Re: [PATCH v5 5/5] ceph: fail quarantined subvolume access with EACCES

[Eric Biggers]

On Tue, Oct 20, 2026 at 08:26:50PM +0000, Alex Markuze wrote:
> +/*
> + * fscrypt can cache the decrypted target in ->i_link, allowing the VFS to
> + * bypass this callback. Checking those cache hits needs separate fscrypt
> + * support; this check covers only accesses that reach ->get_link().
> + */
>  static const char *ceph_encrypted_get_link(struct dentry *dentry,
>  					   struct inode *inode,
>  					   struct delayed_call *done)
>  {
>  	struct ceph_inode_info *ci = ceph_inode(inode);
> +	int err;
>  
>  	if (!dentry)
>  		return ERR_PTR(-ECHILD);
> +	err = ceph_symlink_revalidate(inode);
> +	if (err)
> +		return ERR_PTR(err);
>  
>  	return fscrypt_get_symlink(inode, ci->i_symlink, i_size_read(inode),
>  				   done);

The function comment seems out of sync with the actual code, as the
actual code disables the symlink target caching.

>  	case FS_IOC_GET_ENCRYPTION_POLICY:
>  		ret = vet_mds_for_fscrypt(file);
> +		if (ret)
> +			return ret;
> +		ret = ceph_quarantine_revalidate(inode);
>  		if (ret)
>  			return ret;
>  		return fscrypt_ioctl_get_policy(file, (void __user *)arg);
>  
>  	case FS_IOC_GET_ENCRYPTION_POLICY_EX:
>  		ret = vet_mds_for_fscrypt(file);
> +		if (ret)
> +			return ret;
> +		ret = ceph_quarantine_revalidate(inode);
>  		if (ret)
>  			return ret;
>  		return fscrypt_ioctl_get_policy_ex(file, (void __user *)arg);
> @@ -429,6 +439,9 @@ long ceph_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
>  
>  	case FS_IOC_GET_ENCRYPTION_NONCE:
>  		ret = vet_mds_for_fscrypt(file);
> +		if (ret)
> +			return ret;
> +		ret = ceph_quarantine_revalidate(inode);
>  		if (ret)
>  			return ret;
>  		return fscrypt_ioctl_get_nonce(file, (void __user *)arg);

Can you clarify why FS_IOC_SET_ENCRYPTION_POLICY doesn't need this too?

- Eric