On Fri, Jul 24, 2026 at 11:56:22AM +0200, Ondrej Kozina via devel wrote: > On 23/07/2026 20:13, Justin Forbes wrote: > > On Thu, Jul 23, 2026 at 3:59 AM Ondrej Kozina via devel > > > > > > Ok, public awareness aside (which I agree with), are there any Fedora > > > specific steps planned above what the upstream kernel plans to do? > > > > Somewhat. I do plan to disable it completely for F46. If upstream > > doesn't do so first, it can still be enabled in F45, but that will be > > the last release. > > The upstream has a plan for restricted mode with allow list for AF_ALG and > there's a clear justification for it (links below). I currently do not > follow why this is not enough for Fedora going forward, so I'd like to hear > more if we want to go further then that. > > My arguments against turning the AF_ALG _completely_, without replacement > are as follows: > > - there's no xts mode implemented for camellia, serpent and twofish ciphers > in openssl (I mention only the most used AES alternatives). So the > cryptsetup (in Fedora) will loose userspace access to those ciphers without > CAP_SYS_ADMIN. Affects LUKS2. > > - No Adiantum in userspace crypto libraries currently supported by > libcryptsetup. The fallback via dm-crypt will again need CAP_SYS_ADMIN. > Affects LUKS2.
Is there anything blocking addition of these to openssl, or is it merely that no one has requested it historically ? (Perhaps naively) I would think that openssl ought to be supporting all of the cipher/mode. With regards, Daniel -- |: https://berrange.com ~~ https://hachyderm.io/@berrange :| |: https://libvirt.org ~~ https://entangle-photo.org :| |: https://pixelfed.art/berrange ~~ https://fstop138.berrange.com :| -- _______________________________________________ devel mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
