On Tue, 2 Jun 2026 at 04:37, Eric Biggers <[email protected]> wrote: > On Wed, May 13, 2026 at 10:52:49AM +0200, Daniel Vacek wrote: > > diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c > > index 6a37dd3cc5ee..2e0b79f41197 100644 > > --- a/fs/btrfs/ioctl.c > > +++ b/fs/btrfs/ioctl.c > > @@ -5159,6 +5159,35 @@ long btrfs_ioctl(struct file *file, unsigned int > > return btrfs_ioctl_get_fslabel(fs_info, argp); > > case FS_IOC_SETFSLABEL: > > return btrfs_ioctl_set_fslabel(file, argp); > > +#ifdef CONFIG_BTRFS_EXPERIMENTAL > > + case FS_IOC_SET_ENCRYPTION_POLICY: { > > + if (!IS_ENABLED(CONFIG_FS_ENCRYPTION)) > > + return -EOPNOTSUPP; > > + if (sb_rdonly(fs_info->sb)) > > + return -EROFS; > > + /* > > + * If we crash before we commit, nothing encrypted could have > > + * been written so it doesn't matter whether the encrypted > > + * state persists. > > + */ > > + btrfs_set_fs_incompat(fs_info, ENCRYPT); > > + return fscrypt_ioctl_set_policy(file, (const void __user > > *)arg); > > + } > > + case FS_IOC_GET_ENCRYPTION_POLICY: > > + return fscrypt_ioctl_get_policy(file, (void __user *)arg); > > + case FS_IOC_GET_ENCRYPTION_POLICY_EX: > > + return fscrypt_ioctl_get_policy_ex(file, (void __user *)arg); > > + case FS_IOC_ADD_ENCRYPTION_KEY: > > + return fscrypt_ioctl_add_key(file, (void __user *)arg); > > + case FS_IOC_REMOVE_ENCRYPTION_KEY: > > + return fscrypt_ioctl_remove_key(file, (void __user *)arg); > > + case FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS: > > + return fscrypt_ioctl_remove_key_all_users(file, (void __user > > *)arg); > > + case FS_IOC_GET_ENCRYPTION_KEY_STATUS: > > + return fscrypt_ioctl_get_key_status(file, (void __user *)arg); > > + case FS_IOC_GET_ENCRYPTION_NONCE: > > + return fscrypt_ioctl_get_nonce(file, (void __user *)arg); > > +#endif /* CONFIG_BTRFS_EXPERIMENTAL */ > > Are you sure you want to auto-enable the "encrypt" feature flag like > this? It doesn't even require a privilege. > > It's also only in FS_IOC_SET_ENCRYPTION_POLICY, so this doesn't work in > cases where users add a key first.
The filesystem is flagged with encryption once the first file is encrypted. Adding a key does not change any on-disk data if I'm not mistaken. Though I'm open to suggestions. --nX > - Eric
