From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9EDD22FBDE0 for ; Fri, 18 Sep 2026 08:05:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789718746; cv=none; b=T2duecWmBRsyZ4lHRalxQ+VFN36jV5FR7ON+NWeIlMrEbjNvnyPocccs+XomqMw57odGIAipxu4msUC6pLwDoSgqByYtNt482ICYv89qq4KudkC7e5MfeKNVo9KnEHe+XodA0VFnma+fVoUZrGgUuMgkyBtOYKBQwuTttvSngg0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789718746; c=relaxed/simple; bh=SSml5sWGhbr1aX5qXNp5m87HXKcpLyEzFeK1/Q/8sOE=; h=From:In-Reply-To:References:To:Cc:Subject:MIME-Version: Content-Type:Date:Message-ID; b=qiE4/SvpokOaqvmpL+bif12XTXuc1JVwK885wc5dPf5WEapK6K+GrNsqTs50wr3YQ9xnsm8HNvOj2j/7cNpw2qRrEEpVCk2An5OmNtbLIyo5Ov+T3PBFjzdkfaIC5KicGVl3PReN39uJ+pnYp56OscZIb1JmIoFlZwIBpZzSj2w= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=FDVUVsbN; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="FDVUVsbN" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1789718743; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=Ym7emDJFhy4PiOXGVpk05NT3ISXd1kAvgtskHF5RU0g=; b=FDVUVsbNnu16B0TDHwz3JTvDsDQT8yxvrr6iaNKOg4hHK7MbFMlI2sJ/fxM2Mo8fzor6vy ii1TSVyUU8HA5zZ+5C8YAA6i+vmsvvknaBWxfcCkH6iJ1zSQipTvfU6nDh6J+nXrY64yT3 bye3khKKUSkKds0GLz+RmkAyruezEMw= Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-546-RN0R4fb1NhK5JGQk9pctmg-1; Fri, 18 Sep 2026 04:05:38 -0400 X-MC-Unique: RN0R4fb1NhK5JGQk9pctmg-1 X-Mimecast-MFC-AGG-ID: RN0R4fb1NhK5JGQk9pctmg_1789718736 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id AA7F818512C6; Fri, 18 Sep 2026 08:05:35 +0000 (UTC) Received: from warthog.procyon.org.uk (unknown [10.44.32.54]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 1CADB1956047; Fri, 18 Sep 2026 08:05:27 +0000 (UTC) Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 3798903 From: David Howells In-Reply-To: References: <20260914-ajhalaney-dmverity-key-identifier-v1-0-01922dc1366a@amutable.com> <20260914-ajhalaney-dmverity-key-identifier-v1-1-01922dc1366a@amutable.com> To: Jarkko Sakkinen Cc: dhowells@redhat.com, Andrew Halaney , Alasdair Kergon , Mike Snitzer , Mikulas Patocka , Benjamin Marzinski , Paul Moore , James Morris , "Serge E. Hallyn" , Eric Biggers , "Theodore Y. Ts'o" , Jonathan Corbet , Shuah Khan , Randy Dunlap , dm-devel@lists.linux.dev, linux-kernel@vger.kernel.org, keyrings@vger.kernel.org, linux-security-module@vger.kernel.org, bpf@vger.kernel.org, fsverity@lists.linux.dev, linux-doc@vger.kernel.org, "Christian Brauner (Amutable)" Subject: Re: [PATCH 1/3] keys: add KEY_SPEC_DM_VERITY_KEYRING Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <715248.1789718726.1@warthog.procyon.org.uk> Date: Fri, 18 Sep 2026 09:05:26 +0100 Message-ID: <715249.1789718726@warthog.procyon.org.uk> X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Jarkko Sakkinen wrote: > This is great for discussion but what we want for the commit message > is just motivation and resolution. Actually, I think it's useful that Andrew wrote up the issues in the commit message - and I think it shows part of the motivation. The 'writing a fake /proc/keys line in the description' is something I hadn't considered. > I don't think we need all this just to say that /proc/keys in a racy > query mechanism for production, which is an issue for dm-verity, given > that nothing else is available. I think at some point, we will need a system call to search all for all accessible keys matching certain criteria by actually walking the key database. The problem there is that there may be multiple hits, so we may need something like: int count = find_key(key_serial_t start_id, const char *type, const char *desc_prefix, key_serial_t *results, size_t results_size, unsigned int flags); Allowing you to do: key_serial_t dm_key; int n = find_key(0, "keyring", ".dm_verity", &dm_key, 1, FIND_KEY_EXACT_DESC); This wouldn't be as fast as a direct lookup since it would have to walk the key tree, doing name comparisons and perm checks on each key of the type. > And secondly special keys are meant for implicit keyrings so isn't > that all there's to it? I have no particular objection to setting aside a block of negative key IDs for special keyrings that need to be accessed a lot - though I would make common reg/unreg functions that take the ID to be registered and, say, set the block at -257..-512. Moving the BFP keyring to -257 and DM to -258. David