root="LABEL=ROOT" rootflags=subvol=@root_{{ CURRENT_SUBVOLUME_TIMESTAMP }} lockdown=confidentiality