Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1687064

Re: [PATCH] Crypto_user: Make crypto user API available for all net ns

Show all headers | View raw

On Thu, Jul 13, 2017 at 04:51:10PM +0200, Stephan Müller wrote:
> Am Donnerstag, 13. Juli 2017, 16:22:32 CEST schrieb Christian Langrock:
> 
> Hi Christian,
> 
> > With this patch it's possible to use crypto user API form all
> > network namespaces, not only form the initial net ns.
> 
> Is this wise?
> 
> The crypto_user interface allows root users to change settings in the kernel 
> with a global scope. For example, you can deregister ciphers, change the prio 
> of ciphers and so on. All of that is visible on a global scale and thus should 
> not be possible from namespaces, IMHO.

It is possible to use crypto from all namespaces, so would be nice if
it would be possible to choose which algorithm to use. The problem is that
you can change the global crypto configuration from within a namespace
with this. Maybe crypto_alg_list etc. should be namespace aware first,
then each namespace can have its own configuration.

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

[PATCH] Crypto_user: Make crypto user API available for all net ns Christian Langrock <christian.langrock@secunet.com> - 2017-07-13 16:30 +0200
  Re: [PATCH] Crypto_user: Make crypto user API available for all net ns Stephan Müller <smueller@chronox.de> - 2017-07-13 17:00 +0200
    Re: [PATCH] Crypto_user: Make crypto user API available for all net  ns Steffen Klassert <steffen.klassert@secunet.com> - 2017-07-14 07:00 +0200

csiph-web