From: Sweet Tea Dorminy Date: Tue, 18 Nov 2025 16:08:39 +0000 (+0100) Subject: btrfs: disable verity on encrypted inodes X-Git-Tag: v6.19-rc1~167^2~11 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=45d99129b64b2311cc067b38221d475942166118;p=thirdparty%2Fkernel%2Flinux.git btrfs: disable verity on encrypted inodes Right now there isn't a way to encrypt things that aren't either filenames in directories or data on blocks on disk with extent encryption, so for now, disable verity usage with encryption on btrfs. fscrypt with fsverity should be possible and it can be implemented in the future. Note: The patch was taken from v5 of fscrypt patchset (https://lore.kernel.org/linux-btrfs/cover.1706116485.git.josef@toxicpanda.com/) which was handled over time by various people: Omar Sandoval, Sweet Tea Dorminy, Josef Bacik. Reviewed-by: Boris Burkov Signed-off-by: Sweet Tea Dorminy Signed-off-by: Daniel Vacek Reviewed-by: David Sterba [ add note ] Signed-off-by: David Sterba --- diff --git a/fs/btrfs/verity.c b/fs/btrfs/verity.c index 16f5580cba553..06dfcb461f531 100644 --- a/fs/btrfs/verity.c +++ b/fs/btrfs/verity.c @@ -578,6 +578,9 @@ static int btrfs_begin_enable_verity(struct file *filp) btrfs_assert_inode_locked(inode); + if (IS_ENCRYPTED(&inode->vfs_inode)) + return -EOPNOTSUPP; + if (test_bit(BTRFS_INODE_VERITY_IN_PROGRESS, &inode->runtime_flags)) return -EBUSY;