Re: [PATCH] bpf: add bpf_real_inode() kfunc

[Christoph Hellwig <hch@infradead.org>]

On Tue, Apr 07, 2026 at 12:25:29PM +0200, Christian Brauner wrote:
> Yes, I'm aware of that limitation. In this case we know exactly what
> type of filesystem is used. But thanks for reminding me that for btrfs
> it's s_dev is never the actual block device.
>   
> What I would ultimately would like in the future is to have a security
> hook that allows bpf to reject mounting any block devices that aren't
> dm-verity protected. Maybe we can chat about this at LSFMM as well. I
> know you will love this idea.

I'd much rather go right to that, with a slight tweak to clearly
specify the expected protection and not hard code dm-verity.  There's
ways to do full file system verity [1] much more efficiently inside the
file systems, and it would be good to not lock in a specific solution

[1] not to be confused with the existing fsverity for certain read-only
files.  Although a loopback image on that would probably also qualify.