systemd: serialize fsck device probes with initrd drop-ins

[Pawel Winogrodzki (PawelWMS)]

What

• Add drop-ins for generated initrd root and /usr checks, the static root service, and instantiated device checks.
• Add a wrapper that derives the generated unit's exact block device from its BindsTo= dependency before acquiring the whole-disk lock.
• Add dracut configuration that copies the wrapper, drop-ins, and required binaries into every rebuilt initramfs.
• Add source signatures and package-time assertions for all installed and initramfs-required files.

Why

systemd-udevd can probe filesystem metadata while fsck is still updating it. Serializing the writer against udev's shared whole-disk lock prevents udev from observing transient metadata and removing filesystem identity links before the mount begins.

Mechanism

systemd-fstab-generator already writes generated root and /usr fsck units with BindsTo=dev-....device. The wrapper reads that loaded-unit property with systemctl show, converts the escaped device-unit name back to its /dev/... path with systemd-escape, then runs udevadm lock --device=<path> -- systemd-fsck <path>.

For the static non-initrd root service, which has no generated device dependency, the wrapper falls back to udevadm lock --backing=/ and the existing argument-free systemd-fsck behavior.

The existing Azure Linux initramfs package watches systemd upgrades and regenerates all initramfs images with dracut. The new dracut configuration ensures the drop-ins and resolver are present in those images.

Scope

This alternative covers generated initrd root and /usr checks, static non-initrd root checks, and instantiated device checks. Draft #18640 explores the simpler generator-layer implementation for the initrd-specific path.

Risk

• The initrd path now depends on a shell wrapper, systemctl show, systemd-escape, and dracut file inclusion.
• Wrapper behavior depends on generated root and /usr units retaining one block-device BindsTo= dependency.
• Lock acquisition has a hard 180-second ceiling; timeout prevents fsck from starting and fails the unit.
• Filesystem checks on partitions sharing one physical disk serialize on the whole-disk lock.
• This workaround has more packaging and early-boot moving parts than systemd: serialize generated initrd fsck device probes #18640.

Verification

• Verified BindsTo= device-unit names round-trip through systemd-escape --unescape --path.
• Validated wrapper shell syntax after Git LF normalization.
• Validated every dracut install_items entry.
• Validated source signatures against exact staged Git blobs.
• Ran git diff --check.
• Passed repository commit and push hooks.
• Completed adversarial Advocate, Skeptic, Architect, and focused wrapper review.
• Full package build and boot test were not run locally; draft CI and review are required.