OpenVZ Forum - RDF feed
type: channel
items: Re: [PATCH 1/2] eCryptfs: Introduce device handle for userspace daemon communications
items: Re: [Ecryptfs-devel] [PATCH 1/2] eCryptfs: Introduce device handle for userspace daemon communicatio
items: [PATCH] eCryptfs: Make key module subsystem respect namespaces
items: [PATCH] eCryptfs: Remove obsolete netlink interface to daemon

Re: [PATCH 1/2] eCryptfs: Introduce device handle for userspace daemon communications
type: item
description: On Tue, 15 Apr 2008 15:23:13 -0500 Michael Halcrow <mhalcrow@us.ibm.com> wrote: > Functions to facilitate reading and writing to the eCryptfs > miscellaneous device handle. This will replace the netlink interface > as the preferred mechanism for communicating with the userspace > eCryptfs daemon. > > Each user has his own daemon, which registers itself by opening the > eCryptfs device handle. Only one daemon per euid may be registered at > any given time. The eCryptfs module sends a message to a daemon by > adding its message to the daemon's outgoing message queue. The daemon > reads the device handle to get the oldest message off the queue. > > Incoming messages from the userspace daemon are immediately > handled. If the message is a response, then the corresponding process > that is blocked waiting for the response is awakened. > This is a drastic change, but the changelog doesn't tell us why it is being made! > ... > + rc = ecryptfs_find_daemon_by_euid(&daemon, current->euid); > + if (daemon->pid != current->pid) { > + rc = ecryptfs_find_daemon_by_euid(&daemon, current->euid); > + BUG_ON(current->euid != daemon->euid); > + BUG_ON(current->pid != daemon->pid); This code uses pids and uids all over the place. Will it operate correctly in a containerised environment? _______________________________________________ Containers mailing list Containers@lists.linux-foundation.org https://lists.linux-foundation.org/mailman/listinfo/containers
creator: akpm
date: 2008-04-15T21:04:53-00:00

Re: [PATCH 1/2] eCryptfs: Introduce device handle for userspace daemon communications
type: item
description: Quoting Andrew Morton (akpm@linux-foundation.org): > On Tue, 15 Apr 2008 15:23:13 -0500 > Michael Halcrow <mhalcrow@us.ibm.com> wrote: > > > Functions to facilitate reading and writing to the eCryptfs > > miscellaneous device handle. This will replace the netlink interface > > as the preferred mechanism for communicating with the userspace > > eCryptfs daemon. > > > > Each user has his own daemon, which registers itself by opening the > > eCryptfs device handle. Only one daemon per euid may be registered at > > any given time. The eCryptfs module sends a message to a daemon by > > adding its message to the daemon's outgoing message queue. The daemon > > reads the device handle to get the oldest message off the queue. > > > > Incoming messages from the userspace daemon are immediately > > handled. If the message is a response, then the corresponding process > > that is blocked waiting for the response is awakened. > > > > This is a drastic change, but the changelog doesn't tell us why it is being > made! > > > ... > > + rc = ecryptfs_find_daemon_by_euid(&daemon, current->euid); > > + if (daemon->pid != current->pid) { > > + rc = ecryptfs_find_daemon_by_euid(&daemon, current->euid); > > + BUG_ON(current->euid != daemon->euid); > > + BUG_ON(current->pid != daemon->pid); > > This code uses pids and uids all over the place. Will it operate correctly > in a containerised environment? Thanks Andrew. Mike, the pid_t definately needs to be replaced with a struct pid. As for the euid, it'd be best if you also compared the user_namespace * to make sure we support one ecryptfs deamon per user namespace. thanks, -serge _______________________________________________ Containers mailing list Containers@lists.linux-foundation.org https://lists.linux-foundation.org/mailman/listinfo/containers
creator: serue
date: 2008-04-15T21:34:02-00:00

Re: [Ecryptfs-devel] [PATCH 1/2] eCryptfs: Introduce device handle for userspace daemon communicatio
type: item
description: On Tue, Apr 15, 2008 at 02:04:53PM -0700, Andrew Morton wrote: > On Tue, 15 Apr 2008 15:23:13 -0500 > Michael Halcrow <mhalcrow@us.ibm.com> wrote: > > > Functions to facilitate reading and writing to the eCryptfs > > miscellaneous device handle. This will replace the netlink interface > > as the preferred mechanism for communicating with the userspace > > eCryptfs daemon. > > > > Each user has his own daemon, which registers itself by opening the > > eCryptfs device handle. Only one daemon per euid may be registered at > > any given time. The eCryptfs module sends a message to a daemon by > > adding its message to the daemon's outgoing message queue. The daemon > > reads the device handle to get the oldest message off the queue. > > > > Incoming messages from the userspace daemon are immediately > > handled. If the message is a response, then the corresponding process > > that is blocked waiting for the response is awakened. > > This is a drastic change, but the changelog doesn't tell us why it > is being made! This resurrects the question from 2006: On Thu, Aug 24, 2006 at 08:54:19PM -0700, Andrew Morton wrote: > - _why_ does it use netlink? I responded: > Netlink provides the transport mechanism that would minimize the > complexity of the implementation, given that we can have multiple > daemons (one per user). A regular device file was my real preference from the get-go, but I went with netlink at the time because I thought it would be less complex for managing send queues (i.e., just do a unicast and move on). It turns out that we do not really get that much complexity reduction with netlink, and netlink is more heavyweight than a device handle. In addition, the netlink interface to eCryptfs has been broken since 2.6.24. I am assuming this is a bug in how eCryptfs uses netlink, since the other in-kernel users of netlink do not seem to be having any problems. I have had one report of a user successfully using eCryptfs with netlink on 2.6.24, but for my own system…
creator: Michael Halcrow
date: 2008-04-15T22:47:50-00:00

Re: [Ecryptfs-devel] [PATCH 1/2] eCryptfs: Introduce device handle for userspace daemon communicatio
type: item
description: On Tue, Apr 15, 2008 at 05:47:50PM -0500, Michael Halcrow wrote: > If I cannot find out soon why the netlink interface in eCryptfs > broke, I am likely to just send a patch to disable it in 2.6.24 and > 2.6.25. This patch yanks key module support out of eCryptfs. In the event that the netlink bug with eCryptfs does not get resolved soon, I intend for this to apply to point releases of 2.6.24 and 2.6.25. This patch is only a feature-disabling workaround and conflicts with the patchset that introduces the device handle mechanism for communicating with the userspace key module daemon. Future kernel versions will use a regular device handle for communications with the userspace daemon rather than the netlink interface. Signed-off-by: Michael Halcrow <mhalcrow@us.ibm.com> --- fs/ecryptfs/ecryptfs_kernel.h | 1 - fs/ecryptfs/keystore.c | 422 ++--------------------------------------- fs/ecryptfs/main.c | 11 +- fs/ecryptfs/messaging.c | 6 - 4 files changed, 13 insertions(+), 427 deletions(-) diff --git a/fs/ecryptfs/ecryptfs_kernel.h b/fs/ecryptfs/ecryptfs_kernel.h index 5007f78..abff330 100644 --- a/fs/ecryptfs/ecryptfs_kernel.h +++ b/fs/ecryptfs/ecryptfs_kernel.h @@ -51,7 +51,6 @@ #define ECRYPTFS_VERSIONING_MULTKEY 0x00000020 #define ECRYPTFS_VERSIONING_MASK (ECRYPTFS_VERSIONING_PASSPHRASE \ | ECRYPTFS_VERSIONING_PLAINTEXT_PASSTHROUGH \ - | ECRYPTFS_VERSIONING_PUBKEY \ | ECRYPTFS_VERSIONING_XATTR \ | ECRYPTFS_VERSIONING_MULTKEY) #define ECRYPTFS_MAX_PASSWORD_LENGTH 64 diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c index 682b1b2..8f65054 100644 --- a/fs/ecryptfs/keystore.c +++ b/fs/ecryptfs/keystore.c @@ -273,129 +273,6 @@ out: return rc; } - -static int -write_tag_66_packet(char *signature, u8 cipher_code, - struct ecryptfs_crypt_stat *crypt_stat, char **packet, - size_t *packet_len) -{ - size_t i = 0; - size_t j; - size_t data_len; - size_t checksum = 0; - size_t packet_size_len; - char *message; - int rc; - - /* - * ***** TAG 66 Packet Format ***** - * | C…
creator: Michael Halcrow
date: 2008-04-15T23:30:03-00:00

[PATCH] eCryptfs: Make key module subsystem respect namespaces
type: item
description: On Tue, Apr 15, 2008 at 04:34:02PM -0500, Serge E. Hallyn wrote: > Quoting Andrew Morton (akpm@linux-foundation.org): > > On Tue, 15 Apr 2008 15:23:13 -0500 > > Michael Halcrow <mhalcrow@us.ibm.com> wrote: > > > > > ... > > > + rc = ecryptfs_find_daemon_by_euid(&daemon, current->euid); > > > + if (daemon->pid != current->pid) { > > > + rc = ecryptfs_find_daemon_by_euid(&daemon, current->euid); > > > + BUG_ON(current->euid != daemon->euid); > > > + BUG_ON(current->pid != daemon->pid); > > > > This code uses pids and uids all over the place. Will it operate > > correctly in a containerised environment? > > Thanks Andrew. > > Mike, the pid_t definately needs to be replaced with a struct pid. > > As for the euid, it'd be best if you also compared the user_namespace * > to make sure we support one ecryptfs deamon per user namespace. Make eCryptfs key module subsystem respect namespaces. Since I will be removing the netlink interface in a future patch, I just made changes to the netlink.c code so that it will not break the build. With my recent patches, the kernel module currently defaults to the device handle interface rather than the netlink interface. Signed-off-by: Michael Halcrow <mhalcrow@us.ibm.com> --- fs/ecryptfs/ecryptfs_kernel.h | 25 +++++++++----- fs/ecryptfs/messaging.c | 71 +++++++++++++++++++++++++++++----------- fs/ecryptfs/miscdev.c | 68 +++++++++++++++++++++++++-------------- fs/ecryptfs/netlink.c | 25 +++++++++----- 4 files changed, 126 insertions(+), 63 deletions(-) diff --git a/fs/ecryptfs/ecryptfs_kernel.h b/fs/ecryptfs/ecryptfs_kernel.h index 88b85f7..dc11431 100644 --- a/fs/ecryptfs/ecryptfs_kernel.h +++ b/fs/ecryptfs/ecryptfs_kernel.h @@ -34,6 +34,7 @@ #include <linux/namei.h> #include <linux/scatterlist.h> #include <linux/hash.h> +#include <linux/nsproxy.h> /* Version verification for shared data structures w/ userspace */ #define ECRYPTFS_VERSION_MAJOR 0x00 @@ -410,8 +411,9 @@ struct ecryptfs_daemon { #define ECRYPTFS_DAEMON_MISCDEV_OPEN 0x00000…
creator: Michael Halcrow
date: 2008-04-16T19:24:17-00:00

[PATCH] eCryptfs: Remove obsolete netlink interface to daemon
type: item
description: Remove the obsolete and buggy netlink interface to the userspace daemon. Signed-off-by: Michael Halcrow <mhalcrow@us.ibm.com> --- fs/ecryptfs/Makefile | 2 +- fs/ecryptfs/ecryptfs_kernel.h | 12 -- fs/ecryptfs/main.c | 15 +-- fs/ecryptfs/messaging.c | 31 ++---- fs/ecryptfs/netlink.c | 249 ----------------------------------------- 5 files changed, 17 insertions(+), 292 deletions(-) delete mode 100644 fs/ecryptfs/netlink.c diff --git a/fs/ecryptfs/Makefile b/fs/ecryptfs/Makefile index 1e34a7f..aa22276 100644 --- a/fs/ecryptfs/Makefile +++ b/fs/ecryptfs/Makefile @@ -4,4 +4,4 @@ obj-$(CONFIG_ECRYPT_FS) += ecryptfs.o -ecryptfs-objs := dentry.o file.o inode.o main.o super.o mmap.o read_write.o crypto.o keystore.o messaging.o netlink.o miscdev.o debug.o +ecryptfs-objs := dentry.o file.o inode.o main.o super.o mmap.o read_write.o crypto.o keystore.o messaging.o miscdev.o debug.o diff --git a/fs/ecryptfs/ecryptfs_kernel.h b/fs/ecryptfs/ecryptfs_kernel.h index dc11431..661f202 100644 --- a/fs/ecryptfs/ecryptfs_kernel.h +++ b/fs/ecryptfs/ecryptfs_kernel.h @@ -625,18 +625,6 @@ int ecryptfs_wait_for_response(struct ecryptfs_msg_ctx *msg_ctx, struct ecryptfs_message **emsg); int ecryptfs_init_messaging(unsigned int transport); void ecryptfs_release_messaging(unsigned int transport); - -int ecryptfs_send_netlink(char *data, int data_len, - struct ecryptfs_msg_ctx *msg_ctx, u8 msg_type, - u16 msg_flags, struct pid *daemon_pid); -int ecryptfs_init_netlink(void); -void ecryptfs_release_netlink(void); - -int ecryptfs_send_connector(char *data, int data_len, - struct ecryptfs_msg_ctx *msg_ctx, u8 msg_type, - u16 msg_flags, struct pid *daemon_pid); -int ecryptfs_init_connector(void); -void ecryptfs_release_connector(void); void ecryptfs_write_header_metadata(char *virt, struct ecryptfs_crypt_stat *crypt_stat, diff --git a/fs/ecryptfs/main.c b/fs/ecryptfs/main.c index d25ac95..55fee42 100644 --- a/fs/ecryptfs/main.c +++ b/fs/ecryptfs/main.c @@ -30,7 +30,6 @@ #include <linux/namei.h> #inclu…
creator: Michael Halcrow
date: 2008-04-16T21:10:56-00:00