rpmostreepayload: Rework binds to be recursive

Our hardcoded list of mount points missed critical ones
like `/sys/firmware/efi/efivars`, which broke installation
on EFI.

I started to add that to the list, but then I realized there's a much
simpler solution - make the binds recursive and let `mount` do the
work for us.  This is a bit more risky of a change, but it'll
clearly be more maintainable long term.

Down the line...we may want to simply walk over all the toplevel mount
points in `/mnt/sysimage`, but I doubt anyone is going to add anything
new that's not a subdirectory of `/sys`.

See https://pagure.io/atomic-wg/issue/185

Related: https://github.com/rhinstaller/anaconda/issues/900

pyanaconda/packaging/rpmostreepayload.py

@@ -226,16 +226,24 @@ def prepareMountTargets(self, storage):
                        (iutil.getTargetPhysicalRoot(), iutil.getSysroot() + "/sysroot"),
                        (iutil.getTargetPhysicalRoot() + "/boot", iutil.getSysroot() + "/boot")]
 
-        # Bind mount the other filesystems from /mnt/sysimage to the ostree root
-        for path in ["/dev", "/dev/pts", "/dev/shm", "/proc", "/run", "/sys", "/sys/fs/selinux"]:
+        # Bind mount filesystems from /mnt/sysimage to the ostree root; perhaps
+        # in the future consider `mount --move` to make the output of `findmnt`
+        # not induce blindness.
+        for path in ["/dev", "/proc", "/run", "/sys"]:
             self._binds += [(iutil.getTargetPhysicalRoot()+path, iutil.getSysroot()+path)]
 
         for (src, dest) in self._binds:
-            self._safeExecWithRedirect("mount",
-                                       ["--bind", src, dest if dest else src])
-            if dest is None:
+            is_ro_bind = dest is None
+            if is_ro_bind:
+                self._safeExecWithRedirect("mount",
+                                           ["--bind", src, src])
                 self._safeExecWithRedirect("mount",
                                            ["--bind", "-o", "remount,ro", src, src])
+            else:
+                # Recurse for non-ro binds so we pick up sub-mounts
+                # like /sys/firmware/efi/efivars.
+                self._safeExecWithRedirect("mount",
+                                           ["--rbind", src, dest])
 
         # Now, ensure that all other potential mount point directories such as
         # (/home) are created.  We run through the full tmpfiles here in order