Re: [Ksummit-discuss] [TECH TOPIC] Containerisation, namespaces and keyrings

[Mimi Zohar <zohar@linux.vnet.ibm.com>]

On Fr, 2016-07-22 at 12:01 +0100, David Howells wrote:
> I'm not sure this is the right venue for this, but keyrings will need to be
> namespaced/containerised at some point.
> 
> The problem is that it's an icky problem given that different key types really
> want to live in different namespaces, and upcalls may want to done in
> different containers, depending on the key type.
> 
> For example, DNS resolver keys - should they be in the network, the filesystem
> namespace or neither?  Should the upcall be in the current container or the
> root container?
> 
> Authentication keys, such as used by kafs and AF_RXRPC - should they be in the
> filesystem namespace (kafs is an fs), the network namespace (AF_RXRPC is a net
> protocol) or the user namespace?
> 
> Should crypto keys, such as the asymmetric key type, be in the user namespace?
> What about use by module signing?  Should key operations in the current
> container have access to a blacklist in the root container?  Should key
> verification in the current container have access to system keyrings?  The
> TPM?
> 
> This might actually be right for a hallway track.

Mat Martineau' patch set might address some of these issues for the
asymmetric key type.  As part of the container/namespace initialization,
these self trusted keyrings could be created.

Mimi