client: Allow setpolicy only on dir and when it is empty.

Signed-off-by: Christopher Hoffman <choffman@redhat.com>

diff --git a/src/client/Client.cc b/src/client/Client.cc
index 87aa982158c6d56a2ff17577dbaa5766fb381ebe..6bf8013449ac6e2e49269037e61b1e91d245844e 100644 (file)
--- a/src/client/Client.cc
+++ b/src/client/Client.cc
@@ -18198,6 +18198,12 @@ int Client::ll_set_fscrypt_policy_v2(Inode *in, const struct fscrypt_policy_v2&
     return -EEXIST;
   }
 
+  if (!in->is_dir())
+    return -ENOTDIR;
+
+  if (in->is_dir() && in->dir && in->dir->dentries.size() > 0)
+    return -ENOTEMPTY;
+
   FSCryptContext fsc(cct);
   fsc.init(policy);
   fsc.generate_new_nonce();