CephFS Completes Multi-Year Effort Adding FSCRYPT Support

The Ceph changes were submitted today for the ongoing Linux 6.6 merge window and with it comes one big shiny feature addition: support for making use of the FSCRYPT file-system encryption framework.

FSCRYPT has been in the mainline kernel for several years now and used by file-systems like EXT4 and F2FS. FSCRYPT provides for Linux native file encryption and can support some nifty features like different encryption keys for different directories on a per-file/directory basis. Adding to EXT4, F2FS, and UBIFS with mainline support for this feature (also referred to as CONFIG_FS_ENCRYPTION), is now CephFS supporting FSCRYPT.

This work has been ongoing for quite a while and prior kernels have brought some pieces of CephFS while for Linux 6.6 it's largely over the finish line. Ilya Dryomov explained in today's Ceph pull request:

"Mixed with some fixes and cleanups, this brings in reasonably complete fscrypt support to CephFS! The list of things which don't work with encryption should be fairly short, mostly around the edges: fallocate (not supported well in CephFS to begin with), copy_file_range (requires re-encryption), non-default striping patterns.

This was a multi-year effort principally by Jeff Layton with assistance from Xiubo Li, Luís Henriques and others, including several dependant changes in the MDS, netfs helper library and fscrypt framework itself."

Linux 6.6 is shaping up to be quite an exciting kernel update.