linux-nfs.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Benjamin Coddington <bcodding@hammerspace.com>
To: Steve Dickson <steved@redhat.com>,
	Benjamin Coddington <bcodding@hammerspace.com>
Cc: linux-nfs@vger.kernel.org
Subject: [PATCH v1 0/2] nfs-utils: encrypted filehandle support
Date: Sat, 27 Dec 2025 12:03:50 -0500	[thread overview]
Message-ID: <cover.1766853122.git.bcodding@hammerspace.com> (raw)
In-Reply-To: <510E10A4-11BE-412D-93AF-C4CC969954E7@hammerspace.com>

Here are two patches allowing userspace to set a secret key for kNFSD to
encrypt filehandles, and also set the option to encrypt filehandles for an
export.

The secret key is only implemented via nfs.conf and "nfsdctl autostart", as
further interfaces to set it into the kernel have not yet been built.  I
expect we may need a way for rpc.nfsd to set the key - but perhaps the
community would like to continue to transition to nfsdctl for future
features.

Comments and critique welcomed.

Benjamin Coddington (2):
  nfsdctl: Add support for passing encrypted filehandle key
  exportfs: Add support for export option encrypt_fh

 configure.ac                 |   4 +-
 nfs.conf                     |   1 +
 support/include/nfs/export.h |   2 +-
 support/nfs/exports.c        |   4 ++
 systemd/nfs.conf.man         |   1 +
 utils/exportfs/exportfs.c    |   2 +
 utils/exportfs/exports.man   |   6 ++
 utils/nfsdctl/Makefile.am    |   2 +-
 utils/nfsdctl/nfsd_netlink.h |   2 +
 utils/nfsdctl/nfsdctl.c      | 132 ++++++++++++++++++++++++++++++++++-
 utils/nfsdctl/nfsdctl.h      |  10 ++-
 11 files changed, 158 insertions(+), 8 deletions(-)

-- 
2.50.1


  reply	other threads:[~2025-12-27 17:03 UTC|newest]

Thread overview: 28+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-12-27 17:00 [RFC/v1] kNFSD Encrypted Filehandles Benjamin Coddington
2025-12-27 17:03 ` Benjamin Coddington [this message]
2025-12-27 17:03   ` [PATCH v1 1/2] nfsdctl: Add support for passing encrypted filehandle key Benjamin Coddington
2025-12-27 17:03   ` [PATCH v1 2/2] exportfs: Add support for export option encrypt_fh Benjamin Coddington
2025-12-27 17:04 ` [PATCH v1 0/7] kNFSD Encrypted Filehandles Benjamin Coddington
2025-12-27 17:04   ` [PATCH v1 1/7] nfsd: Convert export flags to use BIT() macro Benjamin Coddington
2025-12-27 17:04   ` [PATCH v1 2/7] nfsd: Add a symmetric-key cipher for encrypted filehandles Benjamin Coddington
2025-12-27 17:04   ` [PATCH v1 3/7] nfsd/sunrpc: add per-thread crypto context pointer Benjamin Coddington
2025-12-27 17:04   ` [PATCH v1 4/7] NFSD: Add a per-knfsd reusable encfh_buf Benjamin Coddington
2025-12-28 17:52     ` kernel test robot
2025-12-29  0:33     ` kernel test robot
2025-12-27 17:04   ` [PATCH v1 5/7] NFSD/export: Add encrypt_fh export option Benjamin Coddington
2025-12-27 17:04   ` [PATCH v1 6/7] NFSD: Add filehandle crypto functions and helpers Benjamin Coddington
2025-12-27 17:14     ` Benjamin Coddington
2025-12-28  1:34     ` Chuck Lever
2025-12-28 20:45       ` Eric Biggers
2025-12-29 13:39         ` Benjamin Coddington
2025-12-28  5:17     ` kernel test robot
2025-12-27 17:04   ` [PATCH v1 7/7] NFSD: Enable filehandle encryption Benjamin Coddington
2025-12-27 23:06   ` [PATCH v1 0/7] kNFSD Encrypted Filehandles NeilBrown
2025-12-27 23:26     ` Benjamin Coddington
2025-12-28  5:49       ` NeilBrown
2025-12-28 17:05         ` Rick Macklem
2025-12-29 12:52           ` Benjamin Coddington
2025-12-28  5:33   ` [PATCH v1 1/7] nfsd: Convert export flags to use BIT() macro NeilBrown
2025-12-29 12:11     ` Benjamin Coddington
2025-12-28 17:09   ` [PATCH v1 0/7] kNFSD Encrypted Filehandles Chuck Lever
2025-12-29 13:23     ` Benjamin Coddington

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=cover.1766853122.git.bcodding@hammerspace.com \
    --to=bcodding@hammerspace.com \
    --cc=linux-nfs@vger.kernel.org \
    --cc=steved@redhat.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).