Linux disk encryption posture detection currently uses a simplified signal that can be bypassed or misreported when an encrypted loop device exists on the system. This can make a host appear compliant even if the relevant root/user data partitions are not actually encrypted.
We should harden the Linux posture collector to verify encryption on meaningful mounted block devices instead of treating any encrypted device as sufficient. The implementation should avoid false positives from loop devices, removable/test volumes, or unrelated encrypted mappings, and should clearly define which mount points/devices are considered posture-relevant.
Linux disk encryption posture detection currently uses a simplified signal that can be bypassed or misreported when an encrypted loop device exists on the system. This can make a host appear compliant even if the relevant root/user data partitions are not actually encrypted.
We should harden the Linux posture collector to verify encryption on meaningful mounted block devices instead of treating any encrypted device as sufficient. The implementation should avoid false positives from loop devices, removable/test volumes, or unrelated encrypted mappings, and should clearly define which mount points/devices are considered posture-relevant.