From: Sebastien Buisson Date: Fri, 3 Jun 2022 09:16:35 +0000 (+0200) Subject: LU-15911 enc: null encrypted names is embedded llcrypt only X-Git-Tag: 2.15.52~16 X-Git-Url: https://git.whamcloud.com/?p=fs%2Flustre-release.git;a=commitdiff_plain;h=4887aff7f10423674939682a2fd56f0490224e6e LU-15911 enc: null encrypted names is embedded llcrypt only enable_filename_encryption tunable only makes sense when Lustre client is built against embedded llcrypt. When built against in-kernel fscrypt, this tunable is silently ignored, as fscrypt always carries out file name encryption. So have the enable_filename_encryption tunable only when Lustre client is built against embedded llcrypt. Also fix sanity-sec test_54 so that it works for in-kernel fscrypt. Fixes: e68d496ada ("LU-15858 sec: reinstate null encryption for file names") Signed-off-by: Sebastien Buisson Change-Id: Ibe52feb670a00c9f421907ecd438bcccc62856f0 Reviewed-on: https://review.whamcloud.com/47520 Reviewed-by: Andreas Dilger Tested-by: jenkins Tested-by: Maloo Reviewed-by: James Simmons Tested-by: James Simmons Reviewed-by: Oleg Drokin --- diff --git a/lustre/llite/llite_lib.c b/lustre/llite/llite_lib.c index 070c225..a0c8cca 100644 --- a/lustre/llite/llite_lib.c +++ b/lustre/llite/llite_lib.c @@ -1305,12 +1305,15 @@ int ll_fill_super(struct super_block *sb) if (err) GOTO(out_free_cfg, err); + /* LSI_FILENAME_ENC is only used by embedded llcrypt */ +#ifdef CONFIG_LL_ENCRYPTION if (ll_sb_has_test_dummy_encryption(sb)) /* enable filename encryption by default for dummy enc mode */ lsi->lsi_flags |= LSI_FILENAME_ENC; else /* filename encryption is disabled by default */ lsi->lsi_flags &= ~LSI_FILENAME_ENC; +#endif /* kernel >= 2.6.38 store dentry operations in sb->s_d_op. */ sb->s_d_op = &ll_d_ops; diff --git a/lustre/llite/lproc_llite.c b/lustre/llite/lproc_llite.c index b121b89..0853eff 100644 --- a/lustre/llite/lproc_llite.c +++ b/lustre/llite/lproc_llite.c @@ -1642,6 +1642,7 @@ static ssize_t ll_nosquash_nids_seq_write(struct file *file, LDEBUGFS_SEQ_FOPS(ll_nosquash_nids); +#ifdef CONFIG_LL_ENCRYPTION static int ll_filename_enc_seq_show(struct seq_file *m, void *v) { struct super_block *sb = m->private; @@ -1686,6 +1687,7 @@ static ssize_t ll_filename_enc_seq_write(struct file *file, } LDEBUGFS_SEQ_FOPS(ll_filename_enc); +#endif /* CONFIG_LL_ENCRYPTION */ static int ll_pcc_seq_show(struct seq_file *m, void *v) { @@ -1741,8 +1743,10 @@ struct ldebugfs_vars lprocfs_llite_obd_vars[] = { .fops = &ll_nosquash_nids_fops }, { .name = "pcc", .fops = &ll_pcc_fops, }, +#ifdef CONFIG_LL_ENCRYPTION { .name = "enable_filename_encryption", .fops = &ll_filename_enc_fops, }, +#endif { NULL } }; diff --git a/lustre/tests/sanity-sec.sh b/lustre/tests/sanity-sec.sh index 1c5b987..c25ef3c 100755 --- a/lustre/tests/sanity-sec.sh +++ b/lustre/tests/sanity-sec.sh @@ -4318,10 +4318,12 @@ test_54() { which fscrypt || skip "This test needs fscrypt userspace tool" - fscrypt setup --force --verbose || error "fscrypt global setup failed" + yes | fscrypt setup --force --verbose || + error "fscrypt global setup failed" sed -i 's/\(.*\)policy_version\(.*\):\(.*\)\"[0-9]*\"\(.*\)/\1policy_version\2:\3"2"\4/' \ /etc/fscrypt.conf - fscrypt setup --verbose $MOUNT || error "fscrypt setup $MOUNT failed" + yes | fscrypt setup --verbose $MOUNT || + error "fscrypt setup $MOUNT failed" mkdir -p $testdir chown -R $ID0:$ID0 $testdir @@ -4357,9 +4359,12 @@ test_54() { [ $filecount -eq 3 ] || error "found $filecount files" # check enable_filename_encryption default value + # tunable only available for client built against embedded llcrypt $LCTL get_param mdc.*.connect_flags | grep -q name_encryption && nameenc=$(lctl get_param -n llite.*.enable_filename_encryption | head -n1) + # If client is built against in-kernel fscrypt, it is not possible + # to decide to encrypt file names or not: they are always encrypted. if [ -n "$nameenc" ]; then [ $nameenc -eq 0 ] || error "enable_filename_encryption should be 0 by default" @@ -4437,7 +4442,7 @@ test_54() { # setup encryption from inside this subdir mount # the .fscrypt directory is going to be created at the real fs root - fscrypt setup --verbose $MOUNT || + yes | fscrypt setup --verbose $MOUNT || error "fscrypt setup $MOUNT failed (2)" testdir=$MOUNT/vault mkdir $testdir @@ -4445,7 +4450,7 @@ test_54() { fid1=$(path2fid $MOUNT/.fscrypt) echo "With FILESET $tdir, .fscrypt FID is $fid1" - # enable name encryption + # enable name encryption, only valid if built against embedded llcrypt if [ -n "$nameenc" ]; then do_facet mgs $LCTL set_param -P \ llite.*.enable_filename_encryption=1 @@ -4517,7 +4522,7 @@ test_54() { $RUNAS fscrypt lock --verbose $DIR/$tdir/vault || error "fscrypt lock $DIR/$tdir/vault failed (5)" - # disable name encryption + # disable name encryption, only valid if built against embedded llcrypt if [ -n "$nameenc" ]; then do_facet mgs $LCTL set_param -P \ llite.*.enable_filename_encryption=0