Upon further investigation; it appears this is not exploitable for RCE:
1) systemd is blocked from completely executing any of these mount units by the ConditionFileExists=!/usr/.noupdate being false.
HOWEVER, the udev event still triggers the mount job to attempt to start, so it begins starting, is blocked from completing by systemd, and then automatically stopped; summarily unmounting the dir out from under IPA, and since we properly declare dependencies for our chroot environment, systemd enforces those dependencies and stops the IPA chroot.
I believe this downgrade this from a major vulnerability to a very minor DoS vuln at worst.
Upon further investigation; it appears this is not exploitable for RCE:
1) systemd is blocked from completely executing any of these mount units by the ConditionFileEx ists=!/ usr/.noupdate being false.
HOWEVER, the udev event still triggers the mount job to attempt to start, so it begins starting, is blocked from completing by systemd, and then automatically stopped; summarily unmounting the dir out from under IPA, and since we properly declare dependencies for our chroot environment, systemd enforces those dependencies and stops the IPA chroot.
I believe this downgrade this from a major vulnerability to a very minor DoS vuln at worst.