1 files changed, 11 insertions, 2 deletions

diff --git a/fs/ecryptfs/file.c b/fs/ecryptfs/file.c
index f22c3a73485c..652ed772a9be 100644
--- a/fs/ecryptfs/file.c
+++ b/fs/ecryptfs/file.c
@@ -250,6 +250,17 @@ static int ecryptfs_open(struct inode *inode, struct file *file)
         struct ecryptfs_file_info *file_info;
         int lower_flags;
 
+        mount_crypt_stat = &ecryptfs_superblock_to_private(
+                ecryptfs_dentry->d_sb)->mount_crypt_stat;
+        if ((mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED)
+            && ((file->f_flags & O_WRONLY) || (file->f_flags & O_RDWR)
+                || (file->f_flags & O_CREAT) || (file->f_flags & O_TRUNC)
+                || (file->f_flags & O_APPEND))) {
+                printk(KERN_WARNING "Mount has encrypted view enabled; "
+                       "files may only be read\n");
+                rc = -EPERM;
+                goto out;
+        }
         /* Released in ecryptfs_release or end of function if failure */
         file_info = kmem_cache_zalloc(ecryptfs_file_info_cache, GFP_KERNEL);
         ecryptfs_set_file_private(file, file_info);
@@ -261,8 +272,6 @@ static int ecryptfs_open(struct inode *inode, struct file *file)
         }
         lower_dentry = ecryptfs_dentry_to_lower(ecryptfs_dentry);
         crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;
-        mount_crypt_stat = &ecryptfs_superblock_to_private(
-                ecryptfs_dentry->d_sb)->mount_crypt_stat;
         mutex_lock(&crypt_stat->cs_mutex);
         if (!ECRYPTFS_CHECK_FLAG(crypt_stat->flags, ECRYPTFS_POLICY_APPLIED)) {
                 ecryptfs_printk(KERN_DEBUG, "Setting flags for stat...\n");