Actions
Tasks #70979
closedTasks #63293: Implement fscrypt in libcephfs and cephfs-fuse
cached fscrypt_file information lost during snap create
% Done:
0%
Reviewed:
Affected Versions:
Component(FS):
Labels (FS):
Pull request ID:
Tags (freeform):
Merge Commit:
Fixed In:
Released In:
Upkeep Timestamp:
Description
When a snapshot is created on an encrypted inode, the cached fscrypt_file xattr information is lost.
Steps to reproduce:
+ sudo CEPH_CONF=ceph.conf ./bin/ceph-fuse --client_fs cephfs /mnt/mycephfs 2025-04-18T14:56:13.921+0000 7f3b396fb600 -1 WARNING: all dangerous and experimental features are enabled. 2025-04-18T14:56:13.931+0000 7f3b396fb600 -1 WARNING: all dangerous and experimental features are enabled. 2025-04-18T14:56:13.934+0000 7f3b396fb600 -1 WARNING: all dangerous and experimental features are enabled. 2025-04-18T14:56:13.939+0000 7f3b396fb600 -1 init, newargv = 0x55cf83eff2c0 newargc=13 2025-04-18T14:56:13.939+0000 7f3b396fb600 -1 init, args.argv = 0x55cf83ec5170 args.argc=4 ceph-fuse[3454218]: starting ceph client ceph-fuse[3454218]: starting fuse + fscrypt setup /mnt/mycephfs Allow users other than choffman to create fscrypt metadata on this filesystem? (See https://github.com/google/fscrypt#setting-up-fscrypt-on-a-filesystem) [y/N] Metadata directories created at "/mnt/mycephfs/.fscrypt", writable by choffman only. + mkdir /mnt/mycephfs/enc1 + fscrypt encrypt /mnt/mycephfs/enc1 The following protector sources are available: 1 - Your login passphrase (pam_passphrase) 2 - A custom passphrase (custom_passphrase) 3 - A raw 256-bit key (raw_key) Enter the source number for the new protector [2 - custom_passphrase]: Enter a name for the new protector: t Enter custom passphrase for protector "t": Confirm passphrase: "/mnt/mycephfs/enc1" is now encrypted, unlocked, and ready for use. + echo contents > /mnt/mycephfs/enc1/filea + getfattr -n ceph.fscrypt.file /mnt/mycephfs/enc1/filea getfattr: Removing leading '/' from absolute path names # file: mnt/mycephfs/enc1/filea ceph.fscrypt.file=0sCQAAAAAAAAA= + mkdir /mnt/mycephfs/.snap/snap1 + ls -alh /mnt/mycephfs/enc1/filea -rw-------. 1 choffman choffman 9 Apr 18 14:56 /mnt/mycephfs/enc1/filea + ls -alh /mnt/mycephfs/.snap/snap1/enc1/filea -rw-------. 1 choffman choffman 4.0K Apr 18 14:56 /mnt/mycephfs/.snap/snap1/enc1/filea + getfattr -n ceph.fscrypt.file /mnt/mycephfs/enc1/filea getfattr: Removing leading '/' from absolute path names # file: mnt/mycephfs/enc1/filea ceph.fscrypt.file=0sABAAAAAAAAA= + getfattr -n ceph.fscrypt.file /mnt/mycephfs/.snap/snap1/enc1/filea getfattr: Removing leading '/' from absolute path names # file: mnt/mycephfs/.snap/snap1/enc1/filea ceph.fscrypt.file=0sABAAAAAAAAA=
Updated by Christopher Hoffman 11 months ago
- Related to Tasks #69840: Support subvolume clone added
Updated by Christopher Hoffman 11 months ago
- Status changed from In Progress to Resolved
fscrypt fields were missing during capsnap.
Author: Christopher Hoffman <choffman@redhat.com>
Date: Fri Apr 18 20:55:02 2025 +0000
client: provide fscrypt vxattrs in CapSnap
Fixes: https://tracker.ceph.com/issues/70979
Signed-off-by: Christopher Hoffman <choffman@redhat.com>
diff --git a/src/client/Client.cc b/src/client/Client.cc
index 0314a620308..747e0672ab0 100644
--- a/src/client/Client.cc
+++ b/src/client/Client.cc
@@ -4362,6 +4362,8 @@ void Client::finish_cap_snap(Inode *in, CapSnap &capsnap, int used)
{
ldout(cct, 10) << __func__ << " " << *in << " capsnap " << (void *)&capsnap << " used " << ccap_string(used) << dendl;
capsnap.size = in->size;
+ capsnap.fscrypt_auth = in->fscrypt_auth;
+ capsnap.fscrypt_file = in->fscrypt_file;
capsnap.mtime = in->mtime;
capsnap.atime = in->atime;
capsnap.ctime = in->ctime;
@@ -4416,6 +4418,8 @@ void Client::send_flush_snap(Inode *in, MetaSession *session,
m->head.xattr_version = capsnap.xattr_version;
encode(capsnap.xattrs, m->xattrbl);
+ m->fscrypt_file = capsnap.fscrypt_auth;
+ m->fscrypt_file = capsnap.fscrypt_file;
m->ctime = capsnap.ctime;
m->btime = capsnap.btime;
m->mtime = capsnap.mtime;
diff --git a/src/client/Inode.h b/src/client/Inode.h
index 9a124029eca..36a8d0ab4bc 100644
--- a/src/client/Inode.h
+++ b/src/client/Inode.h
@@ -99,6 +99,8 @@ struct CapSnap {
gid_t gid = 0;
std::map<std::string,bufferptr> xattrs;
version_t xattr_version = 0;
+ std::vector<uint8_t> fscrypt_auth;
+ std::vector<uint8_t> fscrypt_file;
bufferlist inline_data;
version_t inline_version = 0;
Updated by Christopher Hoffman 11 months ago
- Subject changed from fscrypt_file information lost during snap create to cached fscrypt_file information lost during snap create
- Description updated (diff)
Actions