Re: [PATCH v2 1/1] common/encrypt: Do not run _verify_ciphertext_for_encryption_policy on compressed FS

[Eric Biggers <ebiggers@kernel.org>]

On Mon, Sep 15, 2025 at 12:04:51PM +0200, Jan Prusakowski wrote:
> common/encrypt: Do not run _verify_ciphertext_for_encryption_policy on compressed FS

A better title would be something like
"common/encrypt: Explicitly set the test file to uncompressed".
(We do still run _verify_ciphertext_for_encryption_policy.  And as I
mentioned before, there's not really any such thing as a compressed FS.)

> verify_ciphertext_for_encryption_policy() checks if encryption works
> correctly by reading encrypted file's contents directly from a block device and
> comparing it to a known good ciphertext.
> 
> This, however, won't work if the test file is also compressed. So this patch
> adds a check if a test file is compressed and disables compression in this case.
> 
> Signed-off-by: Jan Prusakowski <jprusakowski@google.com>
> ---
>  common/encrypt | 7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/common/encrypt b/common/encrypt
> index d4f6e3dc..c25ff5a4 100644
> --- a/common/encrypt
> +++ b/common/encrypt
> @@ -790,6 +790,13 @@ _do_verify_ciphertext_for_encryption_policy()
>  	_set_encpolicy $dir $keyspec $set_encpolicy_args -f $policy_flags
>  	for src in $tmp.testfile_*; do
>  		dst=$dir/${src##*.}
> +		# To make sure the test file is not compressed we create an empty one
> +		# and disable compression first (F2FS won't allow resetting the
> +		# compression flag if the file has data already in it).
> +		touch $dst
> +		if lsattr $dst | grep -qE ".+c.+ $dst" ; then
> +			chattr -c $dst
> +		fi
>  		cp $src $dst
>  		inode=$(stat -c %i $dst)
>  		blocklist=$(_get_ciphertext_block_list $dst)

Is adding 'm' (FS_NOCOMP_FL) needed too?  If not, why does it exist?

Also, have you verified that the tests that use this function still pass
on both ext4 and f2fs?

- Eric