mirrors/ceph-csi
1
0
Fork 0
mirror of https://github.com/ceph/ceph-csi.git synced 2024-12-18 02:50:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

fscrypt: fsync encrypted dir after setting policy [workaround]

Browse Source 
Revert once our google/fscrypt dependency is upgraded to a version
that includes https://github.com/google/fscrypt/pull/359 gets accepted

Signed-off-by: Marcel Lauhoff <marcel.lauhoff@suse.com>
This commit is contained in:
Marcel Lauhoff 2022-08-12 15:05:02 +02:00 committed by mergify[bot]
parent 33c33a8b49
commit 4e38bdac10
1 changed files with 20 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
internal/util/fscrypt/fscrypt.go
View File

@ -111,6 +111,20 @@ func createKeyFuncFromVolumeEncryption(
return keyFunc, nil return keyFunc, nil
} }
// fsyncEncryptedDirectory calls sync on dirPath. It is intended to
// work around the fscrypt library not syncing the directory it sets a
// policy on.
// TODO Remove when the fscrypt dependency has https://github.com/google/fscrypt/pull/359
func fsyncEncryptedDirectory(dirPath string) error {
dir, err := os.Open(dirPath)
if err != nil {
return err
}
defer dir.Close()
return dir.Sync()
}
// unlockExisting tries to unlock an already set up fscrypt directory using keys from Ceph CSI. // unlockExisting tries to unlock an already set up fscrypt directory using keys from Ceph CSI.
func unlockExisting( func unlockExisting(
ctx context.Context, ctx context.Context,
@ -225,6 +239,12 @@ func initializeAndUnlock(
return err return err
} }
if err = fsyncEncryptedDirectory(encryptedPath); err != nil {
log.ErrorLog(ctx, "fscrypt: fsync encrypted dir - to flush kernel policy to disk failed %v", err)
return err
}
return nil return nil
} }