> > > And another silly argument: if we had /dev/mktme, then we could > > possibly get away with avoiding all the keyring stuff entirely. > > Instead, you open /dev/mktme and you get your own key under the hook. > > If you want two keys, you open /dev/mktme twice. If you want some > > other program to be able to see your memory, you pass it the fd. > > We still like the keyring because it's one-stop-shopping as the place > that *owns* the hardware KeyID slots. Those are global resources and > scream for a single global place to allocate and manage them. The > hardware slots also need to be shared between any anonymous and > file-based users, no matter what the APIs for the anonymous side. MKTME driver (who creates /dev/mktme) can also be the one-stop-shopping. I think whether to choose keyring to manage MKTME key should be based on whether we need/should take advantage of existing key retention service functionalities. For example, with key retention service we can revoke/invalidate/set expiry for a key (not sure whether MKTME needs those although), and we have several keyrings -- thread specific keyring, process specific keyring, user specific keyring, etc, thus we can control who can/cannot find the key, etc. I think managing MKTME key in MKTME driver doesn't have those advantages. Thanks, -Kai
