2

I was experimenting with encryption on an ext4 filesystem and I encrypted a file (using fscrypt) which was set to be immutable (via chattr +i). I have now lost the encryption key and uninstalled fscrypt.

I would like to delete the file, but when I try to delete it, I get the following error:

# rm foo
rm: cannot remove 'foo': Operation not permitted

and when I try to make it mutable:

# chattr -i foo
chattr: Required key not available while reading flags on foo

Therefore, I believe I cannot delete the file as it is immutable and I cannot change its attributes due to encryption. Any suggestions?


Edit:

I have tried the following and they do not work:

  1. Deleting/modifying the files from a Live USB. The same errors occur.
  2. Trying after removing the encrypt feature, as Ángel suggested. fsck also doesn't throw any errors for some reason.

Output of findmnt (testdir contains foo) and filesystem properties:

$ findmnt --target testdir
TARGET SOURCE    FSTYPE OPTIONS
/      /dev/sda4 ext4   rw,relatime

# tune2fs -l /dev/sda4 | grep "Filesystem features"
Filesystem features:      has_journal ext_attr resize_inode dir_index filetype needs_recovery extent 64bit flex_bg sparse_super large_file huge_file dir_nlink extra_isize metadata_csum
  • Encryption should not matter. Removing a file does not look inside the file. However I don't know what the problem is. You need the appropriate capability (so run as root, with sudo), but that does not account for the error message. – ctrl-alt-delor Jan 12 at 11:16
  • @ctrl-alt-delor: my understanding is that fscrypt works on a directory level (also, it's a FS feature, so it will persist even after uninstalling the tools), so I'm almost as suprised the OP can cd into the directory and still see a meaningful filename. – Ulrich Schwarz Jan 12 at 13:12
  • @ctrl-alt-delor I tried running both commands as root. It makes no difference. – tstsr Jan 12 at 13:45
  • please update question to show: output of findmnt --target directory-that-contains-foo – ctrl-alt-delor Jan 12 at 14:10
1

With the filesystem unmounted, you should be able to use debugfs -w -R "rm path_to_file" /dev/sda1 to delete the file.

| improve this answer | |
1

The easiest way would be to format a new ext4 partition there and start fresh. However, I understand that may not be convenient for you.

Assuming the partition is on /dev/sda1, I would try doing -while the filesystem is not mounted-:

debugfs -w -R "feature -encrypt" /dev/sda1
fsck.ext4 /dev/sda1

The debugfs command will remove the encrypt feature from the ext4 filesystem, and the following fsck should detect all encrypted directories as errors, and would hopefully offer to remove them. Even if they are not removed, I expect the encryption flag to be gone (and the contents to be garbage), so you should then be able to make un-inmmutable and remove the normal way.

| improve this answer | |
  • Note that after e2fsck is run, you still need to remove the immutable flag from the file and unlink it. – LustreOne Jan 13 at 20:22
  • That's what I meant with you should then be able to make un-inmmutable and remove the normal way, yes. – Ángel Jan 15 at 0:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.