Overriding initramfs image with a boot-sel.d hook

[olfway]

I'm trying to cache the unlock passphrase in a load-key.d hook and append it to the initramfs in a boot-sel.d hook (similar to #432).

I see several possible ways to do this:

1. Bind-mount a new initramfs image over the original one.
   This would break BE unmounting. However, this could be fixed by using umount -R "${mnt}", which will also unmount the bind mount if it's present.

2. Unmount the BE, mount a tmpfs at the same mount point, and place the original kernel, the new initramfs, and the dtb file there.
   This would require reimplementing the dtb file logic or refactoring it to be usable from hooks.

3. Introduce an option for hooks to change ZBM_SELECTED_INITRAMFS and other variable values.
   For example, a hook could return JSON similar to {"ZBM_SELECTED_INITRAMFS": "/path/to/new/initramfs.img"}.

4. Reuse kexec_kernel from the hook and pass a new initramfs.
   This could work, but kexec_kernel would have to be refactored to accept initramfs images from outside of ${mnt}, as it currently loads --initrd="${mnt}${initramfs}".

5. Reimplement kexec_kernel in a hook.
   This seems impractical.

Am I missing anything?

For me, using umount -R ${mnt} seems to be the cleanest and easiest solution, and it shouldn't break anything.

Another way would be to use realpath --relative-to=${mnt} /absolute/path/to/new/initramfs and call the existing kexec_kernel from the hook, but I haven't tried it.

Option 3 also seems interesting to me, as it would open up new possibilities for hooks.

[ahesford]

The only one of those options that seems palatable would be extending the mount recursively. This has already been done in the chroot helper. Doing it here wouldn't be terrible.

Trying to parse JSON output from the hooks would likely turn out to be a pain. Even worse, if the hook is doing things to change the state ZFSBootMenu expects, we ought to validate everything to make sure it's consistent. However, because we no longer control the state, we won't even know how to validate it.