Btrfs mountoptions guardrails

[sedlund]

⚠️ Breaking Change

This introduces strict validation of Btrfs subvolume mount option consistency by default.
Configurations that previously relied on divergent filesystem-wide mount options may now fail evaluation.

---

Problem

Btrfs mount options are largely filesystem-wide, but disko allows per-subvolume mountOptions to diverge.
When they do, the effective behavior depends on mount ordering, which is not explicit and can lead to non-deterministic results.

Approach

Introduce a deterministic, Btrfs-specific guardrail:

• Compare filesystem-wide option sets across all mounted subvolumes.

• Allow only a conservative whitelist of clearly per-mount VFS flags to differ:

  • ro / rw
  • nosuid / suid
  • nodev / dev
  • noexec / exec
  • atime variants (noatime, relatime, strictatime, lazytime, etc.)

• Ignore defaults, subvol=..., and userspace helper options (e.g. X-mount.mkdir).

• Treat subvolumes using the default subvolume mountOptions = [ "defaults" ] as inheriting the top-level Btrfs mount options for the consistency check.

• Compare option sets order-insensitively and by option key/value for filesystem-wide options.

Policy / Options

Two new Btrfs module options:

• enforceConsistentMountOptions (default: true)
  Throw an evaluation error if non-whitelisted inconsistencies are detected.

• warnOnInconsistentMountOptions (default: true)
  When strict mode is disabled, emit a warning unless this is set to false.

Why Btrfs-specific?

This behavior is specific to Btrfs subvolume multi-mount semantics, where many mount options are effectively filesystem-wide. Other filesystems do not exhibit the same ambiguity in disko’s model.

Tests

Added coverage for both allowed and rejected Btrfs subvolume mount option divergence.

• btrfs-mountoptions-per-mount-allowed

  • Verifies that whitelisted per-mount VFS flags may differ across mounted subvolumes under strict mode.
  • Covers noexec, nosuid, nodev, and noatime.
  • Verifies that all configured subvolumes mount successfully.
  • Verifies that each subvolume mount contains its expected option.
  • Verifies that these per-mount options do not propagate to the root mount.

• btrfs-mountoptions-consistency-guardrail

  • Verifies that conflicting non-whitelisted filesystem-wide options across mounted subvolumes are rejected during evaluation.
  • Uses a conflicting compress= configuration to confirm the guardrail throws under the default strict mode.

The implementation also treats subvolumes using the default subvolume mountOptions = [ "defaults" ] as inheriting the top-level Btrfs mount options for the consistency check, and ignores defaults, subvol=..., and X-mount.mkdir when comparing filesystem-wide option sets.

---

Fixes #331