rootfs-protection: Fix building with tempdir=/tmp

The issue is that the tempdir is added at the end of the list of
directories to keep writable, and entries earlier in the list are
subdirectories of tempdir.

The check encountered the subdirs first, so decided it must recurse and
make everything else read-only.

It never got as far as noticing that /tmp was requested writable.

Now, every path is checked for being equal, then checked for being
a subdirectory.

This changed style to use any and generator expressions, as it was more
concise than having an explicit loop for checking equality, then an
explicit loop for checking subdirectory.

1 files changed, 25 insertions, 0 deletions

diff --git a/morphlib/fsutils_tests.py b/morphlib/fsutils_tests.py
index f49e6f89..7b159665 100644
--- a/morphlib/fsutils_tests.py
+++ b/morphlib/fsutils_tests.py
@@ -72,3 +72,28 @@ class InvertPathsTests(unittest.TestCase):
         found = frozenset(morphlib.fsutils.invert_paths(walker, ["./foo"]))
         unexpected = ("./foo", "./foo/bar", "./foo/baz")
         self.assertTrue(all(path not in found for path in unexpected))
+
+    def test_lower_mount_precludes(self):
+        walker = dummy_top_down_walker('.', {
+            "tmp": {
+                "morph": {
+                    "staging": {
+                        "build": None,
+                        "inst": None,
+                    },
+                },
+                "ccache": {
+                    "0": None
+                },
+            },
+            "bin": {
+            },
+        })
+        found = frozenset(morphlib.fsutils.invert_paths(
+            walker, [
+                     "./tmp/morph/staging/build",
+                     "./tmp/morph/staging/inst",
+                     "./tmp",
+                    ]))
+        expected = ("./bin",)
+        self.assertEqual(sorted(found), sorted(expected))