On Thu, Oct 15, 2026 at 05:46:24PM +0000, Alex Markuze wrote: > fscrypt stores decrypted symlink targets in inode->i_link. The VFS can > use this field without calling the filesystem's ->get_link() callback. > The target can remain valid after the access policy changes. > > The CephFS subvolume quarantine series adds access checks to > ->get_link(). Quarantine can revoke access after a target is cached. The > VFS cache can bypass these checks. > > The no_symlink_cache option in fscrypt_operations gives filesystems > control of this cache. It applies during target creation, lookup and > getattr. With this option set, the helpers do not read or update > ->i_link. The filesystem callback can then revalidate access. > > Uncached targets use the existing delayed-free callback. Each uncached > lookup allocates a temporary buffer and decrypts or encodes the target. > This lets Ceph reuse fscrypt's target validation and buffer ownership. > > The default setting keeps the current cache behavior for other > filesystems. Ceph selects the option so cached targets cannot bypass its > ->get_link() checks. > > Signed-off-by: Alex Markuze <[email protected]>
This sounds like a bug fix? If so, which commit is it fixing? - Eric
