On Tue, Jan 20, 2026 at 11:39:46PM +0000, David Howells wrote: > Eric Biggers <[email protected]> wrote: > > > As I'm sure you're aware, C has native support for function parameters. > > And we have a syscall interface to honour that takes a parameter string *for > this very purpose*. It just wasn't threaded into the akcipher API.
This seems to be more of a bug than a feature, though. It seems the actual goals of this patchset are to add ML-DSA and RSASSA-PSS support to kernel module signing. But because of how the code is organized, as a side effect it ended up extending the KEYCTL_PKEY_* UAPIs as well. Linux's UAPI stability guarantee holds for these UAPIs; anything that we add to them, including these ad-hoc and undocumented parameter strings, will likely have to be supported forever. Unless these keyctl UAPI extensions are well-justified and come with documentation and tests, we should just hold off on them for now. What's the hurry? BTW, we got hit by this when there was an attempt to remove SHA-1 support from module signing. Due to the design defect where the signing is also exposed through KEYCTL_PKEY_*, it caused a UAPI regression as well and had to be reverted. - Eric
