Re: [RFC 0/4] fs: provide per-filesystem options to disable fscrypt

[Niels de Vos <ndevos@redhat.com>]

On Thu, Nov 10, 2022 at 01:15:38PM -0500, Theodore Ts'o wrote:
> On Thu, Nov 10, 2022 at 05:47:10PM +0100, Niels de Vos wrote:
> > And, there actually are options like CONFIG_EXT4_FS_POSIX_ACL and
> > CONFIG_EXT4_FS_SECURITY. Because these exist already, I did not expect
> > too much concerns with proposing a CONFIG_EXT4_FS_ENCRYPTION...
> 
> Actually, I was thinking of getting rid of them, as we've already
> gotten rid of EXT4_FS_POSIX_ACL....
> 
> > Thanks for adding some history about this. I understand that extra
> > options are needed while creating/tuning the filesystems. Preventing
> > users from setting the right options in a filesystem is not easy, even
> > if tools from a distribution do not offer setting the options. Disks can
> > be portable, or network-attached, and have options enabled that an other
> > distributions kernel does not (want to) support.
> 
> Sure, but as I said, there are **tons** of file system features that
> have not and/or still are not supported for distros, but for which we
> don't have kernel config knobs.  This includes ext4's bigalloc and
> inline data, btrfs's dedup and reflink support, xfs online fsck, etc.,
> etc., etc.  Heck, ext4 is only supported up to a certain size by Red
> Hat, and we don't have a Kernel config so that the kernel will
> absolutely refuse to mount an ext4 file system larger than The
> Officially Supported RHEL Capacity Limit for Ext4.  So what makes
> fscrypt different from all of these other unsupported file system
> features?
> 
> There are plenty of times when I've had to explain to customers why,
> sure they could build their own kernels for RHEL 4 (back in the day
> when I worked for Big Blue and had to talk to lots of enterprise
> customers), but if they did, Red Hat support would refuse to give them
> the time of day if they called asking for help.  We didn't set up use
> digitally signed kernels with trusted boot so that a IBM server would
> refuse to boot anything other than An Officially Signed RHEL
> Kernel...
> 
> What makes fscrypt different that we think we need to enforce this
> using technical means, other than a simple, "this feature is not
> supported"?

Thanks again for the added details. What you are explaining makes sense,
and I am not sure if there is an other good reason why splitting out
fscrypt support per filesystem would be required. I'm checking with the
folks that suggested doing this, and see where we go from there.

Niels