Re: libsed in mdadm

[Jes Sorensen <jes@trained-monkey.org>]

On 8/21/23 10:16, Mariusz Tkaczyk wrote:
> Hello,
> IMSM/VROC is going to support self-encrypted drives. With this feature you need
> to unlock the drives during boot-up in UEFI first. It is kind of protection
> from physical stealing.
> 
> To ensure security, Linux have to respect that. It means that we need to
> determine if the drive support locking and do not allow to mix locked and
> unlocked drives in one IMSM array.
> 
> To grab that information we will need to impose the "magic commands" to the
> drives. There is a libsed library, designed for such purposes:
> https://github.com/sedcli/sedcli
> 
> So far I know, this library is not released under distributions (not handled by
> package managers) and that will bring not user friendly dependency- you will
> need to compile and install the lib first to build mdadm.
> 
> The sedcli project is maintained in Intel, currently it is not in active
> development but there are no plans to drop it, interest around it is growing as
> you can see. It seems to be great opportunity for this project to
> become integrated with mainstream distributions when mdadm will start to
> require it.
> 
> So, my questions are: Are we fine with adding this dependency? Are there big
> cons you see?
> Obviously, I will make it optional like libudev is.
> 
> I can try to re-implement the functionality I need in mdadm but it is like
> reinventing the wheel.
> 
> Any feedback will be appreciated.

Hi Mariusz,

I am not against adding it to mdadm, though I think a better approach is
to try and get the library built as a package for the distros.

Did you look into that yet?

Thanks,
Jes