Re: [PATCH v1 2/4] nfsd: Add a key for signing filehandles

[Jeff Layton <jlayton@kernel.org>]

On Fri, 2026-01-16 at 09:32 -0500, Benjamin Coddington wrote:
> Expand the nfsd_net to hold a siphash_key_t value "fh_key".
> 
> Expand the netlink server interface to allow the setting of the 128-bit
> fh_key value to be used as a signing key for filehandles.
> 
> Add a file to the nfsd filesystem to set and read the 128-bit key,
> formatted as a uuid.
> 
> Signed-off-by: Benjamin Coddington <bcodding@hammerspace.com>
> ---
>  Documentation/netlink/specs/nfsd.yaml | 12 ++++
>  fs/nfsd/netlink.c                     | 15 +++++
>  fs/nfsd/netlink.h                     |  1 +
>  fs/nfsd/netns.h                       |  2 +
>  fs/nfsd/nfsctl.c                      | 85 +++++++++++++++++++++++++++
>  fs/nfsd/trace.h                       | 19 ++++++
>  include/uapi/linux/nfsd_netlink.h     |  2 +
>  7 files changed, 136 insertions(+)
> 
> diff --git a/Documentation/netlink/specs/nfsd.yaml b/Documentation/netlink/specs/nfsd.yaml
> index badb2fe57c98..a467888cfa62 100644
> --- a/Documentation/netlink/specs/nfsd.yaml
> +++ b/Documentation/netlink/specs/nfsd.yaml
> @@ -81,6 +81,9 @@ attribute-sets:
>        -
>          name: min-threads
>          type: u32
> +      -
> +        name: fh-key
> +        type: binary
>    -
>      name: version
>      attributes:
> @@ -227,3 +230,12 @@ operations:
>            attributes:
>              - mode
>              - npools
> +    -
> +      name: fh-key-set
> +      doc: set encryption key for filehandles
> +      attribute-set: server
> +      flags: [admin-perm]
> +      do:
> +        request:
> +          attributes:
> +            - fh-key

Rather than a new netlink operation, I think we might be better served
with just sending the fh-key down as an optional attribute in the
"threads" op. It's a per-netns attribute anyway, and the threads
setting is handled similarly.
-- 
Jeff Layton <jlayton@kernel.org>