lkml.org 
[lkml]   [2019]   [Dec]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: One question about trusted key of keyring in Linux kernel.
    From
    Date
    On Mon, 2019-12-09 at 21:47 +0200, Jarkko Sakkinen wrote:
    > On Mon, Dec 02, 2019 at 10:55:32AM -0800, James Bottomley wrote:
    > > blob but it looks like we need to fix the API. I suppose the good
    > > news is given this failure that we have the opportunity to rewrite
    > > the API since no-one else can have used it for anything because of
    > > this. The
    >
    > I did successfully run this test when I wrote it 5 years ago:
    >
    > https://github.com/jsakkine-intel/tpm2-scripts/blob/master/keyctl-smo
    > ke.sh
    >
    > Given that there is API a way must be found that backwards
    > compatibility
    > is not broken. New format is fine but it must co-exist.

    The old API is unsupportable in the combination of policy + auth as I
    already explained. The kernel doesn't have access to the nonces to
    generate the HMAC because the session was created by the user and the
    API has no way to pass them in (plus passing them in would be a huge
    security failure if we tried). Given that Shirley appears to be the
    first person ever to try this, I don't think the old API has grown any
    policy users so its safe to remove it. If we get a complaint, we can
    discuss adding it back.

    James

    \
     
     \ /
      Last update: 2019-12-09 21:32    [W:3.598 / U:0.784 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site