Another solution is to set the flag unconditionally if the fs is RW:

Currently in fs/ext4/super.c:

if (DUMMY_ENCRYPTION_ENABLED(sbi) &&
    !(sb->s_flags & MS_RDONLY) &&
    !EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_ENCRYPT)) {
       EXT4_SET_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_ENCRYPT);
       ext4_commit_super(sb, 1);
}

This way, we are not dependent on the previous version to have the proper tune2fs in place.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/platform2/+/f44667a87313bd9aedff615a80d38ef00a3be535

commit f44667a87313bd9aedff615a80d38ef00a3be535
Author: Gwendal Grignou <gwendal@chromium.org>
Date: Sat Feb 04 04:01:48 2017

init/install: enable ext4 crypto option on stateful partition.

Allow using e4 crypto tool on stateful partition.

- When installing a new machine, if the kernel support ext4 crypto,
  format ext4 stateful partition with encryption support.
- At boot, if the kernel support ext4 crypto, but stateful fs does not
  have encryption support, enable it via tune2fs.

Note that until cryptohome is enabled to use ext4 crypto, this feature
will not be used.
Also, once a directory is encrypted, we should not use a kernel that
does not support ext4 crypto: it will be unable to access encrypted
directores properly (if \0 happens to be in the encrypted name).

TEST=On veyron_speedy: reboot machine with ext4 crypto enabled kernel,
check that 'encrypt' was added to the stateful filesystem feature.
Run chromeos-install, check the stateful filesystem was formated
properly.
Reinstall samus machine, check sda1 was set with encrypt option.
BUG= chromium:590820 

Change-Id: I96254c200d9a28249aa0c7ff14f1a16adc132599
Signed-off-by: Gwendal Grignou <gwendal@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/348380
Reviewed-by: Mike Frysinger <vapier@chromium.org>

[modify] https://crrev.com/f44667a87313bd9aedff615a80d38ef00a3be535/installer/share/chromeos-common.sh
[modify] https://crrev.com/f44667a87313bd9aedff615a80d38ef00a3be535/init/chromeos_startup
[modify] https://crrev.com/f44667a87313bd9aedff615a80d38ef00a3be535/installer/chromeos-install

The CL in #3 was reverted in https://chromium-review.googlesource.com/c/348380/.
gwendal@, could you take a look?

Wrong CL: The revert is https://chromium-review.googlesource.com/c/439487/

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/overlays/chromiumos-overlay/+/2a26ae5f3a370f0c3619930b39aefc6360094fc4

commit 2a26ae5f3a370f0c3619930b39aefc6360094fc4
Author: Gwendal Grignou <gwendal@chromium.org>
Date: Thu Feb 09 20:47:33 2017

Enabling ext4 directory encryption at install/init based on USE flag.

When enabling directory encryption, we can not rollback to images that
have e2fsprogs packaged version 1.42 or older (pre-53 images).
Condition modifying stateful superblock on USE flag direncryption.

BUG=chromium:689105, chromium:590820 
TEST=On cave, build chromeos-installer with and without direncryption
flag. Verify that when not set, even if install can handle directory
encryption, ext4_dir_encryption_supported returns false.
Check produced /usr/share/misc/chromeos-common.sh in both case.

Change-Id: I04a7da4bad0607bb0244726fe66f1945286dc34c
Signed-off-by: Gwendal Grignou <gwendal@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/439909

[modify] https://crrev.com/2a26ae5f3a370f0c3619930b39aefc6360094fc4/chromeos-base/chromeos-installer/chromeos-installer-9999.ebuild

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/platform2/+/acb063535ff688dc898cf691196e16413c32f022

commit acb063535ff688dc898cf691196e16413c32f022
Author: Gwendal Grignou <gwendal@chromium.org>
Date: Thu Feb 09 20:47:34 2017

init/install: enable ext4 crypto option on stateful partition.

Gate setting -O encrypt on USE flag direncryption.
We need to be sure that root partition have proper e2fsprogs to handle
dir encryption (1.43.x)

BUG=chromium:689105, chromium:590820 
CQ-DEPEND=CL:439909
TEST=On cave, build chromeos-installer with and without
direncryption
flag. Verify that when not set, even if install can handle directory
encryption, ext4_dir_encryption_supported returns false.
Check produced /usr/share/misc/chromeos-common.sh in both case.

This reverts commit 06caeb6609c37c040ae764f094abfd270215969c.

Change-Id: Iaa77b9a3d701b36be41c177b0a81b4cb70883965
Signed-off-by: Gwendal Grignou <gwendal@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/439790
Reviewed-by: Mike Frysinger <vapier@chromium.org>

[modify] https://crrev.com/acb063535ff688dc898cf691196e16413c32f022/installer/share/chromeos-common.sh
[modify] https://crrev.com/acb063535ff688dc898cf691196e16413c32f022/init/chromeos_startup
[modify] https://crrev.com/acb063535ff688dc898cf691196e16413c32f022/installer/chromeos-install

Should be fixed.