LU-13717 sec: make client encryption compatible with ext4

In order to benefit from encrypted file handling implemented in
e2fsprogs, we need to adjust the way Lustre deals with encryption
context of files.

First, the encryption context needs to be stored in an xattr named
"encryption.c" instead of "security.c". But neither llite nor ldiskfs
has an xattr handler for this "encryption." xattr type. So we need
to export ldiskfs_xattr_get and ldiskfs_xattr_set_handle symbols for
this to work.

Second, we set the LDISKFS_ENCRYPT_FL flag on files for which we set
the 'encryption.c' xattr. But we just keep this flag for on-disk
inodes, and make sure the flag is cleared for in-memory inodes.
The purpose is to help e2fsprogs with encrypted files handling, while
not disturbing Lustre server side with the encryption flag (servers
are not supposed to know about it for Lustre client-side encryption).

To maintain compatibility with 2.14 in which encryption context is
stored in "security.c" xattr, we try to fetch enc context from this
xattr if getting it from "encryption.c" fails. On client side, in all
cases everything looks like encryption context is stored in
"encryption.c".

Lustre-change: https://review.whamcloud.com/45211
Lustre-commit: 4231fab66eab3e984499bf0c6bd4514692a409fa

Signed-off-by: Sebastien Buisson <sbuisson@ddn.com>
Change-Id: I784ec530f0dfdd2743169ba2326ff6c5cdd4e85a
Reviewed-by: Li Dongyang <dongyangli@ddn.com>
Reviewed-on: https://review.whamcloud.com/45766
Tested-by: jenkins <devops@whamcloud.com>
Tested-by: Maloo <maloo@whamcloud.com>
Reviewed-by: Andreas Dilger <adilger@whamcloud.com>

diff --git a/ldiskfs/kernel_patches/patches/linux-5.4/ext4-enc-flag.patch b/ldiskfs/kernel_patches/patches/linux-5.4/ext4-enc-flag.patch
new file mode 100644 (file)
index 0000000..6deddd7
--- /dev/null
+++ b/ldiskfs/kernel_patches/patches/linux-5.4/ext4-enc-flag.patch
@@ -0,0 +1,54 @@
+diff -wur a/fs/ext4/inode.c b/fs/ext4/inode.c
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -4766,8 +4766,9 @@ void ext4_set_inode_flags(struct inod
+               new_fl |= S_DIRSYNC;
+       if (ext4_should_use_dax(inode))
+               new_fl |= S_DAX;
+-      if (flags & EXT4_ENCRYPT_FL)
++      if (flags & EXT4_ENCRYPT_FL &&
++          unlikely(test_opt(inode->i_sb, DIRDATA) != EXT4_MOUNT_DIRDATA))
+               new_fl |= S_ENCRYPTED;
+       if (flags & EXT4_CASEFOLD_FL)
+               new_fl |= S_CASEFOLD;
+       if (flags & EXT4_VERITY_FL)
+@@ -5753,8 +5757,9 @@ int ext4_getattr(const struct path *p
+               stat->attributes |= STATX_ATTR_APPEND;
+       if (flags & EXT4_COMPR_FL)
+               stat->attributes |= STATX_ATTR_COMPRESSED;
+-      if (flags & EXT4_ENCRYPT_FL)
++      if (flags & EXT4_ENCRYPT_FL &&
++          unlikely(test_opt(inode->i_sb, DIRDATA) != EXT4_MOUNT_DIRDATA))
+               stat->attributes |= STATX_ATTR_ENCRYPTED;
+       if (flags & EXT4_IMMUTABLE_FL)
+               stat->attributes |= STATX_ATTR_IMMUTABLE;
+       if (flags & EXT4_NODUMP_FL)
+diff -wur a/fs/ext4/xattr.c b/fs/ext4/xattr.c
+--- a/fs/ext4/xattr.c
++++ b/fs/ext4/xattr.c
+@@ -654,6 +654,7 @@
+       up_read(&EXT4_I(inode)->xattr_sem);
+       return error;
+ }
++EXPORT_SYMBOL(ext4_xattr_get);
+ 
+ static int
+ ext4_xattr_list_entries(struct dentry *dentry, struct ext4_xattr_entry *entry,
+@@ -2413,12 +2415,17 @@
+                       ext4_handle_sync(handle);
+       }
+ 
++      if (!error && name_index == EXT4_XATTR_INDEX_ENCRYPTION &&
++          strcmp(name, "c") == 0)
++              EXT4_I(inode)->i_flags |= EXT4_ENCRYPT_FL;
++
+ cleanup:
+       brelse(is.iloc.bh);
+       brelse(bs.bh);
+       ext4_write_unlock_xattr(inode, &no_expand);
+       return error;
+ }
++EXPORT_SYMBOL(ext4_xattr_set_handle);
+ 
+ int ext4_xattr_set_credits(struct inode *inode, size_t value_len,
+                           bool is_create, int *credits)

diff --git a/ldiskfs/kernel_patches/patches/linux-5.8/ext4-enc-flag.patch b/ldiskfs/kernel_patches/patches/linux-5.8/ext4-enc-flag.patch
new file mode 100644 (file)
index 0000000..d8f2b22
--- /dev/null
+++ b/ldiskfs/kernel_patches/patches/linux-5.8/ext4-enc-flag.patch
@@ -0,0 +1,54 @@
+diff -wur a/fs/ext4/inode.c b/fs/ext4/inode.c
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -4766,8 +4766,9 @@ void ext4_set_inode_flags(struct inod
+       if (init && ext4_should_enable_dax(inode))
+               new_fl |= S_DAX;
+ 
+-      if (flags & EXT4_ENCRYPT_FL)
++      if (flags & EXT4_ENCRYPT_FL &&
++          unlikely(test_opt(inode->i_sb, DIRDATA) != EXT4_MOUNT_DIRDATA))
+               new_fl |= S_ENCRYPTED;
+       if (flags & EXT4_CASEFOLD_FL)
+               new_fl |= S_CASEFOLD;
+       if (flags & EXT4_VERITY_FL)
+@@ -5753,8 +5757,9 @@ int ext4_getattr(const struct path *p
+               stat->attributes |= STATX_ATTR_APPEND;
+       if (flags & EXT4_COMPR_FL)
+               stat->attributes |= STATX_ATTR_COMPRESSED;
+-      if (flags & EXT4_ENCRYPT_FL)
++      if (flags & EXT4_ENCRYPT_FL &&
++          unlikely(test_opt(inode->i_sb, DIRDATA) != EXT4_MOUNT_DIRDATA))
+               stat->attributes |= STATX_ATTR_ENCRYPTED;
+       if (flags & EXT4_IMMUTABLE_FL)
+               stat->attributes |= STATX_ATTR_IMMUTABLE;
+       if (flags & EXT4_NODUMP_FL)
+diff -wur a/fs/ext4/xattr.c b/fs/ext4/xattr.c
+--- a/fs/ext4/xattr.c
++++ b/fs/ext4/xattr.c
+@@ -654,6 +654,7 @@
+       up_read(&EXT4_I(inode)->xattr_sem);
+       return error;
+ }
++EXPORT_SYMBOL(ext4_xattr_get);
+ 
+ static int
+ ext4_xattr_list_entries(struct dentry *dentry, struct ext4_xattr_entry *entry,
+@@ -2425,12 +2425,17 @@
+                       ext4_handle_sync(handle);
+       }
+ 
++      if (!error && name_index == EXT4_XATTR_INDEX_ENCRYPTION &&
++          strcmp(name, "c") == 0)
++              EXT4_I(inode)->i_flags |= EXT4_ENCRYPT_FL;
++
+ cleanup:
+       brelse(is.iloc.bh);
+       brelse(bs.bh);
+       ext4_write_unlock_xattr(inode, &no_expand);
+       return error;
+ }
++EXPORT_SYMBOL(ext4_xattr_set_handle);
+ 
+ int ext4_xattr_set_credits(struct inode *inode, size_t value_len,
+                          bool is_create, int *credits)

diff --git a/ldiskfs/kernel_patches/patches/rhel7.9/ext4-enc-flag.patch b/ldiskfs/kernel_patches/patches/rhel7.9/ext4-enc-flag.patch
new file mode 100644 (file)
index 0000000..75814a1
--- /dev/null
+++ b/ldiskfs/kernel_patches/patches/rhel7.9/ext4-enc-flag.patch
@@ -0,0 +1,32 @@
+diff -wur a/fs/ext4/xattr.c b/fs/ext4/xattr.c
+--- a/fs/ext4/xattr.c
++++ b/fs/ext4/xattr.c
+@@ -654,6 +654,7 @@
+       up_read(&EXT4_I(inode)->xattr_sem);
+       return error;
+ }
++EXPORT_SYMBOL(ext4_xattr_get);
+ 
+ static int
+ ext4_xattr_list_entries(struct dentry *dentry, struct ext4_xattr_entry *entry,
+@@ -1197,6 +1197,7 @@
+       up_write(&EXT4_I(inode)->xattr_sem);
+       return error;
+ }
++EXPORT_SYMBOL(ext4_xattr_set_handle);
+ 
+ /*
+  * ext4_xattr_set()
+diff -wur a/fs/ext4/xattr.h b/fs/ext4/xattr.h
+--- a/fs/ext4/xattr.h
++++ b/fs/ext4/xattr.h
+@@ -121,6 +121,9 @@
+ extern const struct xattr_handler ext4_xattr_acl_default_handler;
+ extern const struct xattr_handler ext4_xattr_security_handler;
+ 
++#define LDISKFS_XATTR_INDEX_ENCRYPTION                9
++#define LDISKFS_XATTR_NAME_ENCRYPTION_CONTEXT "c"
++
+ extern ssize_t ext4_listxattr(struct dentry *, char *, size_t);
+ 
+ extern int ext4_xattr_get(struct inode *, int, const char *, void *, size_t);

diff --git a/ldiskfs/kernel_patches/patches/rhel8.4/ext4-enc-flag.patch b/ldiskfs/kernel_patches/patches/rhel8.4/ext4-enc-flag.patch
new file mode 100644 (file)
index 0000000..7256e8f
--- /dev/null
+++ b/ldiskfs/kernel_patches/patches/rhel8.4/ext4-enc-flag.patch
@@ -0,0 +1,55 @@
+diff -wur a/fs/ext4/inode.c b/fs/ext4/inode.c
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -4766,8 +4766,9 @@ void ext4_set_inode_flags(struct inod
+       if (init && ext4_should_enable_dax(inode))
+               new_fl |= S_DAX;
+ 
+-      if (flags & EXT4_ENCRYPT_FL)
++      if (flags & EXT4_ENCRYPT_FL &&
++          unlikely(test_opt(inode->i_sb, DIRDATA) != EXT4_MOUNT_DIRDATA))
+               new_fl |= S_ENCRYPTED;
+       inode_set_flags(inode, new_fl,
+                       S_SYNC|S_APPEND|S_IMMUTABLE|S_NOATIME|S_DIRSYNC|S_DAX|
+                       S_ENCRYPTED);
+@@ -5753,8 +5757,9 @@ int ext4_getattr(const struct path *p
+               stat->attributes |= STATX_ATTR_APPEND;
+       if (flags & EXT4_COMPR_FL)
+               stat->attributes |= STATX_ATTR_COMPRESSED;
+-      if (flags & EXT4_ENCRYPT_FL)
++      if (flags & EXT4_ENCRYPT_FL &&
++          unlikely(test_opt(inode->i_sb, DIRDATA) != EXT4_MOUNT_DIRDATA))
+               stat->attributes |= STATX_ATTR_ENCRYPTED;
+       if (flags & EXT4_IMMUTABLE_FL)
+               stat->attributes |= STATX_ATTR_IMMUTABLE;
+       if (flags & EXT4_NODUMP_FL)
+diff -wur a/fs/ext4/xattr.c b/fs/ext4/xattr.c
+--- a/fs/ext4/xattr.c
++++ b/fs/ext4/xattr.c
+@@ -654,6 +654,7 @@
+       up_read(&EXT4_I(inode)->xattr_sem);
+       return error;
+ }
++EXPORT_SYMBOL(ext4_xattr_get);
+ 
+ static int
+ ext4_xattr_list_entries(struct dentry *dentry, struct ext4_xattr_entry *entry,
+@@ -2413,13 +2415,18 @@
+                       ext4_handle_sync(handle);
+       }
+ 
++      if (!error && name_index == EXT4_XATTR_INDEX_ENCRYPTION &&
++          strcmp(name, "c") == 0)
++              EXT4_I(inode)->i_flags |= EXT4_ENCRYPT_FL;
++
+ cleanup:
+       brelse(is.iloc.bh);
+       brelse(bs.bh);
+       ext4_write_unlock_xattr(inode, &no_expand);
+       return error;
+ }
++EXPORT_SYMBOL(ext4_xattr_set_handle);
+ 
+ int ext4_xattr_set_credits(struct inode *inode, size_t value_len,
+                           bool is_create, int *credits)
+ 

diff --git a/ldiskfs/kernel_patches/patches/rhel8.5/ext4-enc-flag.patch b/ldiskfs/kernel_patches/patches/rhel8.5/ext4-enc-flag.patch
new file mode 100644 (file)
index 0000000..811a6ef
--- /dev/null
+++ b/ldiskfs/kernel_patches/patches/rhel8.5/ext4-enc-flag.patch
@@ -0,0 +1,54 @@
+diff -wur a/fs/ext4/inode.c b/fs/ext4/inode.c
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -4766,8 +4766,9 @@ void ext4_set_inode_flags(struct inod
+       if (init && ext4_should_enable_dax(inode))
+               new_fl |= S_DAX;
+ 
+-      if (flags & EXT4_ENCRYPT_FL)
++      if (flags & EXT4_ENCRYPT_FL &&
++          unlikely(test_opt(inode->i_sb, DIRDATA) != EXT4_MOUNT_DIRDATA))
+               new_fl |= S_ENCRYPTED;
+       inode_set_flags(inode, new_fl,
+                       S_SYNC|S_APPEND|S_IMMUTABLE|S_NOATIME|S_DIRSYNC|S_DAX|
+                       S_ENCRYPTED);
+@@ -5753,8 +5757,9 @@ int ext4_getattr(const struct path *p
+               stat->attributes |= STATX_ATTR_APPEND;
+       if (flags & EXT4_COMPR_FL)
+               stat->attributes |= STATX_ATTR_COMPRESSED;
+-      if (flags & EXT4_ENCRYPT_FL)
++      if (flags & EXT4_ENCRYPT_FL &&
++          unlikely(test_opt(inode->i_sb, DIRDATA) != EXT4_MOUNT_DIRDATA))
+               stat->attributes |= STATX_ATTR_ENCRYPTED;
+       if (flags & EXT4_IMMUTABLE_FL)
+               stat->attributes |= STATX_ATTR_IMMUTABLE;
+       if (flags & EXT4_NODUMP_FL)
+diff -wur a/fs/ext4/xattr.c b/fs/ext4/xattr.c
+--- a/fs/ext4/xattr.c
++++ b/fs/ext4/xattr.c
+@@ -654,6 +654,7 @@
+       up_read(&EXT4_I(inode)->xattr_sem);
+       return error;
+ }
++EXPORT_SYMBOL(ext4_xattr_get);
+ 
+ static int
+ ext4_xattr_list_entries(struct dentry *dentry, struct ext4_xattr_entry *entry,
+@@ -2413,12 +2413,17 @@ retry_inode:
+                       ext4_handle_sync(handle);
+       }
+ 
++      if (!error && name_index == EXT4_XATTR_INDEX_ENCRYPTION &&
++          strcmp(name, "c") == 0)
++              EXT4_I(inode)->i_flags |= EXT4_ENCRYPT_FL;
++
+ cleanup:
+       brelse(is.iloc.bh);
+       brelse(bs.bh);
+       ext4_write_unlock_xattr(inode, &no_expand);
+       return error;
+ }
++EXPORT_SYMBOL(ext4_xattr_set_handle);
+ 
+ int ext4_xattr_set_credits(struct inode *inode, size_t value_len,
+                          bool is_create, int *credits)

diff --git a/ldiskfs/kernel_patches/patches/rhel8/ext4-enc-flag.patch b/ldiskfs/kernel_patches/patches/rhel8/ext4-enc-flag.patch
new file mode 100644 (file)
index 0000000..12f4873
--- /dev/null
+++ b/ldiskfs/kernel_patches/patches/rhel8/ext4-enc-flag.patch
@@ -0,0 +1,55 @@
+diff -wur a/fs/ext4/inode.c b/fs/ext4/inode.c
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -4766,8 +4766,9 @@ void ext4_set_inode_flags(struct inod
+               new_fl |= S_DIRSYNC;
+       if (ext4_should_use_dax(inode))
+               new_fl |= S_DAX;
+-      if (flags & EXT4_ENCRYPT_FL)
++      if (flags & EXT4_ENCRYPT_FL &&
++          unlikely(test_opt(inode->i_sb, DIRDATA) != EXT4_MOUNT_DIRDATA))
+               new_fl |= S_ENCRYPTED;
+       inode_set_flags(inode, new_fl,
+                       S_SYNC|S_APPEND|S_IMMUTABLE|S_NOATIME|S_DIRSYNC|S_DAX|
+                       S_ENCRYPTED);
+@@ -5753,8 +5757,9 @@ int ext4_getattr(const struct path *p
+               stat->attributes |= STATX_ATTR_APPEND;
+       if (flags & EXT4_COMPR_FL)
+               stat->attributes |= STATX_ATTR_COMPRESSED;
+-      if (flags & EXT4_ENCRYPT_FL)
++      if (flags & EXT4_ENCRYPT_FL &&
++          unlikely(test_opt(inode->i_sb, DIRDATA) != EXT4_MOUNT_DIRDATA))
+               stat->attributes |= STATX_ATTR_ENCRYPTED;
+       if (flags & EXT4_IMMUTABLE_FL)
+               stat->attributes |= STATX_ATTR_IMMUTABLE;
+       if (flags & EXT4_NODUMP_FL)
+diff -wur a/fs/ext4/xattr.c b/fs/ext4/xattr.c
+--- a/fs/ext4/xattr.c
++++ b/fs/ext4/xattr.c
+@@ -654,6 +654,7 @@
+       up_read(&EXT4_I(inode)->xattr_sem);
+       return error;
+ }
++EXPORT_SYMBOL(ext4_xattr_get);
+ 
+ static int
+ ext4_xattr_list_entries(struct dentry *dentry, struct ext4_xattr_entry *entry,
+@@ -2413,13 +2415,18 @@
+                       ext4_handle_sync(handle);
+       }
+ 
++      if (!error && name_index == EXT4_XATTR_INDEX_ENCRYPTION &&
++          strcmp(name, "c") == 0)
++              EXT4_I(inode)->i_flags |= EXT4_ENCRYPT_FL;
++
+ cleanup:
+       brelse(is.iloc.bh);
+       brelse(bs.bh);
+       ext4_write_unlock_xattr(inode, &no_expand);
+       return error;
+ }
++EXPORT_SYMBOL(ext4_xattr_set_handle);
+ 
+ int ext4_xattr_set_credits(struct inode *inode, size_t value_len,
+                           bool is_create, int *credits)
+ 

diff --git a/ldiskfs/kernel_patches/series/ldiskfs-3.10-rhel7.6.series b/ldiskfs/kernel_patches/series/ldiskfs-3.10-rhel7.6.series
index 23150e1..c0aa890 100644 (file)
--- a/ldiskfs/kernel_patches/series/ldiskfs-3.10-rhel7.6.series
+++ b/ldiskfs/kernel_patches/series/ldiskfs-3.10-rhel7.6.series
@@ -50,5 +50,6 @@ rhel7.6/ext4-introduce-aging-to-extent-status-tree.patch
 base/ext4-no-max-dir-size-limit-for-iam-objects.patch
 rhel7.6/ext4-dquot-commit-speedup.patch
 rhel7.6/ext4-loadbitmaps.patch
+rhel7.9/ext4-enc-flag.patch
 rhel7.7/ext4-ialloc-uid-gid-and-pass-owner-down.patch
 rhel7.6/ext4-projid-xattrs.patch

diff --git a/ldiskfs/kernel_patches/series/ldiskfs-3.10-rhel7.7.series b/ldiskfs/kernel_patches/series/ldiskfs-3.10-rhel7.7.series
index d57b82f..3b05585 100644 (file)
--- a/ldiskfs/kernel_patches/series/ldiskfs-3.10-rhel7.7.series
+++ b/ldiskfs/kernel_patches/series/ldiskfs-3.10-rhel7.7.series
@@ -50,5 +50,6 @@ rhel7.6/ext4-introduce-aging-to-extent-status-tree.patch
 base/ext4-no-max-dir-size-limit-for-iam-objects.patch
 rhel7.6/ext4-dquot-commit-speedup.patch
 rhel7.7/ext4-loadbitmaps.patch
+rhel7.9/ext4-enc-flag.patch
 rhel7.7/ext4-ialloc-uid-gid-and-pass-owner-down.patch
 rhel7.6/ext4-projid-xattrs.patch

diff --git a/ldiskfs/kernel_patches/series/ldiskfs-3.10-rhel7.8.series b/ldiskfs/kernel_patches/series/ldiskfs-3.10-rhel7.8.series
index 72d308f..f93be4b 100644 (file)
--- a/ldiskfs/kernel_patches/series/ldiskfs-3.10-rhel7.8.series
+++ b/ldiskfs/kernel_patches/series/ldiskfs-3.10-rhel7.8.series
@@ -42,5 +42,6 @@ rhel7.6/ext4-mballoc-skip-uninit-groups-cr0.patch
 rhel7.7/ext4-mballoc-prefetch.patch
 base/ext4-no-max-dir-size-limit-for-iam-objects.patch
 rhel7.6/ext4-dquot-commit-speedup.patch
+rhel7.9/ext4-enc-flag.patch
 rhel7.7/ext4-ialloc-uid-gid-and-pass-owner-down.patch
 rhel7.6/ext4-projid-xattrs.patch

diff --git a/ldiskfs/kernel_patches/series/ldiskfs-3.10-rhel7.9.series b/ldiskfs/kernel_patches/series/ldiskfs-3.10-rhel7.9.series
index a50604c..42a59a2 100644 (file)
--- a/ldiskfs/kernel_patches/series/ldiskfs-3.10-rhel7.9.series
+++ b/ldiskfs/kernel_patches/series/ldiskfs-3.10-rhel7.9.series
@@ -42,5 +42,6 @@ rhel7.6/ext4-mballoc-skip-uninit-groups-cr0.patch
 rhel7.7/ext4-mballoc-prefetch.patch
 base/ext4-no-max-dir-size-limit-for-iam-objects.patch
 rhel7.6/ext4-dquot-commit-speedup.patch
+rhel7.9/ext4-enc-flag.patch
 rhel7.7/ext4-ialloc-uid-gid-and-pass-owner-down.patch
 rhel7.6/ext4-projid-xattrs.patch

diff --git a/ldiskfs/kernel_patches/series/ldiskfs-4.18-rhel8.1.series b/ldiskfs/kernel_patches/series/ldiskfs-4.18-rhel8.1.series
index d34d03d..a6b41fc 100644 (file)
--- a/ldiskfs/kernel_patches/series/ldiskfs-4.18-rhel8.1.series
+++ b/ldiskfs/kernel_patches/series/ldiskfs-4.18-rhel8.1.series
@@ -26,5 +26,6 @@ rhel8/ext4-mballoc-skip-uninit-groups-cr0.patch
 rhel8.1/ext4-mballoc-prefetch.patch
 rhel8/ext4-xattr-disable-credits-check.patch
 base/ext4-no-max-dir-size-limit-for-iam-objects.patch
+rhel8/linux-5.4/ext4-enc-flag.patch
 rhel8/ext4-ialloc-uid-gid-and-pass-owner-down.patch
 base/ext4-projid-xattrs.patch

diff --git a/ldiskfs/kernel_patches/series/ldiskfs-4.18-rhel8.2.series b/ldiskfs/kernel_patches/series/ldiskfs-4.18-rhel8.2.series
index 02d29aa..11da2f6 100644 (file)
--- a/ldiskfs/kernel_patches/series/ldiskfs-4.18-rhel8.2.series
+++ b/ldiskfs/kernel_patches/series/ldiskfs-4.18-rhel8.2.series
@@ -26,5 +26,6 @@ rhel8/ext4-mballoc-skip-uninit-groups-cr0.patch
 rhel8.1/ext4-mballoc-prefetch.patch
 rhel8/ext4-xattr-disable-credits-check.patch
 base/ext4-no-max-dir-size-limit-for-iam-objects.patch
+rhel8/ext4-enc-flag.patch
 rhel8/ext4-ialloc-uid-gid-and-pass-owner-down.patch
 base/ext4-projid-xattrs.patch

diff --git a/ldiskfs/kernel_patches/series/ldiskfs-4.18-rhel8.3.series b/ldiskfs/kernel_patches/series/ldiskfs-4.18-rhel8.3.series
index 3a0ce31..d2c719d 100644 (file)
--- a/ldiskfs/kernel_patches/series/ldiskfs-4.18-rhel8.3.series
+++ b/ldiskfs/kernel_patches/series/ldiskfs-4.18-rhel8.3.series
@@ -26,5 +26,6 @@ rhel8/ext4-mballoc-skip-uninit-groups-cr0.patch
 rhel8.1/ext4-mballoc-prefetch.patch
 rhel8.3/ext4-xattr-disable-credits-check.patch
 base/ext4-no-max-dir-size-limit-for-iam-objects.patch
+rhel8/ext4-enc-flag.patch
 rhel8/ext4-ialloc-uid-gid-and-pass-owner-down.patch
 base/ext4-projid-xattrs.patch

diff --git a/ldiskfs/kernel_patches/series/ldiskfs-4.18-rhel8.4.series b/ldiskfs/kernel_patches/series/ldiskfs-4.18-rhel8.4.series
index 9528ef5..8a49e14 100644 (file)
--- a/ldiskfs/kernel_patches/series/ldiskfs-4.18-rhel8.4.series
+++ b/ldiskfs/kernel_patches/series/ldiskfs-4.18-rhel8.4.series
@@ -26,5 +26,6 @@ rhel8/ext4-mballoc-skip-uninit-groups-cr0.patch
 rhel8.1/ext4-mballoc-prefetch.patch
 rhel8.3/ext4-xattr-disable-credits-check.patch
 base/ext4-no-max-dir-size-limit-for-iam-objects.patch
+rhel8.4/ext4-enc-flag.patch
 rhel8/ext4-ialloc-uid-gid-and-pass-owner-down.patch
 base/ext4-projid-xattrs.patch

diff --git a/ldiskfs/kernel_patches/series/ldiskfs-4.18-rhel8.5.series b/ldiskfs/kernel_patches/series/ldiskfs-4.18-rhel8.5.series
index 7683149..8a49e14 100644 (file)
--- a/ldiskfs/kernel_patches/series/ldiskfs-4.18-rhel8.5.series
+++ b/ldiskfs/kernel_patches/series/ldiskfs-4.18-rhel8.5.series
@@ -26,4 +26,6 @@ rhel8/ext4-mballoc-skip-uninit-groups-cr0.patch
 rhel8.1/ext4-mballoc-prefetch.patch
 rhel8.3/ext4-xattr-disable-credits-check.patch
 base/ext4-no-max-dir-size-limit-for-iam-objects.patch
+rhel8.4/ext4-enc-flag.patch
 rhel8/ext4-ialloc-uid-gid-and-pass-owner-down.patch
+base/ext4-projid-xattrs.patch

diff --git a/ldiskfs/kernel_patches/series/ldiskfs-4.18-rhel8.series b/ldiskfs/kernel_patches/series/ldiskfs-4.18-rhel8.series
index f013041..142e690 100644 (file)
--- a/ldiskfs/kernel_patches/series/ldiskfs-4.18-rhel8.series
+++ b/ldiskfs/kernel_patches/series/ldiskfs-4.18-rhel8.series
@@ -28,5 +28,6 @@ rhel8/ext4-mballoc-prefetch.patch
 rhel8/ext4-xattr-disable-credits-check.patch
 base/ext4-no-max-dir-size-limit-for-iam-objects.patch
 base/ext4-reset-exts-for-gcc10.patch
+rhel8/ext4-enc-flag.patch
 rhel8/ext4-ialloc-uid-gid-and-pass-owner-down.patch
 ubuntu18/ext4-projid-xattrs.patch

diff --git a/ldiskfs/kernel_patches/series/ldiskfs-5.4.0-42-ubuntu20.series b/ldiskfs/kernel_patches/series/ldiskfs-5.4.0-42-ubuntu20.series
index b4b3fde..9bb1c6b 100644 (file)
--- a/ldiskfs/kernel_patches/series/ldiskfs-5.4.0-42-ubuntu20.series
+++ b/ldiskfs/kernel_patches/series/ldiskfs-5.4.0-42-ubuntu20.series
@@ -26,5 +26,6 @@ linux-5.4/export-ext4fs-dirhash-helper.patch
 linux-5.4/ext4-misc.patch
 rhel8/ext4-simple-blockalloc.patch
 base/ext4-no-max-dir-size-limit-for-iam-objects.patch
+linux-5.4/ext4-enc-flag.patch
 rhel8/ext4-ialloc-uid-gid-and-pass-owner-down.patch
 base/ext4-projid-xattrs.patch

diff --git a/ldiskfs/kernel_patches/series/ldiskfs-5.4.0-66-ubuntu20.series b/ldiskfs/kernel_patches/series/ldiskfs-5.4.0-66-ubuntu20.series
index 6cc4567..49a9b3c 100644 (file)
--- a/ldiskfs/kernel_patches/series/ldiskfs-5.4.0-66-ubuntu20.series
+++ b/ldiskfs/kernel_patches/series/ldiskfs-5.4.0-66-ubuntu20.series
@@ -26,5 +26,6 @@ linux-5.4/export-ext4fs-dirhash-helper.patch
 linux-5.4/ext4-misc.patch
 rhel8/ext4-simple-blockalloc.patch
 base/ext4-no-max-dir-size-limit-for-iam-objects.patch
+linux-5.4/ext4-enc-flag.patch
 rhel8/ext4-ialloc-uid-gid-and-pass-owner-down.patch
 base/ext4-projid-xattrs.patch

diff --git a/ldiskfs/kernel_patches/series/ldiskfs-5.4.0-ml.series b/ldiskfs/kernel_patches/series/ldiskfs-5.4.0-ml.series
index 49f32db..6a66a8d 100644 (file)
--- a/ldiskfs/kernel_patches/series/ldiskfs-5.4.0-ml.series
+++ b/ldiskfs/kernel_patches/series/ldiskfs-5.4.0-ml.series
@@ -26,5 +26,6 @@ linux-5.4/export-ext4fs-dirhash-helper.patch
 linux-5.4/ext4-misc.patch
 rhel8/ext4-simple-blockalloc.patch
 base/ext4-no-max-dir-size-limit-for-iam-objects.patch
+linux-5.4/ext4-enc-flag.patch
 rhel8/ext4-ialloc-uid-gid-and-pass-owner-down.patch
 base/ext4-projid-xattrs.patch

diff --git a/ldiskfs/kernel_patches/series/ldiskfs-5.4.21-ml.series b/ldiskfs/kernel_patches/series/ldiskfs-5.4.21-ml.series
index b4b3fde..9bb1c6b 100644 (file)
--- a/ldiskfs/kernel_patches/series/ldiskfs-5.4.21-ml.series
+++ b/ldiskfs/kernel_patches/series/ldiskfs-5.4.21-ml.series
@@ -26,5 +26,6 @@ linux-5.4/export-ext4fs-dirhash-helper.patch
 linux-5.4/ext4-misc.patch
 rhel8/ext4-simple-blockalloc.patch
 base/ext4-no-max-dir-size-limit-for-iam-objects.patch
+linux-5.4/ext4-enc-flag.patch
 rhel8/ext4-ialloc-uid-gid-and-pass-owner-down.patch
 base/ext4-projid-xattrs.patch

diff --git a/ldiskfs/kernel_patches/series/ldiskfs-5.8.0-ml.series b/ldiskfs/kernel_patches/series/ldiskfs-5.8.0-ml.series
index ef91523..579d789 100644 (file)
--- a/ldiskfs/kernel_patches/series/ldiskfs-5.8.0-ml.series
+++ b/ldiskfs/kernel_patches/series/ldiskfs-5.8.0-ml.series
@@ -25,5 +25,6 @@ ubuntu19/ext4-iget-with-flags.patch
 linux-5.4/export-ext4fs-dirhash-helper.patch
 linux-5.4/ext4-misc.patch
 linux-5.8/ext4-simple-blockalloc.patch
+linux-5.8/ext4-enc-flag.patch
 linux-5.8/ext4-no-max-dir-size-limit-for-iam-objects.patch
 base/ext4-projid-xattrs.patch

diff --git a/lustre/include/uapi/linux/lustre/lustre_idl.h b/lustre/include/uapi/linux/lustre/lustre_idl.h
index 6109676..db02d47 100644 (file)
--- a/lustre/include/uapi/linux/lustre/lustre_idl.h
+++ b/lustre/include/uapi/linux/lustre/lustre_idl.h
@@ -1222,6 +1222,7 @@ struct lov_mds_md_v1 {            /* LOV EA mds/wire data (little-endian) */
 #define XATTR_USER_PREFIX       "user."
 #define XATTR_TRUSTED_PREFIX    "trusted."
 #define XATTR_SECURITY_PREFIX   "security."
+#define XATTR_ENCRYPTION_PREFIX        "encryption."
 
 #define XATTR_NAME_SOM         "trusted.som"
 #define XATTR_NAME_LOV          "trusted.lov"
@@ -1237,7 +1238,8 @@ struct lov_mds_md_v1 {            /* LOV EA mds/wire data (little-endian) */
 #define XATTR_NAME_DUMMY       "trusted.dummy"
 #define XATTR_NAME_PROJID      "trusted.projid"
 
-#define LL_XATTR_NAME_ENCRYPTION_CONTEXT XATTR_SECURITY_PREFIX"c"
+#define LL_XATTR_NAME_ENCRYPTION_CONTEXT_OLD XATTR_SECURITY_PREFIX"c"
+#define LL_XATTR_NAME_ENCRYPTION_CONTEXT XATTR_ENCRYPTION_PREFIX"c"
 
 #define XATTR_NAME_LFSCK_NAMESPACE "trusted.lfsck_ns"
 #define XATTR_NAME_MAX_LEN     32 /* increase this, if there is longer name. */

diff --git a/lustre/llite/crypto.c b/lustre/llite/crypto.c
index 51db6d2..14ec437 100644 (file)
--- a/lustre/llite/crypto.c
+++ b/lustre/llite/crypto.c
@@ -32,29 +32,13 @@
 
 static int ll_get_context(struct inode *inode, void *ctx, size_t len)
 {
-       struct dentry *dentry = d_find_any_alias(inode);
-       struct lu_env *env;
-       __u16 refcheck;
        int rc;
 
-       env = cl_env_get(&refcheck);
-       if (IS_ERR(env))
-               return PTR_ERR(env);
-
-       /* Set lcc_getencctx=1 to allow this thread to read
-        * LL_XATTR_NAME_ENCRYPTION_CONTEXT xattr, as requested by llcrypt.
+       /* Get enc context xattr directly instead of going through the VFS,
+        * as there is no xattr handler for "encryption.".
         */
-       ll_cl_add(inode, env, NULL, LCC_RW);
-       ll_env_info(env)->lti_io_ctx.lcc_getencctx = 1;
-
-       rc = ll_vfs_getxattr(dentry, inode, LL_XATTR_NAME_ENCRYPTION_CONTEXT,
-                            ctx, len);
-
-       ll_cl_remove(inode, env);
-       cl_env_put(env, &refcheck);
-
-       if (dentry)
-               dput(dentry);
+       rc = ll_xattr_list(inode, LL_XATTR_NAME_ENCRYPTION_CONTEXT,
+                          XATTR_ENCRYPTION_T, ctx, len, OBD_MD_FLXATTR);
 
        /* used as encryption unit size */
        if (S_ISREG(inode->i_mode))
@@ -91,15 +75,15 @@ int ll_set_encflags(struct inode *inode, void *encctx, __u32 encctxlen,
  *   op_data, so that it will be sent along to the server with the request that
  *   the caller is preparing, thus saving a setxattr request.
  * - inode is not NULL:
- *   normal case in which passed fs_data is a struct dentry *, letting proceed
- *   with setxattr operation.
+ *   normal case, letting proceed with setxattr operation.
  *   This use case should only be used when explicitly setting a new encryption
  *   policy on an existing, empty directory.
  */
 static int ll_set_context(struct inode *inode, const void *ctx, size_t len,
                          void *fs_data)
 {
-       struct dentry *dentry;
+       struct ptlrpc_request *req = NULL;
+       struct ll_sb_info *sbi;
        int rc;
 
        if (inode == NULL) {
@@ -120,12 +104,16 @@ static int ll_set_context(struct inode *inode, const void *ctx, size_t len,
        if (inode->i_ino == inode->i_sb->s_root->d_inode->i_ino)
                return -EPERM;
 
-       dentry = (struct dentry *)fs_data;
-       ll_file_set_flag(ll_i2info(inode), LLIF_SET_ENC_CTX);
-       rc = ll_vfs_setxattr(dentry, inode, LL_XATTR_NAME_ENCRYPTION_CONTEXT,
-                            ctx, len, XATTR_CREATE);
+       sbi = ll_i2sbi(inode);
+       /* Send setxattr request to lower layers directly instead of going
+        * through the VFS, as there is no xattr handler for "encryption.".
+        */
+       rc = md_setxattr(sbi->ll_md_exp, ll_inode2fid(inode),
+                        OBD_MD_FLXATTR, LL_XATTR_NAME_ENCRYPTION_CONTEXT,
+                        ctx, len, XATTR_CREATE, ll_i2suppgid(inode), &req);
        if (rc)
                return rc;
+       ptlrpc_req_finished(req);
 
        return ll_set_encflags(inode, (void *)ctx, len, false);
 }

diff --git a/lustre/llite/llite_internal.h b/lustre/llite/llite_internal.h
index 51656f1..f197efe 100644 (file)
--- a/lustre/llite/llite_internal.h
+++ b/lustre/llite/llite_internal.h
@@ -437,8 +437,6 @@ enum ll_file_flags {
        LLIF_PROJECT_INHERIT    = 3,
        /* update atime from MDS even if it's older than local inode atime. */
        LLIF_UPDATE_ATIME       = 4,
-       /* setting encryption context in progress */
-       LLIF_SET_ENC_CTX        = 6,
        /* Xattr cache is filled */
        LLIF_XATTR_CACHE_FILLED = 7,
 
@@ -1369,11 +1367,6 @@ struct ll_cl_context {
        struct cl_io            *lcc_io;
        struct cl_page          *lcc_page;
        enum lcc_type            lcc_type;
-       /**
-        * Get encryption context operation in progress,
-        * allow getxattr of LL_XATTR_NAME_ENCRYPTION_CONTEXT xattr
-        */
-       unsigned                 lcc_getencctx:1;
 };
 
 struct ll_thread_info {
@@ -1486,6 +1479,7 @@ extern const struct xattr_handler *ll_xattr_handlers[];
 #define XATTR_ACL_DEFAULT_T    5
 #define XATTR_LUSTRE_T         6
 #define XATTR_OTHER_T          7
+#define XATTR_ENCRYPTION_T     9
 
 ssize_t ll_listxattr(struct dentry *dentry, char *buffer, size_t size);
 int ll_xattr_list(struct inode *inode, const char *name, int type,

diff --git a/lustre/llite/xattr.c b/lustre/llite/xattr.c
index b58cfbe..6081a4b 100644 (file)
--- a/lustre/llite/xattr.c
+++ b/lustre/llite/xattr.c
@@ -154,15 +154,14 @@ static int ll_xattr_set_common(const struct xattr_handler *handler,
                        RETURN(-EPERM);
        }
 
-       /* Setting LL_XATTR_NAME_ENCRYPTION_CONTEXT xattr is only allowed
-        * when defining an encryption policy on a directory, ie when it
-        * comes from ll_set_context().
-        * When new files/dirs are created in an encrypted dir, the xattr
-        * is set directly in the create request.
+       /* This check is required for compatibility with 2.14, in which
+        * encryption context is stored in security.c xattr.
+        * Setting the encryption context should only be possible by llcrypt
+        * when defining an encryption policy on a directory.
+        * When new files/dirs are created in an encrypted dir, the enc
+        * context is set directly in the create request.
         */
-       if (handler->flags == XATTR_SECURITY_T &&
-           !strcmp(name, "c") &&
-           !ll_file_test_and_clear_flag(ll_i2info(inode), LLIF_SET_ENC_CTX))
+       if (handler->flags == XATTR_SECURITY_T && strcmp(name, "c") == 0)
                RETURN(-EPERM);
 
        fullname = kasprintf(GFP_KERNEL, "%s%s", xattr_prefix(handler), name);
@@ -393,18 +392,12 @@ int ll_xattr_list(struct inode *inode, const char *name, int type, void *buffer,
        int rc;
        ENTRY;
 
-       /* Getting LL_XATTR_NAME_ENCRYPTION_CONTEXT xattr is only allowed
-        * when it comes from ll_get_context(), ie when llcrypt needs to
-        * know the encryption context.
-        * Otherwise, any direct reading of this xattr returns -EPERM.
+       /* This check is required for compatibility with 2.14, in which
+        * encryption context is stored in security.c xattr. Accessing the
+        * encryption context should only be possible by llcrypt.
         */
-       if (type == XATTR_SECURITY_T &&
-           !strcmp(name, LL_XATTR_NAME_ENCRYPTION_CONTEXT)) {
-               struct ll_cl_context *lcc = ll_cl_find(inode);
-
-               if (!lcc || !lcc->lcc_getencctx)
-                       GOTO(out_xattr, rc = -EPERM);
-       }
+       if (type == XATTR_SECURITY_T && strcmp(name, "security.c") == 0)
+               GOTO(out_xattr, rc = -EPERM);
 
        if (sbi->ll_xattr_cache_enabled && type != XATTR_ACL_ACCESS_T &&
            (type != XATTR_SECURITY_T || strcmp(name, "security.selinux"))) {
@@ -637,7 +630,6 @@ static int ll_xattr_get(const struct xattr_handler *handler,
 
 ssize_t ll_listxattr(struct dentry *dentry, char *buffer, size_t size)
 {
-       struct inode *dir = d_inode(dentry->d_parent);
        struct inode *inode = dentry->d_inode;
        struct ll_sb_info *sbi = ll_i2sbi(inode);
        ktime_t kstart = ktime_get();
@@ -667,38 +659,37 @@ ssize_t ll_listxattr(struct dentry *dentry, char *buffer, size_t size)
        rem = rc;
 
        while (rem > 0) {
+               const struct xattr_handler *xh = get_xattr_type(xattr_name);
                bool hide_xattr = false;
 
-               /* Listing xattrs should not expose
-                * LL_XATTR_NAME_ENCRYPTION_CONTEXT xattr, unless it comes
-                * from llcrypt.
-                */
-               if (get_xattr_type(xattr_name)->flags == XATTR_SECURITY_T &&
-                   !strcmp(xattr_name, LL_XATTR_NAME_ENCRYPTION_CONTEXT)) {
-                       struct ll_cl_context *lcc = ll_cl_find(inode);
-
-                       if (!lcc || !lcc->lcc_getencctx)
-                               hide_xattr = true;
-               }
-
                /* Hide virtual project id xattr from the list when
                 * parent has the inherit flag and the same project id,
                 * so project id won't be messed up by copying the xattrs
                 * when mv to a tree with different project id.
                 */
-               if (get_xattr_type(xattr_name)->flags == XATTR_TRUSTED_T &&
+               if (xh && xh->flags == XATTR_TRUSTED_T &&
                    strcmp(xattr_name, XATTR_NAME_PROJID) == 0) {
-                       if (ll_i2info(inode)->lli_projid ==
-                                       ll_i2info(dir)->lli_projid &&
+                       struct inode *dir = d_inode(dentry->d_parent);
+
+                       if ((ll_i2info(inode)->lli_projid ==
+                            ll_i2info(dir)->lli_projid) &&
                            test_bit(LLIF_PROJECT_INHERIT,
                                     &ll_i2info(dir)->lli_flags))
                                hide_xattr = true;
+               } else if (xh && xh->flags == XATTR_SECURITY_T &&
+                          strcmp(xattr_name, "security.c") == 0) {
+                       /* Listing xattrs should not expose encryption
+                        * context. There is no handler defined for
+                        * XATTR_ENCRYPTION_PREFIX, so this test is just
+                        * needed for compatibility with 2.14, in which
+                        * encryption context is stored in security.c xattr.
+                        */
+                       hide_xattr = true;
                }
 
                len = strnlen(xattr_name, rem - 1) + 1;
                rem -= len;
-               if (!xattr_type_filter(sbi, hide_xattr ? NULL :
-                                      get_xattr_type(xattr_name))) {
+               if (!xattr_type_filter(sbi, hide_xattr ? NULL : xh)) {
                        /* Skip OK xattr type, leave it in buffer. */
                        xattr_name += len;
                        continue;

diff --git a/lustre/mdt/mdt_lib.c b/lustre/mdt/mdt_lib.c
index b6dda16..421f4fe 100644 (file)
--- a/lustre/mdt/mdt_lib.c
+++ b/lustre/mdt/mdt_lib.c
@@ -1995,6 +1995,12 @@ int mdt_pack_encctx_in_reply(struct mdt_thread_info *info,
                                          mdt_object_child(child),
                                          buffer,
                                          LL_XATTR_NAME_ENCRYPTION_CONTEXT);
+                       if (unlikely(rc == -ENODATA))
+                               /* For compatibility with 2.14 */
+                               rc = mo_xattr_get(info->mti_env,
+                                         mdt_object_child(child),
+                                         buffer,
+                                         LL_XATTR_NAME_ENCRYPTION_CONTEXT_OLD);
                        if (rc >= 0) {
                                CDEBUG(D_SEC,
                                       "found encryption ctx of size %d for "DFID"\n",

diff --git a/lustre/osd-ldiskfs/osd_handler.c b/lustre/osd-ldiskfs/osd_handler.c
index 9c6b126..17f3c7e 100644 (file)
--- a/lustre/osd-ldiskfs/osd_handler.c
+++ b/lustre/osd-ldiskfs/osd_handler.c
@@ -4483,8 +4483,18 @@ static int osd_xattr_get(const struct lu_env *env, struct dt_object *dt,
                        ol->ol_comp_id = 0;
                }
        } else {
-               rc = __osd_xattr_get(inode, dentry, name,
-                                    buf->lb_buf, buf->lb_len);
+               /* Get enc context xattr directly from ldiskfs instead of going
+                * through the VFS, as there is no xattr handler for
+                * "encryption.".
+                */
+               if (strcmp(name, LL_XATTR_NAME_ENCRYPTION_CONTEXT) == 0)
+                       rc = ldiskfs_xattr_get(inode,
+                                         LDISKFS_XATTR_INDEX_ENCRYPTION,
+                                         LDISKFS_XATTR_NAME_ENCRYPTION_CONTEXT,
+                                         buf->lb_buf, buf->lb_len);
+               else
+                       rc = __osd_xattr_get(inode, dentry, name,
+                                            buf->lb_buf, buf->lb_len);
        }
 
        if (cache_xattr) {
@@ -4852,7 +4862,27 @@ static int osd_xattr_set(const struct lu_env *env, struct dt_object *dt,
        if (fl & LU_XATTR_CREATE)
                fs_flags |= XATTR_CREATE;
 
-       rc = __osd_xattr_set(info, inode, name, buf->lb_buf, len, fs_flags);
+       if (strcmp(name, LL_XATTR_NAME_ENCRYPTION_CONTEXT) == 0) {
+               /* Set enc context xattr directly in ldiskfs instead of going
+                * through the VFS, as there is no xattr handler for
+                * "encryption.".
+                */
+               struct osd_thandle *oth = container_of(handle,
+                                                      struct osd_thandle,
+                                                      ot_super);
+
+               if (!oth->ot_handle)
+                       /* this should be already part of a transaction */
+                       RETURN(-EPROTO);
+
+               rc = ldiskfs_xattr_set_handle(oth->ot_handle, inode,
+                                         LDISKFS_XATTR_INDEX_ENCRYPTION,
+                                         LDISKFS_XATTR_NAME_ENCRYPTION_CONTEXT,
+                                         buf->lb_buf, len, fs_flags);
+       } else {
+               rc = __osd_xattr_set(info, inode, name,
+                                    buf->lb_buf, len, fs_flags);
+       }
        osd_trans_exec_check(env, handle, OSD_OT_XATTR_SET);
 
        if (rc == 0 &&

diff --git a/lustre/tests/sanity-sec.sh b/lustre/tests/sanity-sec.sh
index 1ae3fda..d86d134 100755 (executable)
--- a/lustre/tests/sanity-sec.sh
+++ b/lustre/tests/sanity-sec.sh
@@ -3618,7 +3618,7 @@ trace_cmd() {
        [ $? -eq 0 ] || error "$cmd failed"
 
        if [ -z "$MATCHING_STRING" ]; then
-               $LCTL dk | grep -E "get xattr 'security.c'|get xattrs"
+               $LCTL dk | grep -E "get xattr 'encryption.c'|get xattrs"
        else
                $LCTL dk | grep -E "$MATCHING_STRING"
        fi
@@ -3644,7 +3644,7 @@ test_49() {
        trace_cmd stat $dirname/f1
        trace_cmd cat $dirname/f1
        dd if=/dev/zero of=$dirname/f1 bs=1M count=10 conv=fsync
-       MATCHING_STRING="get xattr 'security.c'" \
+       MATCHING_STRING="get xattr 'encryption.c'" \
                trace_cmd $TRUNCATE $dirname/f1 10240
        trace_cmd $LFS setstripe -E -1 -S 4M $dirname/f2
        trace_cmd $LFS migrate -E -1 -S 256K $dirname/f2
@@ -3665,7 +3665,7 @@ test_49() {
                trace_cmd stat $dirname/f1
                trace_cmd cat $dirname/f1
                dd if=/dev/zero of=$dirname/f1 bs=1M count=10 conv=fsync
-               MATCHING_STRING="get xattr 'security.c'" \
+               MATCHING_STRING="get xattr 'encryption.c'" \
                        trace_cmd $TRUNCATE $dirname/f1 10240
                trace_cmd $LFS setstripe -E -1 -S 4M $dirname/f2
                trace_cmd $LFS migrate -E -1 -S 256K $dirname/f2
@@ -4299,10 +4299,14 @@ test_57() {
        mkdir $DIR/$tdir
        mkdir $testdir
        setfattr -n security.c -v myval $testdir &&
-               error "setting xattr on $testdir should have failed (1)"
+               error "setting xattr on $testdir should have failed (1.1)"
+       setfattr -n encryption.c -v myval $testdir &&
+               error "setting xattr on $testdir should have failed (1.2)"
        touch $testfile
        setfattr -n security.c -v myval $testfile &&
-               error "setting xattr on $testfile should have failed (1)"
+               error "setting xattr on $testfile should have failed (1.1)"
+       setfattr -n encryption.c -v myval $testfile &&
+               error "setting xattr on $testfile should have failed (1.2)"
 
        rm -rf $DIR/$tdir
 
@@ -4312,28 +4316,48 @@ test_57() {
        mkdir $testdir
        if [ $(getfattr -n security.c $testdir 2>&1 |
               grep -ci "Operation not permitted") -eq 0 ]; then
-               error "getting xattr on $testdir should have failed"
+               error "getting xattr on $testdir should have failed (1.1)"
+       fi
+       if [ $(getfattr -n encryption.c $testdir 2>&1 |
+              grep -ci "Operation not supported") -eq 0 ]; then
+               error "getting xattr on $testdir should have failed (1.2)"
        fi
        getfattr -d -m - $testdir 2>&1 | grep security\.c &&
                error "listing xattrs on $testdir should not expose security.c"
+       getfattr -d -m - $testdir 2>&1 | grep encryption\.c &&
+              error "listing xattrs on $testdir should not expose encryption.c"
        if [ $(setfattr -n security.c -v myval $testdir 2>&1 |
               grep -ci "Operation not permitted") -eq 0 ]; then
-               error "setting xattr on $testdir should have failed (2)"
+               error "setting xattr on $testdir should have failed (2.1)"
+       fi
+       if [ $(setfattr -n encryption.c -v myval $testdir 2>&1 |
+              grep -ci "Operation not supported") -eq 0 ]; then
+               error "setting xattr on $testdir should have failed (2.2)"
        fi
        touch $testfile
        if [ $(getfattr -n security.c $testfile 2>&1 |
               grep -ci "Operation not permitted") -eq 0 ]; then
-               error "getting xattr on $testfile should have failed"
+               error "getting xattr on $testfile should have failed (1.1)"
+       fi
+       if [ $(getfattr -n encryption.c $testfile 2>&1 |
+              grep -ci "Operation not supported") -eq 0 ]; then
+               error "getting xattr on $testfile should have failed (1.2)"
        fi
        getfattr -d -m - $testfile 2>&1 | grep security\.c &&
                error "listing xattrs on $testfile should not expose security.c"
+       getfattr -d -m - $testfile 2>&1 | grep encryption\.c &&
+             error "listing xattrs on $testfile should not expose encryption.c"
        if [ $(setfattr -n security.c -v myval $testfile 2>&1 |
               grep -ci "Operation not permitted") -eq 0 ]; then
-               error "setting xattr on $testfile should have failed (2)"
+               error "setting xattr on $testfile should have failed (2.1)"
+       fi
+       if [ $(setfattr -n encryption.c -v myval $testfile 2>&1 |
+              grep -ci "Operation not supported") -eq 0 ]; then
+               error "setting xattr on $testfile should have failed (2.2)"
        fi
        return 0
 }
-run_test 57 "security.c xattr protection"
+run_test 57 "security.c/encryption.c xattr protection"
 
 test_58() {
        local testdir=$DIR/$tdir/mytestdir