Re: Proposal for keying encrypted filesystem

[Hans Reiser <reiser@namesys.com>]

Edward Shushkin wrote:

>Hans Reiser wrote:
>  
>
>>Edward Shushkin wrote:
>>
>>    
>>
>>>Valdis.Kletnieks@vt.edu wrote:
>>>
>>>
>>>      
>>>
>>>>On Fri, 04 Apr 2003 09:30:29 EST, Pierre Abbat <phma@webjockey.net>  said:
>>>>
>>>>
>>>>
>>>>        
>>>>
>>>>>But I'd also like to be able to have several encrypted directories on one
>>>>>partition, with different keys, such that when I give the key any process
>>>>>with the right UID can access them. I might have a cron job that needs access
>>>>>
>>>>>
>>>>>to encrypted data.
>>>>>
>>>>>
>>>>>          
>>>>>
>>>>You need to apply "least privilege" - you don't give the key to any process
>>>>that doesn't need it.  In your example, you would make sure that any process
>>>>running under UID nnn gets given the key, so that other processes couldn't
>>>>do anything even if they *did* access them.
>>>>
>>>>Properly applied, you can even leverage it further - for instance, if your
>>>>backup process doesn't have the key tokens, you can safely let it have access
>>>>to all the files - it can read the 127 meg of data to back it up in a bitwise
>>>>manner,
>>>>
>>>>
>>>>        
>>>>
>>>I am sorry, bitwise manner seems to be impossible in reiser4: the only access
>>>to crypto files is via page cache, it requires a valid key..
>>>
>>>      
>>>
>>this is not desirable.  
>>    
>>
>
>I understand, but direct io is incompatible with transaction semantics.
>
This means what?

> On the
>other hand, on the last seminar we made a conclusion to check key validness in 
>oredr to avoid a possible security hole when read() first looks for uptodate
>(decrypted!) pages in memory before reading encrypted data from disk..
>
So how about making a key of 0 be a special case which gets you the file 
in its encrypted form?

>
>  
>
>>Encypted files need to be backed up too...
>>    
>>
>
>They will be as ordinary unix files..
>
This means what?

>Edward.
>
>  
>
>>>Edward.
>>>
>>>
>>>
>>>
>>>      
>>>
>>>>but it can't actually DO anything with the data - this is something
>>>>that you can't do in the "give everything the token" model....
>>>>
>>>> ----------------------------------------------------------------------------------------------------
>>>>  Part 1.2Type: application/pgp-signature
>>>>
>>>>
>>>>        
>>>>
>>>
>>>
>>>      
>>>
>>--
>>Hans
>>    
>>
>
>
>  
>


-- 
Hans