On Tue, Jun 13, 2023 at 06:55:50PM -0700, Darrick J. Wong wrote: > > I'd love it if filesystems actually /could/ lock down the parts of block > devices they're using. They could hand out write privileges to the open > bdev fds at the same time that a block layout lease is created, and > retract them when the lease terminates. Areas before the fs (e.g. BIOS > boot sector) could actually be left writable by filesystems that don't > use that area; and anything beyond EOFS would still be writable (hello > lvm). Then xfs actually /could/ prevent you from blowing away mounted > xfs filesystem. > > ext4 could even still allow primary superblock writes to avoid breaking > tune2fs, or they could detect secureboot lockdown and prohibit that. Let's not overcomplicate things. As said not allowing writes to partitions through the whole block device is pretty trivial. The allowing to write into some areas of an otherwise fs owned device (partition or whole) is just bogus. We might have to support it for extN (and maybe some other things) for legacy setups, but we really need to add proper APIs for that and just disallow it for modern setups instead of creating complex infrastructure to cater to this fundamentally broken use case.
