Skip to content

Commit 004151b

Browse files
sweetteakdave
authored andcommitted
btrfs: disable verity on encrypted inodes
Right now there isn't a way to encrypt things that aren't either filenames in directories or data on blocks on disk with extent encryption, so for now, disable verity usage with encryption on btrfs. fscrypt with fsverity should be possible and it can be implemented in the future. Note: The patch was taken from v5 of fscrypt patchset (https://lore.kernel.org/linux-btrfs/cover.1706116485.git.josef@toxicpanda.com/) which was handled over time by various people: Omar Sandoval, Sweet Tea Dorminy, Josef Bacik. Reviewed-by: Boris Burkov <boris@bur.io> Signed-off-by: Sweet Tea Dorminy <sweettea-kernel@dorminy.me> Signed-off-by: Daniel Vacek <neelx@suse.com> Reviewed-by: David Sterba <dsterba@suse.com> [ add note ] Signed-off-by: David Sterba <dsterba@suse.com>
1 parent 1dc9348 commit 004151b

File tree

1 file changed

+3
-0
lines changed

1 file changed

+3
-0
lines changed

fs/btrfs/verity.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -578,6 +578,9 @@ static int btrfs_begin_enable_verity(struct file *filp)
578578

579579
btrfs_assert_inode_locked(inode);
580580

581+
if (IS_ENCRYPTED(&inode->vfs_inode))
582+
return -EOPNOTSUPP;
583+
581584
if (test_bit(BTRFS_INODE_VERITY_IN_PROGRESS, &inode->runtime_flags))
582585
return -EBUSY;
583586

0 commit comments

Comments
 (0)