Hello, As I understand the usage of EXT4_IOC_SET(GET)_ENCRYPTION_POLICY and as the policy is set per inode and stored as an attribute, any reason that - it should be a selinux attribute in specific ? and setfattr / getfattr wasn't used instead of the above ioctl ? IMO, if its attribute its better to have it read/writable using the generic tools such as set(get)fattr. ? Thanks, Anand