Re: [PATCH] implement in-kernel keys & keyring management

[David Howells <dhowells@redhat.com>]

Linus Torvalds <torvalds@osdl.org> wrote:
> So the "I don't have a key" case is more of an issue where somebody tries 
> to mount an encrypted filesystem, and the filesystem says "you don't have 
> a key".

Or in a network filesystem, such as AFS, CIFS or SMB where the key holds the
user identity mapping - perhaps a Kerberos ticket.

What I envision for AFS is that there'll be a TGT somewhere on the system,
perhaps in another key, and request-key will invoke a request to the kerberos
server to get an AFS ticket based on that TGT.

> It's not a thing like "you tried to open a file" that happens thousands of
> times a second - that one would get an EACCES if you don't have a key. 

Well, each open call would incur a key search, but I've half taken care of the
problem. Adding the concept of a limited-duration negative key would, I think,
take care of the rest.

> It would be more like "the mount binary needs a key to mount this volume, 
> so let's request that key first".
> 
> David, have you actually coded up something that uses the user callback, 
> maybe you can describe a realistic schenario...

Well:

	keyctl request <type> <description> <keyring>

Can be used to drive it at the moment, so that I can check that it works.

The scenario I'm mainly interested in involves kAFS/OpenAFS with Kerberos or
other authentication (see above). But I talked to a number of people at OLS
who also expressed an interest.

I need to work on my kAFS client at some point soon to get that to use it, but
that'll be a couple of weeks at least, I think.

> But at least to me, the /sbin/request-key thing is more like loading a 
> module. You might do it to mount a filesystem or read an encrypted volume, 
> but you wouldn't do it in the "normal" workload. It's a major event.

With AFS + Krb, you currently make the key available in advance (using the
aklog program) and any request for which you don't have a key fails with some
error or other.

You can't really do it at mount time in this case because you may have more
than one user on the system, and all of them may need to share the same
mountpoints (some people put /usr/ on AFS, for example).

David