Merge 2fab0223b7 into 7a7f306b6c

Before commit 7c764d4599 ("switch-root: always use MS_BIND to move api vfs over"),
when switching root from an initrd, the old procfs, sysfs, /dev/ and
/run would be moved using MS_MOVE. According to that commit, this change
was mostly a simplification because systemd already cleans up the old
mount hierarchy before the switch root, and no longer needed to rely on
the clean up side-effect of MS_MOVE.

However, this change broke some systemd services that also have an
associated AppArmor profile. For example, in Ubuntu, rsyslog has an
AppArmor profile configured, and when it tries to access
/run/systemd/notify during start up (after the switch root has
occurred), we see the denial:

 audit: type=1400 audit(1714740096.740:159): apparmor="DENIED" operation="sendmsg" class="file" info="Failed name lookup - disconnected path" error=-13 profile="rsyslogd" name="systemd/notify" [...]

The difference in MS_BIND vs MS_MOVE affects the view that AppArmor has
of the mount tree. With MS_BIND, AppArmor will not know that e.g.
/run/systemd/notify is in the current mount tree after the pivot_root,
because it is tracking this path from the old root. But with MS_MOVE,
the original mount is preserved and does not affect AppArmor's view.

Ultimately, this is most likely something that should be addressed in
AppArmor, but that is not going to happen in the short term. For now,
just go back to MS_MOVE when switching from the initrd.

src/shared/switch-root.c

@@ -42,7 +42,7 @@ int switch_root(const char *new_root,
                 { "/dev",             MS_BIND|MS_REC,  MS_BIND|MS_REC }, /* Recursive, because we want to save the original /dev/shm/ + /dev/pts/ and similar */
                 { "/sys",             MS_BIND|MS_REC,  MS_BIND|MS_REC }, /* Similar, we want to retain various API VFS, or the cgroupv1 /sys/fs/cgroup/ tree */
                 { "/proc",            MS_BIND|MS_REC,  MS_BIND|MS_REC }, /* Similar */
-                { "/run",             MS_BIND,         MS_BIND|MS_REC }, /* Recursive except on soft reboot, see above */
+                { "/run",             MS_BIND,         MS_MOVE        }, /* Recursive except on soft reboot, see above */
                 { "/run/credentials", MS_BIND|MS_REC,  0 /* skip! */  }, /* Credential mounts should survive */
                 { "/run/host",        MS_BIND|MS_REC,  0 /* skip! */  }, /* Host supplied hierarchy should also survive */
         };