• Ondrej Kozina's avatar
    dm crypt: add ability to use keys from the kernel key retention service · c538f6ec
    Ondrej Kozina authored
    The kernel key service is a generic way to store keys for the use of
    other subsystems. Currently there is no way to use kernel keys in dm-crypt.
    This patch aims to fix that. Instead of key userspace may pass a key
    description with preceding ':'. So message that constructs encryption
    mapping now looks like this:
    
      <cipher> [<key>|:<key_string>] <iv_offset> <dev_path> <start> [<#opt_params> <opt_params>]
    
    where <key_string> is in format: <key_size>:<key_type>:<key_description>
    
    Currently we only support two elementary key types: 'user' and 'logon'.
    Keys may be loaded in dm-crypt either via <key_string> or using
    classical method and pass the key in hex representation directly.
    
    dm-crypt device initialised with a key passed in hex representation may be
    replaced with key passed in key_string format and vice versa.
    
    (Based on original work by Andrey Ryabinin)
    Signed-off-by: default avatarOndrej Kozina <okozina@redhat.com>
    Reviewed-by: default avatarDavid Howells <dhowells@redhat.com>
    Signed-off-by: default avatarMike Snitzer <snitzer@redhat.com>
    c538f6ec
dm-crypt.txt 4.2 KB