On 30.11.2016 01:04, Eric Biggers wrote:
> On Tue, Nov 29, 2016 at 10:59:28PM +0100, Richard Weinberger wrote:
>> Do you also plan to address d/page cache related issues?
>> i.e. when two users are logged into the system user rw
>> is able to see decrypted file names and contents in /home/dags/
>> if user dags installs a key and accessed a file.
> As far as I know, there are no plans to make it possible for one user to see
> plaintext while another user sees ciphertext. Fundamentally, the dentry,
> and page caches are shared systemwide. This cannot be changed by using
> namespaces; it can only be changed by doing something like an ecryptfs-style
> stacked mount where the plaintext and ciphertext are actually exposed by
> different filesystems. And it was a fundamental design goal of ext4
> to not do a stacked mount.
Well, we could over-mount /home/rw with an empty directory for every user
> So the expectation is that to restrict access by other users once a key has
> provisioned, file permissions should be used.
>> Or files in /home/dags/ are still readable even after
>> user dags purged the key.
> If you revoke the key (with 'keyctl revoke') rather than unlink the key (with
> 'keyctl unlink') then it actually does appear to work currently. The
> is that revoking the key is a modification of the key, whereas unlinking the
> is only removing a link to the key without affecting any links which the
> may have internally or which userspace may have in other keyrings. Revocation
> (but not unlinking) is detected by fscrypt_get_encryption_info() when someone
> tries to open an encrypted file or directory. There's also a d_revalidate
> dentry operation which cause a dentry to be invalidated if it's a plaintext
> but the directory key is no longer valid, or if it's a ciphertext name but the
> directory key is now valid.
Ahh, in my quick and dirty tests I've always used purge. Let me try revoke. :)
BTW: This limitations needs to be clearly documented somewhere.
Usually an user thinks that only she can access encrypted files...