boot: Add systemd unit to cleanup sysroot automatically

This unit makes use of the `--auto` option of `ostree admin cleanup` to
cleanup the sysroot when the `/sysroot/.cleanup` file is left behind
when finalizing a staged deployment. The purpose of this service is to
restore pruning of deleted deployments when a staged deployment is
written out during shutdown of the previous boot. The unit is optional
as the cleanup can be run at another time or not at all.

Cleaning the sysroot will prune the repo, and this can be a slow and IO
intensive operation. To keep the system from blocking, the default
`Before` dependency on `multi-user.target` has been removed. Since the
service will then run in the background, the IO scheduling class has
been lowered to `idle` to keep the system's primary tasks more
responsive.

Makefile-boot.am

@@ -40,6 +40,7 @@ systemdsystemunit_DATA = src/boot/ostree-prepare-root.service \
 	src/boot/ostree-remount.service \
 	src/boot/ostree-finalize-staged.service \
 	src/boot/ostree-finalize-staged.path \
+	src/boot/ostree-auto-cleanup.service \
 	$(NULL)
 systemdtmpfilesdir = $(prefix)/lib/tmpfiles.d
 dist_systemdtmpfiles_DATA = src/boot/ostree-tmpfiles.conf
@@ -68,6 +69,7 @@ EXTRA_DIST += src/boot/dracut/module-setup.sh \
 	src/boot/ostree-finalize-staged.path \
 	src/boot/ostree-remount.service \
 	src/boot/ostree-finalize-staged.service \
+	src/boot/ostree-auto-cleanup.service \
 	src/boot/grub2/grub2-15_ostree \
 	src/boot/grub2/ostree-grub-generator \
 	$(NULL)

src/boot/ostree-auto-cleanup.service

@@ -0,0 +1,43 @@
+# Copyright © 2022 Endless OS Foundation LLC
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public
+# License along with this library. If not, see <https://www.gnu.org/licenses/>.
+
+[Unit]
+Description=OSTree Automatic Sysroot Cleanup
+Documentation=man:ostree-admin-cleanup(1)
+ConditionPathExists=/sysroot/.cleanup
+
+# We want this to be triggered by multi-user.target but not block it via
+# the default After added to target units since pruning the repo can be
+# slow. See the Default Dependencies sections in systemd.service(5) and
+# systemd.target(5).
+DefaultDependencies=no
+Requires=sysinit.target
+After=sysinit.target basic.target
+Conflicts=shutdown.target
+Before=shutdown.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStop=/usr/bin/ostree admin cleanup --auto
+ProtectSystem=strict
+ReadWritePaths=/sysroot /boot
+
+# This will be allowed to run in the background, so try to make it less
+# disruptive while it prunes the repo.
+IOSchedulingClass=idle
+
+[Install]
+WantedBy=multi-user.target

src/libostree/ostree-impl-system-generator.c

@@ -134,6 +134,8 @@ require_internal_units (const char *normal_dir,
     return FALSE;
   if (symlinkat (SYSTEM_DATA_UNIT_PATH "/ostree-finalize-staged.path", normal_dir_dfd, "multi-user.target.wants/ostree-finalize-staged.path") < 0)
     return glnx_throw_errno_prefix (error, "symlinkat");
+  if (symlinkat (SYSTEM_DATA_UNIT_PATH "/ostree-auto-cleanup.service", normal_dir_dfd, "multi-user.target.wants/ostree-auto-cleanup.service") < 0)
+    return glnx_throw_errno_prefix (error, "symlinkat");
 
   return TRUE;
 #else

tests/kolainst/destructive/staged-deploy.sh

@@ -10,6 +10,7 @@ case "${AUTOPKGTEST_REBOOT_MARK:-}" in
   "")
   # Test our generator
   test -f /run/systemd/generator/multi-user.target.wants/ostree-finalize-staged.path
+  test -f /run/systemd/generator/multi-user.target.wants/ostree-auto-cleanup.service
   test -f /run/systemd/generator/local-fs.target.requires/ostree-remount.service
 
   cat >/etc/systemd/system/sock-to-ignore.socket << 'EOF'
@@ -77,6 +78,12 @@ EOF
     rm -f svc.txt
     # And there should not be a staged deployment
     test '!' -f /run/ostree/staged-deployment
+    # Check that auto cleanup ran
+    assert_not_has_file /sysroot/.cleanup
+    journalctl -b 0 -u ostree-auto-cleanup.service > svc.txt
+    assert_file_has_content svc.txt 'Starting ostree-auto-cleanup.service'
+    assert_not_file_has_content svc.txt 'No cleanup needed.'
+    rm -f svc.txt
 
     # Upgrade with staging
     test '!' -f /run/ostree/staged-deployment