Module fsverity 

fs-verity integration for tamper-evident snapshot sealing. fs-verity integration for tamper-evident snapshot sealing.

Provides FS_IOC_ENABLE_VERITY ioctl wrapper to seal files with a kernel-enforced Merkle tree. Once sealed, any modification to the file causes reads to return EIO. Works on XFS (kernel 6.12+) and btrfs.

Structs

SealStats

Statistics from a batch seal operation.

Enums

FsVerityError

Errors from fs-verity operations.

Constants

FS_VERITY_HASH_ALG_SHA256

fs-verity hash algorithms (from linux/fsverity.h)

FS_VERITY_HASH_ALG_SHA512

Functions

is_verity_enabled

Check if a file has fs-verity enabled.

parse_algorithm

Parse a hash algorithm name to its kernel constant.

seal_snapshot_directory

Seal all files in a directory tree with fs-verity.

seal_with_fsverity

Seal a file with fs-verity.