lkml.org 
[lkml]   [2014]   [Mar]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: RFC: 'ioctl' for keyrings
From
Date
On Thu, 2014-03-13 at 16:17 +0000, David Howells wrote: 
> David Howells <dhowells@redhat.com> wrote:
>
> > I can fix this in one of a number of ways:
> >
> > (1) Provide a generic control operation (analogous with ioctl()) that allows
> > the user to make some general operation on a key (querying it, altering
> > it, interacting with hardware).
> >
> > (2) Provide an alter operation that only allows the key to be altered.
> > Looking at trusted_update(), though, I have a suspicion that this may not
> > be sufficient as that also seems to invoke an interaction with the TPM.
> >
> > (3) Provide separate, specific keyctl functions for the special operations
> > required by encrypted and trusted keys (and other key types potentially)
> > that are then validated in the core and routed to the key type.
>
> (4) Simply make key_update() look for the encrypted and trusted key types
> and call a special key type op for those. The main ->update op will be
> taking preparsed data and would no longer be callable in this situation.

I prefer this last option. Define a separate 'update' option for trusted
and encrypted keys, which would only create or modify, but never replace
an existing key.

thanks,

Mimi



\
 
 \ /
  Last update: 2014-03-13 18:21    [W:3.120 / U:0.604 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site