Re: Why add the general notification queue and its sources

Ray Strode [off-list ref] writes:

Linus Torvalds [off-list ref] wrote:

quoted

That is *way* too specific to make for any kind of generic
notification mechanism.

Well from my standpoint, I just don't want to have to poll... I don't
have a strong opinion about how it looks architecturally to reach that
goal.

Ideally, at a higher level, I want the userspace api that gnome uses
to be something like:

err = krb5_cc_watch (ctx, ccache, (krb5_cc_change_fct) on_cc_change ,
&watch_fd);

then a watch_fd would get handed back and caller could poll on it. if
it woke up poll(), caller would do

krb5_cc_watch_update (ctx, ccache, watch_fd)

or so and it would trigger on_cc_change to get called (or something like that).

If under the hood, fd comes from opening /dev/watch_queue, and
krb5_cc_watch_update reads from some mmap'ed buffer to decide whether
or not to call on_cc_change, that's fine with me.

If under the hood, fd comes from a pipe fd returned from some ioctl or
syscall, and krb5_cc_watch_update reads messages directly from that fd
to decide whether or not to call on_cc_change, that's fine with
me. too.

it could be an eventfd too, or whatever, too, just as long as its
something I can add to poll() and don't have to intermittently poll
... :-)

quoted

And why would you do a broken big-key thing in the kernel in the
first place? Why don't you just have a kernel key to indirectly
encrypt using a key and "additional user space data". The kernel
should simply not take care of insane 1MB keys.

🤷 dunno.  I assume you're referencing the discussions from comment 0
on that 2013 bug.  I wasn't involved in those discussions, I just
chimed in after they happened trying to avoid having to add polling
:-)

I have no idea why a ticket would get that large. I assume it only is
in weird edge cases.

Sadly they're not weird, but yes.  Kerberos tickets can get decently
large due to Microsoft's PACs (see MS-PAC and MS-KILE), which we need to
process, understand, and store for Active Directory interop.  I'm not
sure if I've personally made one over 1MB, but it could easily occur
given enough claims (MS-ADTS).

Anyway, gnome treats the tickets as opaque blobs.  it doesn't do anything
with them other than tell the user when they need to get refreshed...

all the actual key manipulation happens from krb5 libraries.

of course, one advantage of having the tickets kernel side is nfs
could in theory access them directly, rather than up calling back to
userspace...

Easy availability to filesystems is in fact the main theoretical
advantage of the keyring for us in krb5 (and, for whatever it's worth,
is why we're interested in namespaced keyrings for containers).  Our
privilege separation mechanism (gssproxy) is cache-type agnostic, and we
do have other credential cache types (KCM and DIR/FILE) in the
implementation.

Thanks,
--Robbie

--
Robbie Harwood
Kerberos Development Lead
Security Engineering Team
Red Hat, Inc.
Boston, MA, US