linux-kernel - [PATCH v2 0/5] eCryptfs key locking patches

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 21 Mar 2011 16:00:50 +0100
From:	Roberto Sassu <roberto.sassu@...ito.it>
To:	tyhicks@...ux.vnet.ibm.com
Cc:	kirkland@...onical.com, dhowells@...hat.com, jmorris@...ei.org,
	linux-fsdevel@...r.kernel.org, keyrings@...ux-nfs.org,
	linux-kernel@...r.kernel.org, ecryptfs-devel@...ts.launchpad.net,
	Roberto Sassu <roberto.sassu@...ito.it>
Subject: [PATCH v2 0/5] eCryptfs key locking patches

This patch set modifies the eCryptfs code in order to lock requested keys
while authentication tokens are used to encrypt or decrypt files.

Changelog:
  - removed patch "eCryptfs: ecryptfs_keyring_auth_tok_for_sig() bug fix"
	(already applied to the eCryptfs git repository at git.kernel.org);
  - added new patch "eCryptfs: removed num_global_auth_toks from 
	ecryptfs_mount_crypt_stat";
  - patch 3/5: avoid invalidating a global authentication token only if
	key_validate() returns the error -EKEYEXPIRED;
  - patch 3/5: added new function
	process_find_global_auth_tok_for_sig_err() to handle errors
	returned by ecryptfs_find_global_auth_tok_for_sig();
  - patch 3/5: return an error in the function
	ecryptfs_generate_key_packet_set() if at least one global
	authentication token cannot be retrieved.

Roberto Sassu


Roberto Sassu (5):
  eCryptfs: removed num_global_auth_toks from ecryptfs_mount_crypt_stat
  eCryptfs: modified size of keysig in the ecryptfs_key_sig structure
  eCryptfs: verify authentication tokens before their use
  eCryptfs: move ecryptfs_find_auth_tok_for_sig() call before
    mutex_lock
  eCryptfs: write lock requested keys

 fs/ecryptfs/crypto.c          |    1 -
 fs/ecryptfs/ecryptfs_kernel.h |    4 +-
 fs/ecryptfs/keystore.c        |  280 ++++++++++++++++++++++++++---------------
 fs/ecryptfs/main.c            |    8 +-
 4 files changed, 185 insertions(+), 108 deletions(-)

-- 
1.7.4


Download attachment "smime.p7s" of type "application/x-pkcs7-signature" (2061 bytes)