(cherry picked from commit b1034aab)

(cherry picked from commit 8098a423)

(cherry picked from commit 13ae2f59)

(cherry picked from commit 2a7a87c0)

(cherry picked from commit fe848ddd)

(cherry picked from commit 181dd67b)

(cherry picked from commit 1e9aa0ab)

(cherry picked from commit 2223d5d2)

(cherry picked from commit a9ce543c)

(cherry picked from commit 680bb240)

(cherry picked from commit 34986253)

(cherry picked from commit f985dae7)

(cherry picked from commit 78354c7f)

(cherry picked from commit d9d87849)

(cherry picked from commit 89eb450b)

(cherry picked from commit e5621835)

(cherry picked from commit eab8c64c)

(cherry picked from commit 6b87325f)

(cherry picked from commit afba0908)

(cherry picked from commit cd379a8f)

(cherry picked from commit ecb715c3)

(cherry picked from commit b7298829)

(cherry picked from commit ab2bc45a)

(cherry picked from commit d4a1a4db)

(cherry picked from commit 18364725)

The new package targets have no drawbacks compared to auto live
mount, but the latter has proven difficult and does not match the
normal boot scenario and could potentially panic due to unionfs
being broken beyond repair (kib@'s words in spirit, not mine).

Discussed with: @adschellevis

(cherry picked from commit 80a70ffe)

We don't use this file very often so clamp down the access range
in order to avoid unwanted leakage.

(cherry picked from commit f50e2f58)

(cherry picked from commit f79e2018)

(cherry picked from commit 8d2cf58b)

(cherry picked from commit 603469c6)

(cherry picked from commit 56f3f564)

(cherry picked from commit 46265467)

The two are mutually exclusive.

(cherry picked from commit 174028db)

(cherry picked from commit 77d83631)

(cherry picked from commit 305ba62b)

(cherry picked from commit 05e75ec6)

(cherry picked from commit 34b75c5e)

(cherry picked from commit 8912f909)

(cherry picked from commit 159d2fd2)

(cherry picked from commit bea8906d)