On 20.08.21 22:20, Tim Harvey wrote: > On Fri, Aug 20, 2021 at 9:20 AM Ahmad Fatoum <a.fatoum@xxxxxxxxxxxxxx> wrote: >> On 20.08.21 17:39, Tim Harvey wrote: >>> Thanks for your work! >>> >>> I've been asked to integrate the capability of using CAAM to >>> blob/deblob data to an older 5.4 kernel such as NXP's downstream >>> vendor kernel does [1] and I'm trying to understand how your series >>> works. I'm not at all familiar with the Linux Key Management API's or >>> trusted keys. Can you provide an example of how this can be used for >>> such a thing? >> >> Here's an example with dm-crypt: >> >> https://lore.kernel.org/linux-integrity/5d44e50e-4309-830b-79f6-f5d888b1ef69@xxxxxxxxxxxxxx/ >> >> dm-crypt is a bit special at the moment, because it has direct support for >> trusted keys. For interfacing with other parts of the kernel like ecryptfs >> or EVM, you have to create encrypted keys rooted to the trusted keys and use >> those. The kernel documentation has an example: >> >> https://www.kernel.org/doc/html/v5.13/security/keys/trusted-encrypted.html >> >> If you backport this series, you can include the typo fix spotted by David. >> >> I'll send out a revised series, but given that a regression fix I want to >> rebase on hasn't been picked up for 3 weeks now, I am not in a hurry. >> > Thanks for the reference. > > I'm still trying to understand the keyctl integration with caam. For > the 'data' param to keyctl you are using tings like 'new <len>' and > 'load <data>'. Where are these 'commands' identified? Search for match_table_t in security/keys/trusted-keys/trusted_core.c > I may still be missing something. I'm using 4.14-rc6 with your series > and seeing the following: That's an odd version to backport stuff to.. > # cat /proc/cmdline > trusted.source=caam > # keyctl add trusted mykey 'new 32' @s)# create new trusted key named > 'mykey' of 32 bytes in the session keyring > 480104283 > # keyctl print 480104283 # dump the key > keyctl_read_alloc: Unknown error 126 > ^^^ not clear what this is Not sure what returns -ENOKEY for you. I haven't been using trusted keys on v4.14, but you can try tracing the keyctl syscall. Cheers, Ahmad > > Best regards, > > Tim > -- Pengutronix e.K. | | Steuerwalder Str. 21 | http://www.pengutronix.de/ | 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
