introduce systemd-validatefs@.service that ensures file systems can only be used in the way they were intended (#36714)

If we have multiple trusted fs (i.e. luks or dm-verity) we generate via
repart at boot, we must make sure they cannot be "misappropriated", i.e.
used for a different mount they were intended for.

Hence, let's introduce "mount constraint" data (encoded in xattrs on the
root inode of the fs) that tells us where a file system has to be
mounted, and what the gpt partition metadata has to be for the fs to be
valid.

Inspired by this thread:
https://lists.freedesktop.org/archives/systemd-devel/2025-March/051244.html

src/basic/special.h

@@ -95,6 +95,7 @@
 #define SPECIAL_GROWFS_ROOT_SERVICE "systemd-growfs-root.service"
 #define SPECIAL_PCRFS_SERVICE "systemd-pcrfs@.service"
 #define SPECIAL_PCRFS_ROOT_SERVICE "systemd-pcrfs-root.service"
+#define SPECIAL_VALIDATEFS_SERVICE "systemd-validatefs@.service"
 #define SPECIAL_HIBERNATE_RESUME_SERVICE "systemd-hibernate-resume.service"
 
 /* Services systemd relies on */

src/basic/xattr-util.c

@@ -13,11 +13,13 @@
 #include "fd-util.h"
 #include "macro.h"
 #include "missing_syscall.h"
+#include "nulstr-util.h"
 #include "parse-util.h"
 #include "sparse-endian.h"
 #include "stat-util.h"
 #include "stdio-util.h"
 #include "string-util.h"
+#include "strv.h"
 #include "time-util.h"
 #include "xattr-util.h"
 
@@ -189,6 +191,24 @@ int getxattr_at_bool(int fd, const char *path, const char *name, int at_flags) {
         return parse_boolean(v);
 }
 
+int getxattr_at_strv(int fd, const char *path, const char *name, int at_flags, char ***ret_strv) {
+        int r;
+
+        _cleanup_free_ char *nulstr = NULL;
+        size_t nulstr_size = 0;
+
+        r = getxattr_at_malloc(fd, path, name, at_flags, &nulstr, &nulstr_size);
+        if (r < 0)
+                return r;
+
+        _cleanup_strv_free_ char **l = strv_parse_nulstr(nulstr, nulstr_size);
+        if (!l)
+                return -ENOMEM;
+
+        *ret_strv = TAKE_PTR(l);
+        return 0;
+}
+
 static int listxattr_pinned_internal(
                 int fd,
                 const char *path,
@@ -323,6 +343,18 @@ int xsetxattr_full(
         return 0;
 }
 
+int xsetxattr_strv(int fd, const char *path, int at_flags, const char *name, char * const* l) {
+        int r;
+
+        _cleanup_free_ char *nulstr = NULL;
+        size_t size = 0;
+        r = strv_make_nulstr(l, &nulstr, &size);
+        if (r < 0)
+                return r;
+
+        return xsetxattr_full(fd, path, at_flags, name, nulstr, size, /* xattr_flags= */ 0);
+}
+
 int xremovexattr(int fd, const char *path, int at_flags, const char *name) {
         int r;
 

src/basic/xattr-util.h

@@ -20,6 +20,7 @@ static inline int fgetxattr_malloc(int fd, const char *name, char **ret, size_t
 }
 
 int getxattr_at_bool(int fd, const char *path, const char *name, int at_flags);
+int getxattr_at_strv(int fd, const char *path, const char *name, int at_flags, char ***ret_strv);
 
 int listxattr_at_malloc(int fd, const char *path, int at_flags, char **ret);
 static inline int listxattr_malloc(const char *path, char **ret) {
@@ -49,6 +50,8 @@ static inline int xsetxattr(
         return xsetxattr_full(fd, path, at_flags, name, value, SIZE_MAX, 0);
 }
 
+int xsetxattr_strv(int fd, const char *path, int at_flags, const char *name, char *const*l);
+
 int xremovexattr(int fd, const char *path, int at_flags, const char *name);
 
 int fd_setcrtime(int fd, usec_t usec);