{
  "slug": "fscrypt-policy",
  "term": "fscrypt encryption policy",
  "aliases": [
    "fscrypt policy"
  ],
  "definition": "An fscrypt policy selects the encryption format and master-key reference inherited by newly created files in an encrypted directory tree.",
  "note": "In Linux v6.12, policy fields include the version, contents and filename modes, flags and key reference. The v2 structure also carries a data-unit-size setting. Equal key identifiers alone do not mean equal policies. [uapi] [policy-code]\n\nInitial setup requires an empty directory. Reapplying the same policy verifies an existing setting; a different policy returns EEXIST instead of re-encrypting data. Regular files, directories and symlinks inherit the parent's policy at creation; special files are excluded. [policy-code] [fscrypt-source]\n\nThe legacy FS_IOC_GET_ENCRYPTION_POLICY returns EINVAL for an encrypted v2 file. The extended _EX ioctl supports both versions; policy_size specifies buffer capacity on input and returned policy size on success. EOVERFLOW means the recognized policy does not fit, whereas ENODATA means the file is unencrypted. The v1 version code is 0, not 1; v2 uses 2. [fscrypt-source] [uapi]",
  "status": "shipping",
  "advantages": [],
  "limitations": [],
  "supersedes": [],
  "supersededBy": [],
  "firstSeen": null,
  "lastSeen": null,
  "updated": "2026-10-23",
  "related": [
    "fscrypt",
    "fscrypt-key-identifier"
  ],
  "citations": [
    {
      "id": "fscrypt-source",
      "title": "Linux v6.12: fscrypt policy setup, enforcement and key identifiers",
      "url": "https://docs.kernel.org/6.12/filesystems/fscrypt.html",
      "accessed": "2026-10-22"
    },
    {
      "id": "policy-code",
      "title": "Linux v6.12: fscrypt policy comparison and installation",
      "url": "https://github.com/torvalds/linux/blob/v6.12/fs/crypto/policy.c",
      "accessed": "2026-10-22"
    },
    {
      "id": "uapi",
      "title": "Linux v6.12: fscrypt policy structures and identifier size",
      "url": "https://github.com/torvalds/linux/blob/v6.12/include/uapi/linux/fscrypt.h",
      "accessed": "2026-10-22"
    },
    {
      "id": "hesela-fscrypt",
      "title": "Hesela: filesystem encryption and the execution backend",
      "url": "https://hesela.com/analyses/checksums-identity-and-lost-writes/#filesystem-encryption",
      "accessed": "2026-10-22"
    }
  ]
}