From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934219AbcHJSWR (ORCPT ); Wed, 10 Aug 2016 14:22:17 -0400 Received: from mx1.redhat.com ([209.132.183.28]:59124 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S934058AbcHJSWM (ORCPT ); Wed, 10 Aug 2016 14:22:12 -0400 Subject: Re: [dm-devel] [RFC] dm-crypt: add ability to use keys from the kernel key retention service To: Andrey Ryabinin , Alasdair Kergon , Mike Snitzer , dm-devel@redhat.com References: <1470750966-13028-1-git-send-email-aryabinin@virtuozzo.com> Cc: Igor@redhat.com, Sukhih , linux-kernel@vger.kernel.org, Mikulas Patocka , Milan Broz From: Ondrej Kozina Message-ID: <7aa99e52-6ad8-9da2-759f-58c47f2e5256@redhat.com> Date: Wed, 10 Aug 2016 13:16:11 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <1470750966-13028-1-git-send-email-aryabinin@virtuozzo.com> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.25]); Wed, 10 Aug 2016 11:16:14 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 08/09/2016 03:56 PM, Andrey Ryabinin wrote: Hi Andrey, I'm definitely in favour of dm-crypt with support for kernel keyring service, but I think this patch do lack in addressing few issues: Currently the dm-crypt guarantees that on remove ioctl command the volume key gets deleted from both crypto layer and device-mapper subsystem without exception. I believe we should stick to the guarantee. At least let's provide an option that would immediately invalidate the key passed via key description on table destruction. Or on last table destruction that would reach dm-crypt internal reference count on such key equal to zero. Each table key has at least single copy in crypto layer anyway... This is no big deal on live system (copy in crypto layer) but after proper system shutdown there should be no key in system memory (coldboot risk mitigation). While it may sound contradicting my claim about guaranteed key destruction I'd like to be able to perform table load (imagine admin wants to resize dm-crypt device) without need of reuploading the key every time. Even when such user/admin has no access to already active volume key put in a keyring. IOW it doesn't matter what keyring the key was originally anchored in. (Re)load of table with valid key description should always pass). The uspace part is about to land in cryptsetup 2.0 hopefully later this year. Most probably the kernel keyring will be used with other features of 2.0 release apart from loading dm-crypt mappings. Last but not least: Mind me asking where do you plan to use it? In case we come with different implementation I'd like to reassure it'll be still of use to you. Regards Ondrej