mt = mount_type;
+            Ok(TmpMountGuard { guard })
+        }
+    }
+    pub async fn unmount(self) -> Result<(), Error> {
+        if let Ok(guard) = Arc::try_unwrap(self.guard) {
+            guard.unmount(true).await?;
+        }
+        Ok(())
+    }
+}
+impl AsRef<Path> for TmpMountGuard {
+    fn as_ref(&self) -> &Path {
+        (&*self.guard).as_ref()
+    }
+}
+#[async_trait::async_trait]
+impl GenericMountGuard for TmpMountGuard {
+    async fn unmount(mut self) -> Result<(), Error> {
+        TmpMountGuard::unmount(self).await
+    }
+}

core/startos/src/disk/mount/mod.rs

@@ -0,0 +1,4 @@
+pub mod backup;
+pub mod filesystem;
+pub mod guard;
+pub mod util;

core/startos/src/disk/mount/util.rs

@@ -0,0 +1,52 @@
+use std::path::Path;
+
+use tracing::instrument;
+
+use crate::util::Invoke;
+use crate::Error;
+
+#[instrument(skip_all)]
+pub async fn bind<P0: AsRef<Path>, P1: AsRef<Path>>(
+    src: P0,
+    dst: P1,
+    read_only: bool,
+) -> Result<(), Error> {
+    tracing::info!(
+        "Binding {} to {}",
+        src.as_ref().display(),
+        dst.as_ref().display()
+    );
+    let is_mountpoint = tokio::process::Command::new("mountpoint")
+        .arg(dst.as_ref())
+        .stdout(std::process::Stdio::null())
+        .stderr(std::process::Stdio::null())
+        .status()
+        .await?;
+    if is_mountpoint.success() {
+        unmount(dst.as_ref()).await?;
+    }
+    tokio::fs::create_dir_all(&src).await?;
+    tokio::fs::create_dir_all(&dst).await?;
+    let mut mount_cmd = tokio::process::Command::new("mount");
+    mount_cmd.arg("--bind");
+    if read_only {
+        mount_cmd.arg("-o").arg("ro");
+    }
+    mount_cmd
+        .arg(src.as_ref())
+        .arg(dst.as_ref())
+        .invoke(crate::ErrorKind::Filesystem)
+        .await?;
+    Ok(())
+}
+
+#[instrument(skip_all)]
+pub async fn unmount<P: AsRef<Path>>(mountpoint: P) -> Result<(), Error> {
+    tracing::debug!("Unmounting {}.", mountpoint.as_ref().display());
+    tokio::process::Command::new("umount")
+        .arg("-l")
+        .arg(mountpoint.as_ref())
+        .invoke(crate::ErrorKind::Filesystem)
+        .await?;
+    Ok(())
+}