linux-kernel - Re: [RFC][PATCH v3 5/6] encrypted-keys: add ecryptfs format support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 26 Jan 2011 07:57:11 -0500
From:	Mimi Zohar <zohar@...ux.vnet.ibm.com>
To:	David Howells <dhowells@...hat.com>
Cc:	Roberto Sassu <roberto.sassu@...ito.it>,
	linux-security-module@...r.kernel.org, keyrings@...ux-nfs.org,
	linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org,
	jmorris@...ei.org, safford@...son.ibm.com, ramunno@...ito.it,
	tyhicks@...ux.vnet.ibm.com, kirkland@...onical.com
Subject: Re: [RFC][PATCH v3 5/6] encrypted-keys: add ecryptfs format support

On Wed, 2011-01-26 at 11:18 +0000, David Howells wrote:
> Roberto Sassu <roberto.sassu@...ito.it> wrote:
> 
> >  security/keys/keys_ecryptfs.c            |   81 ++++++++++++++++++++++++++++++
> >  security/keys/keys_ecryptfs.h            |   30 +++++++++++
> 
> Can you rename these files please?  The 'keys' prefix is redundant.  They're
> obviously about keys, or they shouldn't be in this directory.  I'd suggest
> something like 'ecryptfs_format.[ch]'.
> 
> You might want to make a subdir here specifically for the trusted and
> encrypted keys and all their formats and move those files into it if you're
> going to have lots of formats.

We think most other encrypted key usages will be unformatted. Perhaps,
for the time being, we should wait and see before making an 'encrypted'
subdirectory. 

Mimi

> >  /*
> > + * valid_ecryptfs_desc - verify the description of a new/loaded encrypted key
> > + *
> > + * The description of a encrypted key with format 'ecryptfs' must contain
> > + * exactly 16 hexadecimal characters.
> > + *
> > + */
> > +static int valid_ecryptfs_desc(const char *ecryptfs_desc)
> > +{
> 
> I think we need an additional key type operation - one that allows you to pass
> judgement on the description to be given for a key in key_alloc().  On the
> other hand, this doesn't help here as you can't do a full check on the key
> description without the payload.
> 
> David
> --
> To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/