Allow booting directory images owned by root if running as root

Alternative to #4214. While we still don't support booting images
built as non-root uids without the foreign UID range, we can make
an exception for images built and booted as root.

Author: daandemeyer

mkosi/__init__.py

@@ -5263,10 +5263,16 @@ def run_verb(args: Args, tools: Optional[Config], images: Sequence[Config], *, r
         return
 
     if (output := last.output_dir_or_cwd() / last.output).is_dir() and not is_foreign_uid_tree(output):
-        die(
-            "Can only operate on foreign UID range owned directory images",
-            hint="Add ForeignUIDRange=yes to [Build] and rebuild the image to use the foreign UID range",
-        )
+        if output.stat().st_uid != 0:
+            die(
+                "Can only operate on foreign UID range or root owned directory images",
+                hint="Add ForeignUIDRange=yes to [Build] and rebuild the image to use the foreign UID range",
+            )
+
+        if os.getuid() != 0:
+            die(
+                "Must be root to operate on root owned directory images",
+            )
 
     run_vm = {
         Vmm.qemu: run_qemu,

mkosi/qemu.py

@@ -51,7 +51,7 @@
 from mkosi.log import ARG_DEBUG, die
 from mkosi.partition import finalize_root, find_partitions
 from mkosi.run import AsyncioThread, find_binary, run, spawn, workdir
-from mkosi.tree import copy_tree, maybe_make_nocow, rmtree
+from mkosi.tree import copy_tree, is_foreign_uid_tree, maybe_make_nocow, rmtree
 from mkosi.user import INVOKING_USER
 from mkosi.util import (
     PathString,
@@ -395,11 +395,13 @@ def start_virtiofsd(
             group=st.st_gid if st else None,
             sandbox=config.sandbox(
                 options=[
-                    "--bind" if uidmap else "--bind-foreign", directory, workdir(directory),
+                    "--bind" if uidmap or not is_foreign_uid_tree(directory) else "--bind-foreign",
+                    directory,
+                    workdir(directory),
                     "--become-root",
                 ],
             ),
-        ) as proc:  # fmt: skip
+        ) as proc:
             yield path
             proc.terminate()