From f1a7c762e18228dd04bfade8279bfd9203ba563f Mon Sep 17 00:00:00 2001 From: Christopher Hoffman Date: Thu, 21 Aug 2025 19:23:44 +0000 Subject: [PATCH] client: Check for supported fscrypt policy When setting a policy on a directory, check to make sure policy is supported. Signed-off-by: Christopher Hoffman --- src/client/Client.cc | 5 +++++ src/client/FSCrypt.h | 13 +++++++++++++ 2 files changed, 18 insertions(+) diff --git a/src/client/Client.cc b/src/client/Client.cc index 51f7ae5d072e1..075968a87db84 100644 --- a/src/client/Client.cc +++ b/src/client/Client.cc @@ -18334,6 +18334,11 @@ int Client::ll_set_fscrypt_policy_v2(Inode *in, const struct fscrypt_policy_v2& } FSCryptContext fsc(cct); + + if (!fsc.is_supported_policy(policy)) { + return -EINVAL; + } + fsc.init(policy); fsc.generate_new_nonce(); diff --git a/src/client/FSCrypt.h b/src/client/FSCrypt.h index 9d58100ec655e..038775eb7a5fb 100644 --- a/src/client/FSCrypt.h +++ b/src/client/FSCrypt.h @@ -125,6 +125,19 @@ public: virtual ~FSCryptPolicy() {} + bool is_supported_policy(fscrypt_policy_v2 policy) { + if (policy.version != 2) { + return false; + } + + if (policy.contents_encryption_mode != FSCRYPT_MODE_AES_256_XTS || + policy.filenames_encryption_mode != FSCRYPT_MODE_AES_256_CTS) { + return false; + } + + return true; + } + void init(const struct fscrypt_policy_v2& policy) { version = policy.version; contents_encryption_mode = policy.contents_encryption_mode; -- 2.39.5