Error trying to install or update `linux-image-amd64`

This has been driving me crazy for the last few weeks; basically I tried installing an upgrade to the `linux-image-amd64` package via `apt-get` on my machine (running Debian) but it has been failing mysteriously, leaving the machine in a weird state every time (e.g. not releasing upgrade locks, etc). Just today I think I finally managed to track that down to keybase:

```
% sudo apt-get install linux-image-amd64
Reading package lists... Done
Building dependency tree
Reading state information... Done
linux-image-amd64 is already the newest version (4.9+80+deb9u3).
linux-image-amd64 set to manually installed.
0 upgraded, 0 newly installed, 0 to remove and 2 not upgraded.
3 not fully installed or removed.
After this operation, 0 B of additional disk space will be used.
Do you want to continue? [Y/n]
Setting up linux-image-4.9.0-5-amd64 (4.9.65-3+deb9u2) ...
/etc/kernel/postinst.d/initramfs-tools:
update-initramfs: Generating /boot/initrd.img-4.9.0-5-amd64
I: The initramfs will attempt to resume from /dev/dm-3
I: (UUID=a259dc09-b002-48f4-b1ee-da382689dbda)
I: Set the RESUME variable to override this.
Adding IMA policy.
ln: failed to create symbolic link '/var/tmp/mkinitramfs_2TJsHQ/bin/grep': File exists
ln: failed to create symbolic link '/var/tmp/mkinitramfs_2TJsHQ/bin/awk': File exists
/etc/kernel/postinst.d/zz-update-grub:
Generating grub configuration file ...
Found background image: .background_cache.png
Found linux image: /boot/vmlinuz-4.9.0-5-amd64
Found initrd image: /boot/initrd.img-4.9.0-5-amd64
Found linux image: /boot/vmlinuz-4.9.0-4-amd64
Found initrd image: /boot/initrd.img-4.9.0-4-amd64
find: ‘/keybase’: Permission denied
run-parts: /etc/kernel/postinst.d/zz-update-grub exited with return code 1
dpkg: error processing package linux-image-4.9.0-5-amd64 (--configure):
subprocess installed post-installation script returned error exit status 1
dpkg: dependency problems prevent configuration of linux-image-amd64:
linux-image-amd64 depends on linux-image-4.9.0-5-amd64; however:
Package linux-image-4.9.0-5-amd64 is not configured yet.

dpkg: error processing package linux-image-amd64 (--configure):
dependency problems - leaving unconfigured
Setting up linux-image-4.9.0-4-amd64 (4.9.65-3+deb9u1) ...
/etc/kernel/postinst.d/initramfs-tools:
update-initramfs: Generating /boot/initrd.img-4.9.0-4-amd64
I: The initramfs will attempt to resume from /dev/dm-3
I: (UUID=a259dc09-b002-48f4-b1ee-da382689dbda)
I: Set the RESUME variable to override this.
Adding IMA policy.
ln: failed to create symbolic link '/var/tmp/mkinitramfs_VBGtzl/bin/grep': File exists
ln: failed to create symbolic link '/var/tmp/mkinitramfs_VBGtzl/bin/awk': File exists
/etc/kernel/postinst.d/zz-update-grub:
Generating grub configuration file ...
Found background image: .background_cache.png
Found linux image: /boot/vmlinuz-4.9.0-5-amd64
Found initrd image: /boot/initrd.img-4.9.0-5-amd64
Found linux image: /boot/vmlinuz-4.9.0-4-amd64
Found initrd image: /boot/initrd.img-4.9.0-4-amd64
find: ‘/keybase’: Permission denied
run-parts: /etc/kernel/postinst.d/zz-update-grub exited with return code 1
dpkg: error processing package linux-image-4.9.0-4-amd64 (--configure):
subprocess installed post-installation script returned error exit status 1
Errors were encountered while processing:
linux-image-4.9.0-5-amd64
linux-image-amd64
linux-image-4.9.0-4-amd64
E: Sub-process /usr/bin/dpkg returned an error code (1)
```

Note the `find: ‘/keybase’: Permission denied` line there.

In the end I managed to proceed with the upgrade by unmounting the keybase folder with `sudo umount /keybase` and then retrying, but this was more complicated than it should have been. I think the core issue is that even the root user is not able to access the `/keybase` mount point when keybase is running. Is this WAI, or is there anything that can be done to avoid this?

Start by reproducing the Debian apt-get kernel upgrade while /keybase is mounted, focusing on the reported `find: '/keybase': Permission denied` failure. Investigate the mount's root-access behavior and determine whether the upgrade can complete without manually unmounting /keybase.

Written by the indexing model from the issue text.