linux-kernel - Re: Is ndo_do_ioctl still acceptable?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 12 Nov 2015 15:30:31 -0500
From:	Austin S Hemmelgarn <ahferroin7@...il.com>
To:	"Jason A. Donenfeld" <Jason@...c4.com>,
	Stephen Hemminger <stephen@...workplumber.org>
Cc:	David Miller <davem@...emloft.net>,
	LKML <linux-kernel@...r.kernel.org>,
	Netdev <netdev@...r.kernel.org>
Subject: Re: Is ndo_do_ioctl still acceptable?

On 2015-11-12 11:58, Jason A. Donenfeld wrote:
> Hi Stephen,
>
> Thanks for your response.
>
> On Thu, Nov 12, 2015 at 5:34 PM, Stephen Hemminger
> <stephen@...workplumber.org> wrote:
>> The problem is ioctl's are device specific, and therefore create dependency
>> on the unique features supported by your device.
>> The question always comes up, why is this new API not something general?
>
> In this case, it really is for unique features of my device. My device
> has its own unique notion of a "peer" based on a particular elliptic
> curve point and some other interesting things. It's not something
> generalizable to other devices. The thing that makes my particular
> device special is these attributes that I need to make configurable. I
> think then, by your criteria, ioctl would actually be perfect. In
> other words, I interpret what you wrote to mean "generalizable:
> netlink. device-specific: ioctl." If that's a decent summary, then
> ioctl is certainly good for me.
>
On the other hand, based on what you are saying about your device, it 
sounds like you are working on some kind of cryptographically secured 
(either authenticated or encrypted or both) tunnel, in which case the 
fact that security is easier to handle with netlink than ioctls becomes 
important.  If you can't ensure security of the endpoint configuration, 
you can't ensure security of the tunnel itself.



Download attachment "smime.p7s" of type "application/pkcs7-signature" (3019 bytes)