Re: [PATCH] [RFC] KEYS: Add invalidation support

David Howells
2011-12-15T13:14:30Z

Mimi Zohar <zohar@linux.vnet.ibm.com> wrote:

> Not all keys can be 'refetched'. A trusted key, sealed to a PCR, can
> extend the PCR to prevent it from being re-loaded. Removing the trusted
> key could prevent the instantiation/update of encrypted keys.

I meant discard and set up a new struct key not actually invalidate any real
key store. Is this actually a problem? If it is, I can certainly add a flag
to prevent struct keys from being invalidated; but that doesn't stop them from
being unlinked or revoked.

David