rootfs-protection: Fix building with tempdir=/tmp

The issue is that the tempdir is added at the end of the list of
directories to keep writable, and entries earlier in the list are
subdirectories of tempdir.

The check encountered the subdirs first, so decided it must recurse and
make everything else read-only.

It never got as far as noticing that /tmp was requested writable.

Now, every path is checked for being equal, then checked for being
a subdirectory.

This changed style to use any and generator expressions, as it was more
concise than having an explicit loop for checking equality, then an
explicit loop for checking subdirectory.

1 files changed, 19 insertions, 15 deletions

diff --git a/morphlib/fsutils.py b/morphlib/fsutils.py
index 84884be8..0212b987 100644
--- a/morphlib/fsutils.py
+++ b/morphlib/fsutils.py
@@ -103,29 +103,33 @@ def invert_paths(tree_walker, paths):
         dn_copy = list(dirnames)
         for subdir in dn_copy:
             subdirpath = os.path.join(dirpath, subdir)
-            for p in paths:
-                # Subdir is an exact match for a given path
+
+            if any(p == subdirpath for p in paths):
+                # Subdir is an exact match for a path
                 # Don't recurse into it, so remove from list
-                # Also don't yield it as we're inverting
-                if subdirpath == p:
-                    dirnames.remove(subdir)
-                    break
+                # Don't yield it, since we don't return listed paths
+                dirnames.remove(subdir)
+            elif any(is_subpath(subdirpath, p) for p in paths):
                 # This directory is a parent directory of one
-                # of our paths, recurse into it, but don't yield it
-                elif is_subpath(subdirpath, p):
-                    break
+                # of our paths
+                # Recurse into it, so don't remove it from the list
+                # Don't yield it, since we don't return listed paths
+                pass
             else:
+                # This directory is neither one marked for writing,
+                # nor a parent of a file marked for writing
+                # Don't recurse, so remove it from the list
+                # Yield it, since we return listed paths
                 dirnames.remove(subdir)
                 yield subdirpath
 
         for filename in filenames:
             fullpath = os.path.join(dirpath, filename)
-            for p in paths:
+            if any(is_subpath(p, fullpath) for p in paths):
                 # The file path is a child of one of the paths
-                # or is equal. Don't yield because either it is
-                # one of the specified paths, or is a file in a
-                # directory specified by a path
-                if is_subpath(p, fullpath):
-                    break
+                # or is equal.
+                # Don't yield because either it is one of the specified
+                # paths, or is a file in a directory specified by a path
+                pass
             else:
                 yield fullpath