On Wed, 23 Aug 2023 08:00:51 +0200 Hannes Reinecke <hare@xxxxxxx> wrote: > On 8/22/23 22:54, Jes Sorensen wrote: > > On 8/21/23 10:16, Mariusz Tkaczyk wrote: > >> Hello, > >> IMSM/VROC is going to support self-encrypted drives. With this feature you > >> need to unlock the drives during boot-up in UEFI first. It is kind of > >> protection from physical stealing. > >> > >> To ensure security, Linux have to respect that. It means that we need to > >> determine if the drive support locking and do not allow to mix locked and > >> unlocked drives in one IMSM array. > >> > >> To grab that information we will need to impose the "magic commands" to the > >> drives. There is a libsed library, designed for such purposes: > >> https://github.com/sedcli/sedcli > >> > >> So far I know, this library is not released under distributions (not > >> handled by package managers) and that will bring not user friendly > >> dependency- you will need to compile and install the lib first to build > >> mdadm. > >> > >> The sedcli project is maintained in Intel, currently it is not in active > >> development but there are no plans to drop it, interest around it is > >> growing as you can see. It seems to be great opportunity for this project > >> to become integrated with mainstream distributions when mdadm will start to > >> require it. > >> > >> So, my questions are: Are we fine with adding this dependency? Are there > >> big cons you see? > >> Obviously, I will make it optional like libudev is. > >> > >> I can try to re-implement the functionality I need in mdadm but it is like > >> reinventing the wheel. > >> > >> Any feedback will be appreciated. > > > > Hi Mariusz, > > > > I am not against adding it to mdadm, though I think a better approach is > > to try and get the library built as a package for the distros. > > > > Did you look into that yet? > > > We (as in 'We as an OS distributor') actually evaluated packaging libsed > some time ago, but decided against it as the original authors (namely > Intel) apparently disbanded it. So before adding it to a distro there > needs to be an active maintainer, and one would be looking to Intel here. > Thanks Hannes for feedback. I totally agree with you. I will raise it internally. Thanks, Mariusz
