Fail decryption operation if OS is encrypted
@@ -116,6 +116,12 @@ def disable_encryption():
extension_parameter = ExtensionParameter(hutil, logger, DistroPatcher, encryption_environment, protected_settings, public_settings)
disk_util = DiskUtil(hutil=hutil, patching=DistroPatcher, logger=logger, encryption_environment=encryption_environment)
+
+ encryption_status = json.loads(disk_util.get_encryption_status())
+
+ if encryption_status["os"] != "NotEncrypted":
+ raise Exception("Disabling encryption is not supported when OS volume is encrypted")
+
bek_util = BekUtil(disk_util, logger)
encryption_config = EncryptionConfig(encryption_environment, logger)
bek_passphrase_file = bek_util.get_bek_passphrase_file(encryption_config)
