Re: Proposal for keying encrypted filesystem

[Hans Reiser <reiser@namesys.com>]

Valdis.Kletnieks@vt.edu wrote:

>On Tue, 01 Apr 2003 20:06:32 +0400, Hans Reiser said:
>
>  
>
>>Are you sure we should not get keys from the environment? Is there too 
>>much performance cost?
>>    
>>
>
>It's not just a performance cost issue.  It's also a security issue.
>
>There's too many ways to leak the contents of /proc/<nnnn>/environ.  Yes,
>it's mode 600.  (Think all the LD_* environment variable bugs.. ;)
>  
>
You mean because processes might not be secure in what they do with 
their info about their environment variables?

Like shells....

Hmm.....

>
>Also, there's the problem that keys are per-file (possibly) while environments
>are per-process.  As a result, a process that uses files in multiple security
>domains can chew up a *LOT* of environment space.
>
>A better bet would be to use the LSM security framework to create a module
>that carries the tokens around for the process - this could even allow you
>to do things like add a new key token to a process group leader and have
>it propagate to already-running children (which is a phenomenally useful
>thing to do that you can't do with an environment variable).  So for
>instance, you could add a new key to your X login process, and all the
>myriad subshells would get it - and thus any processes THEY launch) without
>the need to log out from X and log back in again...
>
Ok, let's do it.  Edward, find some documentation about this and send us 
info....

>
>  
>
>>It would be best if people could use applications that are unaware of 
>>the crypto mechanism when accessing files.
>>    
>>
>
>Correct.  If the app can't use the normal open() call it's a non-starter.
>  
>


-- 
Hans