Bug 2362686

Description of problem:
The supported encryption algorithm is,
AES_256_XTS for 'contents' and AES_256_CTS for 'filenames' which is default setting with fscrypt setup when https://github.com/ceph/fscrypt.git with branch wip-ceph-fuse used.

But if end-user tries to override default algo with other support algo like AES-256-HCTR2 for filenames, there is NO warning or Error message during fscrypt encrypt.

This BZ is to provide error message when AES-256-HCTR2 such unsupported algorithm is mentioned. It is unsupported for CephFS but not with FScrypt in-general, so this algo could be used as it is recommended pair - (AES-256-XTS, AES-256-HCTR2) 

Currently, since fscrypt encrypt prompts no error or warning message with this use case, after lock, only content is encrypted but not filename.

Version-Release number of selected component (if applicable): 19.2.1-161.el9cp


How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:

Logs:

[root@ceph-sumar-fscrypt-az0v8f-node6 fuse_sv4]# fscrypt status testdir2
"testdir2" is encrypted with fscrypt.

Policy:   43399fee26967bc347421fa2839ccf7b
Options:  padding:32 contents:AES_256_XTS filenames:AES_256_CTS policy_version:2
Unlocked: No

Protected with 1 protector:
PROTECTOR         LINKED  DESCRIPTION
3e429880957ffb16  No      custom protector "cephfs1"


[root@ceph-sumar-fscrypt-az0v8f-node6 fuse_sv4]# cat /etc/fscrypt.conf 
{
	"source": "custom_passphrase",
	"hash_costs": {
		"time": "75",
		"memory": "131072",
		"parallelism": "8",
		"truncation_fixed": true
	},
	"options": {
		"padding": "32",
		"contents": "AES_256_XTS",
		"filenames": "AES_256_HCTR2",
		"policy_version": "2"
	},
	"use_fs_keyring_for_v1_policies": false,
	"allow_cross_user_metadata": false
}

[root@ceph-sumar-fscrypt-az0v8f-node6 fuse_sv4]# mkdir testdir3
[root@ceph-sumar-fscrypt-az0v8f-node6 fuse_sv4]# fscrypt encrypt testdir3
Should we create a new protector? [y/N] y
The following protector sources are available:
1 - Your login passphrase (pam_passphrase)
2 - A custom passphrase (custom_passphrase)
3 - A raw 256-bit key (raw_key)
Enter the source number for the new protector [2 - custom_passphrase]: 2
Enter a name for the new protector: cephfs2
Enter custom passphrase for protector "cephfs2": 
Confirm passphrase: 
"testdir3" is now encrypted, unlocked, and ready for use.
[root@ceph-sumar-fscrypt-az0v8f-node6 fuse_sv4]# fscrypt status testdir3
"testdir3" is encrypted with fscrypt.

Policy:   da8c7b27c062dbecb4606e8e5f41f184
Options:  padding:32 contents:AES_256_XTS filenames:AES_256_HCTR2 policy_version:2
Unlocked: Yes

Protected with 1 protector:
PROTECTOR         LINKED  DESCRIPTION
bc0a61431bd062ba  No      custom protector "cephfs2"
[root@ceph-sumar-fscrypt-az0v8f-node6 fuse_sv4]# cp /var/log/messages testdir3/
[root@ceph-sumar-fscrypt-az0v8f-node6 fuse_sv4]# ls -l testdir3
total 30
-rw-------. 1 root root 30012 Apr 28 11:03 messages
[root@ceph-sumar-fscrypt-az0v8f-node6 fuse_sv4]# fscrypt lock testdir3
"testdir3" is now locked.
[root@ceph-sumar-fscrypt-az0v8f-node6 fuse_sv4]# ls -l testdir3
total 30
-rw-------. 1 root root 30012 Apr 28 11:03 messages
[root@ceph-sumar-fscrypt-az0v8f-node6 fuse_sv4]# ls -l testdir3/
total 30
-rw-------. 1 root root 30012 Apr 28 11:03 messages
[root@ceph-sumar-fscrypt-az0v8f-node6 fuse_sv4]# cd testdir3
[root@ceph-sumar-fscrypt-az0v8f-node6 testdir3]# ls -l
total 30
-rw-------. 1 root root 30012 Apr 28 11:03 messages
[root@ceph-sumar-fscrypt-az0v8f-node6 testdir3]# vi messages 
[root@ceph-sumar-fscrypt-az0v8f-node6 testdir3]# echo test >> messages 
-bash: messages: Input/output error
[root@ceph-sumar-fscrypt-az0v8f-node6 testdir3]#