Getting "encryption not enabled" on an ext4 filesystem

[alexandracristea09]

I keep getting this error when trying to encrypt a directory:

"fscrypt encrypt /var/opencloud/test_fscrypt/
[ERROR] fscrypt encrypt: encryption not enabled on filesystem /var/opencloud (/dev/sdc1).
To enable encryption support on this filesystem, run:
     sudo tune2fs -O encrypt "/dev/sdc1"
Also ensure that your kernel has CONFIG_FS_ENCRYPTION=y. See the documentation for more details."

The kernel configuration contains the encryption enablement:

grep FS_ENCRYPTION /boot/config-$(uname -r)
CONFIG_FS_ENCRYPTION=y
CONFIG_FS_ENCRYPTION_ALGS=m

Also the 'encrypt' feature flag appears:

sudo tune2fs -l /dev/sdc1 | grep 'Filesystem features'
Filesystem features:      has_journal ext_attr resize_inode dir_index filetype needs_recovery extent 64bit flex_bg encrypt sparse_super large_file huge_file dir_nlink extra_isize metadata_csum

I've tried unmounting and remounting the filesystem, rebooting, running 'tune2fs -O encrypt /dev/device', but nothing seems to work.
I mention that the machine is running on Linux 9.7, kernel version is 5.14.0-570.37.1.el9_6.x86_64.

[ebiggers]

This happens when the kernel returns -EOPNOTSUPP from the fscrypt ioctls on the filesystem. From reading through the kernel code, the only other case I can find where that is a possibility (besides the two that fscrypt is already aware of) is the case where the filesystem is mounted with -o dax. Was that perhaps the case here? Encryption and DAX (Direct Access) are not compatible.

[alba02119451]

Not OP nor working with them, but I have the same issue and a bit of data to share from our end. I will preface this by saying I'm not super well-versed in filesystems, but I'll do my best to provide more info and debug if requested. Hope it helps!

I was doing some testing with fscrypt on the OS partition (trying to automate with Ansible, for context) and performed the two tests that OP listed. In our case, the 'encrypt' feature flag was initially missing, but after adding it with sudo tune2fs -O encrypt "/dev/dm-0" the issue persisted. I checked /etc/fstab to see if the -o dax mount option was specified, but it doesn't look like it. I also cannot find any entry specifying it in the scripts that built the machine (Terraform + Ansible).

/etc/fstab

#
# /etc/fstab
# Created by anaconda on Wed Mar 25 09:07:29 2026
#
# Accessible filesystems, by reference, are maintained under '/dev/disk/'.
# See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info.
#
# After editing this file, run 'systemctl daemon-reload' to update systemd
# units generated from this file.
#
/dev/mapper/vg_main-lv_root 				/           ext4    defaults        								1 1
UUID=0e3b3aba-3cfc-4e43-8353-c6918b219ca2 	/boot       ext4    defaults        								1 2
UUID=5C0B-FB30          					/boot/efi	vfat    defaults,uid=0,gid=0,umask=077,shortname=winnt	0 2
/dev/mapper/vg_main-lv_swap 				none        swap    defaults        								0 0

lsblk -f output

NAME                FSTYPE      FSVER    LABEL UUID                                   FSAVAIL FSUSE% MOUNTPOINTS
sda
├─sda1              vfat        FAT16    EFI   5C0B-FB30                               192.2M     4% /boot/efi
├─sda2              ext4        1.0            0e3b3aba-3cfc-4e43-8353-c6918b219ca2      752M    16% /boot
└─sda3              LVM2_member LVM2 001       563s0g-8UHg-JtMT-NLe4-52Mm-9QaY-i5Jv2I
  ├─vg_main-lv_root ext4        1.0            99ae26dd-a395-4ce3-a87e-09ad34e4ee2f     23.4G    26% /
  └─vg_main-lv_swap swap        1              04b402f2-6a3c-4ae6-9cec-5976f1c3f80a                  [SWAP]
sr0

Anything else I can provide?

[ebiggers]

What kernel version? I'm wondering if this issue is specific to Red Hat kernels.

[alba02119451]

Could be. We're also on RHEL 9, kernel version 5.14.0-687.42.1.el9_8.x86_64. fscrypt version is 0.3.4-2.el9 (default for the EPEL repository). Unfortunately I am unable to download and build the latest version at this moment due to a restricted network, but I may be able to test it at a later date after access is granted.