Commit 45d99129 authored by Sweet Tea Dorminy's avatar Sweet Tea Dorminy Committed by David Sterba
Browse files

btrfs: disable verity on encrypted inodes 

Right now there isn't a way to encrypt things that aren't either
filenames in directories or data on blocks on disk with extent
encryption, so for now, disable verity usage with encryption on btrfs.

fscrypt with fsverity should be possible and it can be implemented
in the future.

Note: The patch was taken from v5 of fscrypt patchset
(https://lore.kernel.org/linux-btrfs/cover.1706116485.git.josef@toxicpanda.com/

)
which was handled over time by various people: Omar Sandoval, Sweet Tea
Dorminy, Josef Bacik.

Reviewed-by: default avatarBoris Burkov <boris@bur.io>
Signed-off-by: default avatarSweet Tea Dorminy <sweettea-kernel@dorminy.me>
Signed-off-by: default avatarDaniel Vacek <neelx@suse.com>
Reviewed-by: default avatarDavid Sterba <dsterba@suse.com>
[ add note ]
Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
parent f9683400

fs/btrfs/verity.c

+3 −0
Original line number Diff line number Diff line
@@ -578,6 +578,9 @@ static int btrfs_begin_enable_verity(struct file *filp) 


	btrfs_assert_inode_locked(inode);



	if (IS_ENCRYPTED(&inode->vfs_inode))

		return -EOPNOTSUPP;



	if (test_bit(BTRFS_INODE_VERITY_IN_PROGRESS, &inode->runtime_flags))

		return -EBUSY;