Re: [PATCH RFC 2/4] keys: add KEY_SPEC_IPE_KEYRING
flat view
From: Christian Brauner <brauner@kernel.org>
Date: 2026-10-21 13:51:29
Also in:
bpf, keyrings, linux-doc, linux-kselftest, lkml
On Mon, Oct 19, 2026 at 04:24:29PM -0700, Fan Wu wrote:
On 10/19/2026 2:40 PM, Manuel Huber via B4 Relay wrote:quoted
From: Manuel Huber <redacted> The IPE policy keyring is allocated unlinked, so userspace would otherwise have to scrape /proc/keys to name it. Signed-off-by: Manuel Huber <redacted> ---I'm ok with this id addition, but why can't Kata use keyctl to find the keyring by name? e.g. keyctl padd asymmetric "" %:.ipe < cert.der. If the concern is that /proc/keys can be spoofed, that would mean other processes are already running while the keyring is still unsealed, which seems even less appropriate.
Why do you object to a reliable and trivial way for userspace to interact with a security sensitive kernel keyring in a dedicated reserved namespace just for this purpose?