ab update: Trident tries to relabel shared partitions too when selinux is being used

[frhuelsz]

On AB update when SELinux is being used, Trident generates a list of all filesystems that must be relabeled. This list includes shared partitions, not only inactive volumes. This leads to a situation where we relabel active filesystems too. This generally doesn't case issues, but it may cause intermittent failures when incompatible processes are running and operating on the active OS.

An example of this is containerd, which manages many filesystem trees, overlays, and mounts in /var/lib/containerd. Past error reports have shown that setfiles may encounter issues and fail when it tries to relabel continerd-managed paths.

Details

Problem

During an A/B update, Trident selects all mounted, writable, SELinux-capable filesystems for relabeling. This includes standalone
filesystems shared with the active OS.

For example, relabeling a shared /var/lib/containerd filesystem can race with containerd-managed files and mounts, causing intermittent update failures.

Expected behavior

During an A/B update, relabel only filesystems belonging to A/B volume pairs. Do not relabel standalone shared filesystems.

Clean-install behavior must remain unchanged.

Acceptance criteria

• A/B filesystems are relabeled during an A/B update.
• Standalone shared filesystems are not relabeled during an A/B update.
• Existing handling of read-only, unmounted, and unsupported filesystems
  remains unchanged.
• Unit tests cover the A/B and shared-filesystem cases.
• The Rust test suite passes.