Skip to main content

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

4
  • I'm not sure if there is a strong reason why tune2fs doesn't allow flag removal; guess it could be simply due to confusion, since forcefully removing the flag does not actually stop the encryption at all. Commented May 12, 2020 at 10:59
  • Also both mke2fs and tune2fs have code to set additional flags (encryption algorithm) in the superblock when enabling the feature; debugfs does not and simply ignores the clear flag restrictions. So there is no deliberate implementation of this feature in debugfs and enabling the flag with it doesn't do the same thing as mke2fs/tune2fs either. Commented May 12, 2020 at 11:02
  • About Answer 2: Having to run fsck makes that command look really risky. And I assume that command simply disables encryption/decryption processing by removing a flag, but encryption-related metadata (nonces, etc.) are still kept on the filesystem? Commented May 12, 2020 at 20:41
  • It’s just a precaution. I imagine the flag is only toggled, and all the data remains, but I haven’t checked. (It might be the case that fsck clears any encrypted data if the flag is disabled, although I don’t see anything like that in the source code so I suspect it doesn’t.) Commented May 12, 2020 at 21:03