1. Kernel Key Management

2. Red Hat: Kernel Key Management Kernel Key Management Overview Designed to hold keys ready for fast use by kernel services ● Mainly filesystems Keys can hold authentication, authorisation or other security data Permits keys to be grouped together using keyrings Provides access controls on keys Provides standard upcall method to get keys that aren't yet available

3. Red Hat: Kernel Key Management Keys Keys have a number of attributes: ● Type ● Description ● Owner UID/GID ● Permissions (DAC) ● Security (MAC) ● Expiry ● State (revocation, instantiation) Keys also have a payload that is the actual security data

4. Red Hat: Kernel Key Management Keyrings Keyrings are keys that contain a set of links to other keys Each thread subscribes to five standard keyrings: ● Per-thread ● Per-process ● Session ● User default session ● User Only the first three are automatically searched The fourth is searched if the third doesn't exist The fifth is normally searched through a link from the session keyring The session keyring will be created by PAM on login in FC6/RHEL5

5. Red Hat: Kernel Key Management Keyutils Userspace utilities, libraries RPMs found in RHEL4, FE5, FE6, RHEL5 RPMs, tarball found on: ● http://people.redhat.com/~dhowells/keys/ http://people.redhat.com/~dhowells/keys/

6. Red Hat: Kernel Key Management What is it being used or considered for? eCryptFS NFSv4 AFS/OpenAFS CIFS Kerberos TGT and Tickets SSH agent-type stuff

7. Red Hat: Kernel Key Management Example: CIFS Keys could be used to store: ● Local UID Windows user UUID mapping ● Login credentials ● Username ● Domain ● Password ● SMB session ID

8. Red Hat: Kernel Key Management So... What else are people using it for? What can be done to improve it? What extra facilities could be added?