We discussed this offline and it makes sense because dm-verity provides the integrity checking. That being said, for something like Flash player, it still makes sense to copy disk images into /var/imageloader.

So this should just add a new API:

bool LoadComponentAtPath(const std::string& component_path, const std::string& mount_path);

Does that fit your needs? I can implement that very easily.

if you want to support both modes, that's fine.  that API looks like it should work since we now stuff all the container stuff inside the imageloader image.

The one 'gotcha' that I see: do you have a plan to make sure imageloaderd has read access to the component?

the chronos-access group should have read access granted, and the imageloaderd is part of that group, so i think it should be fine

The extensions dir is group chronos, not chronos-access, though. mount_extension_image copies the directory somewhere else first to get around this.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/platform/imageloader/+/0fd6be374dfc48efc231b44b97aa7c4a8e7e3cec

commit 0fd6be374dfc48efc231b44b97aa7c4a8e7e3cec
Author: Greg Kerr <kerrnel@chromium.org>
Date: Tue Jun 27 17:55:44 2017

Add LoadComponentAtPath method.

Add LoadComponentAtPath method to verify and mount images in place.

BUG= chromium:728856 
TEST=FEATURES="test" emerge-${BOARD} imageloader

Change-Id: Ic80c5a45a45341268ef6ca231259435071de063b
Reviewed-on: https://chromium-review.googlesource.com/538924
Commit-Ready: Greg Kerr <kerrnel@chromium.org>
Tested-by: Greg Kerr <kerrnel@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>

[modify] https://crrev.com/0fd6be374dfc48efc231b44b97aa7c4a8e7e3cec/dbus_permissions/org.chromium.ImageLoader.conf
[modify] https://crrev.com/0fd6be374dfc48efc231b44b97aa7c4a8e7e3cec/imageloader.cc
[modify] https://crrev.com/0fd6be374dfc48efc231b44b97aa7c4a8e7e3cec/dbus_adaptors/org.chromium.ImageLoaderInterface.xml
[modify] https://crrev.com/0fd6be374dfc48efc231b44b97aa7c4a8e7e3cec/imageloader_impl.h
[modify] https://crrev.com/0fd6be374dfc48efc231b44b97aa7c4a8e7e3cec/imageloader.h
[modify] https://crrev.com/0fd6be374dfc48efc231b44b97aa7c4a8e7e3cec/imageloader_impl.cc
[modify] https://crrev.com/0fd6be374dfc48efc231b44b97aa7c4a8e7e3cec/imageloader_unittest.cc

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/autotest/+/202d81a2f3cbf7171d4e3e5ec20a7c0e9c6aef0f

commit 202d81a2f3cbf7171d4e3e5ec20a7c0e9c6aef0f
Author: Greg Kerr <kerrnel@chromium.org>
Date: Tue Jun 27 17:55:45 2017

Add test for LoadComponentAtPath.

Adds a test for the new LoadComponentAtPath method which supports
loading a component from a path outside of the /var/lib/imageloader
reserved storage.

BUG= chromium:728856 
CQ-DEPEND=CL:538924
TEST=test_that -b ${BOARD} platform_ImageLoaderServer

Change-Id: I00a99980a8536e1e4bbbc44028c17f3d051c8560
Reviewed-on: https://chromium-review.googlesource.com/549218
Commit-Ready: Greg Kerr <kerrnel@chromium.org>
Tested-by: Greg Kerr <kerrnel@chromium.org>
Reviewed-by: Eric Caruso <ejcaruso@chromium.org>

[modify] https://crrev.com/202d81a2f3cbf7171d4e3e5ec20a7c0e9c6aef0f/client/site_tests/platform_ImageLoader/platform_ImageLoader.py

Mike, does what I landed work for you or do you need anything else added?