stage-2-init: fix false positives for RO Nix store mounts

[numinit]

Mounting an ext4 Nix store with the option errors=remount-ro results in the store not being remounted as RO after stage2 runs. In fact, many mount options involving "ro" at the end of the option are susceptible to this.

We need to take the "top" mount instead of any mount, which is the last line printed by findmnt. Additionally, make the regex more strict, so we don't select mount options ending in ro (like errors=remount-ro from
ext4, or overlay paths ending in 'ro') and accidentally leave the Nix store RW after boot.

The tests for this look a little tortured, because of how the tests overlay mount the Nix store. It is much easier to hit this on real hardware, with a single mountpoint (though, incidentally, I first hit this with an overlay).

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 25.05 Release Notes (or backporting 24.11 and 25.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[numinit]

@Mic92 @shlevy @edolstra You three touched this code last :-)

If I didn't think of any edgecases here from taking the last thing mounted over the store, let me know, but I'm pretty sure the regex is correct. (Of note, bash regexes match ^$ at the beginning and end of the string, not the line).

[numinit]

One edgecase I considered is that if the store is under a readonly mount (as opposed to one itself) we will still perform the RO bind mount, but I'm not sure this is actually worth changing.

[r-vdp]

Diff LGTM

[numinit]

Working on several boxes in prod already that had this problem :-)