Do not mount /boot/efi by default

[travier]

Objectives

To avoid issues on AWS and to better convey the fact that users and administrators should not manually alter the content of the EFI partition, we want to not mount /boot/efi / the EFI partition by default.

The only programs on the system that should alter ESP partition content should be bootupd and fwupd and special support will be included for them to operate properly.

References

Split from #652

From coreos/fedora-coreos-config#407:

Nothing in the OS touches the ESP by default, so there's no reason to mount it by default, particularly writable. This is good for avoiding wear&tear on the filesystem, but I am specifically doing this as preparation for potentially removing the ESP from AWS images, because AWS ImportImage chokes on its presence: openshift/os#396

See also: coreos/fedora-coreos-config#356

[jamescassell]

I'd rather just make/keep it read-only than unmounted.

[bgilbert]

It looks like we're going to have to rework full-disk RAID support to maintain multiple independent ESPs, rather than RAIDing the replicas together. That necessitates keeping the ESP unmounted, since "the ESP" would no longer be a coherent concept; anything modifying ESP content would need to mount and independently modify each copy.

[dustymabe]

What about anything reading ESP content? Would mounting one "replica" read-only suffice?

Not sure it would be a valid use case to want to read ESP content, but from an "optics" perspective if people look at their mounts and don't see /boot/efi they might assume (incorrectly) the system is booted via BIOS and not UEFI.

[bgilbert]

It would suffice, but I worry that someone would mount -o remount,rw if they wanted to change something, without understanding the consequences.

I hope users aren't associating /boot/efi with the system having booted via UEFI. But even if so, I think we should consider breaking that expectation.

[bgilbert]

coreos/fedora-coreos-config#794 removes the mount.

[dustymabe]

The fix for this went into testing stream release 33.20210104.2.0. Please try out the new release and report issues.