linux-kernel - Re: Revised keyrings(7) man page for review

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 13 Dec 2016 14:52:00 +0100
From:   "Michael Kerrisk (man-pages)" <mtk.manpages@...il.com>
To:     David Howells <dhowells@...hat.com>
Cc:     mtk.manpages@...il.com, lkml <linux-kernel@...r.kernel.org>,
        Eugene Syromyatnikov <evgsyr@...il.com>,
        keyrings@...r.kernel.org, linux-man <linux-man@...r.kernel.org>
Subject: Re: Revised keyrings(7) man page for review

On 12/13/2016 02:38 PM, David Howells wrote:
> Michael Kerrisk (man-pages) <mtk.manpages@...il.com> wrote:
> 
>> So, I've updated this piece a couple of times since the draft that you
>> reviewed, and by now it reads:
>>
>>        "big_key" (since Linux 3.13)
>>               This key type is similar to the "user" key type, but it may
>>               hold  a  payload  of up to 1 MiB in size.  This key type is
>>               useful for tasks such as holding Kerberos ticket caches.
> 
> I'm not sure that "tasks" is quite the word I'd use here (it's overloaded).
> Perhaps "purposes"?

Fixed.

>>               The payload data may be stored in  the  swap  space  rather
>>               than in kernel memory if the data size exceeds the overhead
>>               of storing the data encrypted in swap space.  (A tmpfs file
>>               is  used,  which requires filesystem structures to be allo‐
>>               cated in the kernel; The size of  these  structures  deter‐
>>               mines  the  size  threshold  above  which the tmpfs storage
>>               method  is  used.)   Since  Linux  4.8,  payload  data   is
>>               encrypted,  to  prevent  it  being written unencrypted into
>>               swap space.
> 
> I would either drop the first "encrypted" ("storing the data encrypted") since

I already dropped that first "encrypted".

> you mention this later or move it earlier to be after the word "stored" ("may
> be stored encrypted").
> 
> Note that with the "Since Linux 4.8 ..." sentence, the encryption is only
> applied if it is stored into tmpfs.

Thanks for that tip.

> Also, the payload isn't directly stored into swapspace, but is rather stored
> into tmpfs, from where it can be swapped.  This is important since you can use
> this type of key without any swapspace available to your system.

Yes, the text still needs some work... How about:


       "big_key" (since Linux 3.13)
              This key type is similar to the "user" key type, but it may
              hold  a  payload  of up to 1 MiB in size.  This key type is
              useful for purposes such as holding Kerberos ticket caches.

              The payload data may  be  stored  in  a  tmpfs  filesystem,
              rather  than in kernel memory, if the data size exceeds the
              overhead of storing the data in the  filesystem.   (Storing
              the  data in a filesystem requires filesystem structures to
              be allocated in the kernel.  The size of  these  structures
              determines the size threshold above which the tmpfs storage
              method is used.)  Since Linux  4.8,  the  payload  data  is
              encrypted when stored in tmpfs, to prevent it being written
              unencrypted into swap space.

?

Thanks,

Michael



-- 
Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
Linux/UNIX System Programming Training: http://man7.org/training/