Mount policies

Every mounted filesystem in Peios carries a mount policy — a single setting per superblock that determines whether FACS applies, how missing SDs are handled, and what fallback SD template is used. This page is the map for the four policy classes and where each fits.

Three FACS-managed policy classes and one unmanaged class. Each handles missing SDs differently — deny, synthesise in memory, or synthesise and persist. This page covers each class, the SD synthesis chain (parent → mount template → fallback), and the universal rule for corrupt SDs.

Different filesystems store SDs differently. ext4 uses xattrs, sometimes needing the ea_inode feature for larger SDs. XFS supports xattrs natively. NTFS rounds-trip through system.ntfs_security. FAT and exFAT have no xattr support at all. This page catalogues the storage by filesystem type and the implications for mount-policy choice.

Mount policies are set via kacs_set_mount_policy and read via kacs_get_mount_policy. Changes are lazy — the kernel maintains a generation counter that invalidates in-memory cached state on next access rather than walking the filesystem. This page covers the syscalls, the generation counter, and the privilege rules.