Trond Myklebust <trond.myklebust@xxxxxxxxxx> wrote: > Unless you _are_ root and can check every executable, after presumably > rebooting into your own trusted kernel, then those requirements won't > mean squat. If you're that paranoid, then you will presumably also be > using a cryptfs-encrypted partition for cachefs, which you unmount when > you're not logged in. Actually... Cachefiles could fairly trivially add encryption. It would have to be simple encryption but you wouldn't have to store any keys locally. Currently cachefiles _copies_ data between the backingfs and the netfs pages because the direct-IO code is only usable to/from userspace. Rather than copying, encrypt/decrypt could be called. A key could be constructed at the point a cache file is looked up. It could be constructed from the coherency data. In the case of NFS that would be mtime, ctime, isize and change_attr. The coherency data would be encrypted with this key and then stored on disk, as would the contents of the file. It might be possible to chuck the cache key (NFS fh) into the encryption key too and also encrypt the cache key before it is turned into a filename, though we'd have to be careful to avoid collisions if each filename is encrypted with a different key. We'd probably have to be careful about the coherency data decrypting with a different key showing up as the wrong but valid thing. The nice thing about this is that the key need not be retained locally since it's entirely constructed from data fetched from the netfs. David -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
