[Ksummit-discuss] [TECH TOPIC] Containerisation, namespaces and keyrings
Mimi Zohar
zohar at linux.vnet.ibm.com
Wed Jul 27 19:47:55 UTC 2016
On Fr, 2016-07-22 at 12:01 +0100, David Howells wrote:
> I'm not sure this is the right venue for this, but keyrings will need to be
> namespaced/containerised at some point.
>
> The problem is that it's an icky problem given that different key types really
> want to live in different namespaces, and upcalls may want to done in
> different containers, depending on the key type.
>
> For example, DNS resolver keys - should they be in the network, the filesystem
> namespace or neither? Should the upcall be in the current container or the
> root container?
>
> Authentication keys, such as used by kafs and AF_RXRPC - should they be in the
> filesystem namespace (kafs is an fs), the network namespace (AF_RXRPC is a net
> protocol) or the user namespace?
>
> Should crypto keys, such as the asymmetric key type, be in the user namespace?
> What about use by module signing? Should key operations in the current
> container have access to a blacklist in the root container? Should key
> verification in the current container have access to system keyrings? The
> TPM?
>
> This might actually be right for a hallway track.
Mat Martineau' patch set might address some of these issues for the
asymmetric key type. As part of the container/namespace initialization,
these self trusted keyrings could be created.
Mimi
More information about the Ksummit-discuss
mailing list