Re: dm-crypt crypt_status reports key?

From: Christophe Saout (christophe_at_saout.de)
Date: 02/03/05

  • Next message: Linus Torvalds: "Linux 2.6.11-rc3" 
    To: Matt Mackall <mpm@selenic.com>
Date:	Thu, 03 Feb 2005 03:34:29 +0100

    Am Mittwoch, den 02.02.2005, 17:52 -0800 schrieb Matt Mackall:

    > > An alternativ would be to use some form of handle to point to the key
    > > after it has been given to the kernel. But that would require some more
    > > infrastructure.
    >
    > There's been some talk about such infrastructure already. I believe
    > some pieces of it may already be in place.

    Yes, you are right. I didn't follow the discussion but it actually looks
    very promising. The keys in the infrastructure are reference-counted.
    That's good.

    The keyrings can be attached to either thread, processes, sessions or
    users.

    It seems that it's possible to have floating keys (not attached to any
    keyring). So we would just need to figure out how to use these keyrings
    to allow communication with userspace applications. Process keyrings
    seem to have the advantage that the keyring is dropped when it exits so
    that all keys that are not in use by the kernel are also dropped. A
    keyring for the root user would have the problem that if the cryptsetup
    application aborts in the middle you would end up with old keys lying
    around forever.

    The keyring API seems very flexible. You can define your own type of
    keys and give them names. Well, the name is probably irrelevant here and
    should be chosen randomly but it's less likely to collide with someone
    else.

    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

  • Next message: Linus Torvalds: "Linux 2.6.11-rc3"

    Relevant Pages

    • Re: In-kernel Authentication Tokens (PAGs)
      ... A keyring doesn't know what points to it, only the keys that it holds. ... TOS pointer as a child of the new keyring, ... > module could join processes to the appropriate key-ring when you login. ...
      (Linux-Kernel)
    • Re: [PATCH] implement in-kernel keys & keyring management [try #2]
      ... Files containing keyring ID numbers? ... Looking at all the keys on ... e.g. userspace searching for keys. ... the search _has_ to be available in kernel space. ...
      (Linux-Kernel)
    • Re: In-kernel Authentication Tokens (PAGs)
      ... > A keyring doesn't know what points to it, only the keys that it holds. ... > TOS pointer as a child of the new keyring, ... current key-ring. ...
      (Linux-Kernel)
    • Re: GPGkeys duplicate display of keys (GPGshell)
      ... > It would appear that someone probably me reloaded the list of keys on the ... > GPGkeys GUI and lo they appear listed twice? ... The cause is a quirk in GnuPG, ... it automatically "loads" in the default keyring. ...
      (comp.security.pgp.discuss)
    • Re: In-kernel Authentication Tokens (PAGs)
      ... > processes with different UIDs can share the same keyring EX: ... keys and keyrings are represented by file descriptors, ... There are several attachment points for keys ... I have all my process' key-ring pointers ...
      (Linux-Kernel)