Re: [PATCH RFC 2/5] NFS: allocate the .nfs keyring per network namespace

["Chuck Lever" <cel@kernel.org>]

On Fri, Sep 18, 2026, at 10:44 AM, Hannes Reinecke wrote:
> On 9/18/26 4:05 PM, Chuck Lever wrote:
>> Commit 87268f7a4f1f ("nfs: create a kernel keyring") allocates one
>> .nfs keyring at module load, and nothing in the NFS client reads it.
>> One module-wide keyring also cannot isolate x.509 credentials
>> between network namespaces. Each tlshd instance services the
>> handshake socket of one network namespace, so a credential
>> provisioned for that namespace's mounts has to be reachable by that
>> tlshd and by no other.
>> 
>> Allocate one .nfs keyring per network namespace in nfs_net_init()
>> and release it in nfs_net_exit(). tlshd finds a keyring by name
>> through /proc/keys, which is not namespace scoped, so each handshake
>> request has to carry the keyring serial instead. Allocate the
>> keyring under a kernel credential rather than that of the task
>> creating the namespace, so an LSM labels every namespace's keyring
>> the same way.

> Curiously enough, I had been pondering a similar issue.
> Thing is, when running within a container (eg a docker one) access
> access to /proc/keys might be restricted, and from what I've
> gathered each container gets its own, _empty_ keyring.
> (certainly an empty session keyring ...).
> So I wonder what'll happen with the predefined keyrings (like the
> .nvme keyring); one possibility is surely to make them network
> namespace aware.
> But the alternative approach I'm exploring is to allow each container
> to create its own (.nvme) keyring; that would have the advantage of
> being more flexible and we wouldn't need to rely on 'magic' names.

IMO we need to hear from the folks who have deep keyring expertise
to understand what is most flexible and most idiomatic. I'm certainly
not expert enough to make those calls.

It would be great if tlshd's NVMe and NFS/NFSD keyring support
behaved consistently with each other, but perhaps that's just my
compulsion for symmetry talking.

I'm willing to take a look at patches, if you have any.


-- 
Chuck Lever (Come to NFS bake-a-thon! https://nfsv4bat.org)