feat: refuse to install over a partition which is in use

[otavio]

Closes #353.

An update could write over storage the running system still had mounted. TargetTypeExt::valid() only checked that the target existed and was writable, so a raw object pointed at the live rootfs went straight through the block device while the mounted filesystem kept serving its own page cache and writing it back over what had just been installed.

Audit of the handlers

The issue asked to double-check every mode, so here is where each stood:

Mode	Before	Now
raw	existence + write permission + free space	valid(Access::Exclusive)
raw-delta	same	valid(Access::Exclusive)
flash	same, plus MTD tools on PATH	valid(Access::Exclusive)
ubifs	same, plus UBI tools on PATH	valid(Access::Exclusive)
imxkobs	only kobs-ng on PATH, no target validation whatsoever	each chip path is checked
copy	existence + write permission + free space	valid(Access::for_format(should_format))
tarball	same	valid(Access::for_format(should_format))
uboot-env, mender, zephyr	no partition target	unchanged

How the check works

utils::fs::ensure_not_mounted() reads /proc/self/mountinfo and matches on two axes:

• By device number. rdev is compared against mountinfo's major:minor, so the by-uuid link, /dev/root and a device mapper name all resolve to the same device. sysfs then extends the comparison to storage the target shares: the partitions a disk holds, the disk a partition belongs to, and whatever is stacked on top through LVM, MD or loop. Sibling partitions are deliberately excluded, since writing to one does not reach the others.
• By mount source name. UBIFS and JFFS2 mount no block device, so mountinfo carries ubi0:rootfs or mtd:rootfs. Those names are rebuilt from /sys/class/mtd and /sys/class/ubi, which also catches erasing an MTD out from under the UBI volumes attached to it.

Where the policy lives

valid() now takes an Access argument saying how the handler reaches its target — Exclusive for handlers writing the device itself, ThroughFilesystem for those writing through a mount they make. Every handler already called valid(), so each is forced by the compiler to state its intent exactly once, and there is no separate call for the next handler to forget.

copy and tarball pass Access::for_format(should_format): formatting rewrites the whole filesystem and so takes the device for itself, even though the rest of their work is safe on an already-mounted target. That also means the whole package is rejected during validation — before anything is downloaded, and before an earlier object in the same package has written to storage.

format() keeps a check of its own, so the mkfs calls stay guarded regardless of who reaches them. The force flags there (-F/-f/-y) are deliberately kept: dropping them would make the tools prompt on a whole disk or an existing filesystem, and an unattended agent with no tty would hang or abort. The explicit check is stronger anyway, since mkfs's own refusal covers only the exact device path, not partitions or holders.

Verification

cargo test --all --all-features passes, clippy is clean.

Probed against real devices on a development host:

/dev/nvme0n1     => Err(DeviceInUse { mount_point: "/boot" })    # disk, partition mounted
/dev/nvme0n1p1   => Err(DeviceInUse { mount_point: "/boot" })    # the partition itself
/dev/nvme0n1p2   => Ok(())                                       # unmounted sibling
/dev/sda2        => Err(DeviceInUse { mount_point: "/tmp/..." }) # LUKS/dm holder chain
/dev/mapper/keys => Err(DeviceInUse { mount_point: "/tmp/..." })

The /dev/sda2 case surfaced on its own: the imxkobs fixture used /dev/sda1 and /dev/sda2 as placeholders and the new check rejected them, because /dev/sda2 really is a LUKS PV on that host. The fixture now names devices which do not exist, which also exercises the not-found path where a missing device returns Ok and leaves the existence complaint to valid().

Tests cover mountinfo parsing with and without the optional fields, malformed lines, a regular file and a missing device. A loop-device round trip is included as #[ignore]d, following the loopdev pattern the copy/tarball tests already use and sharing their SERIALIZE mutex; note CI runs cargo test without --ignored, so it documents intent rather than running in the pipeline.

Known limitations

mount_sources_for enumerates the spellings a kernel might have recorded for an MTD or UBI target rather than resolving each mountinfo source forward to a canonical device. A spelling that is missing fails open. UBIFS superblocks carry anonymous devnos so some name-based reasoning is unavoidable, but the direction of the mapping could be inverted later, using the fstype field the parser already walks past.