Overview and Recent Developments of Keyrings Subsystem
summary
Kernel keyrings provide per-thread, per-process, session, user and persistent stores for tokens and keys, with add_key, request_key, keyctl and /proc/keys as the user API and a request-key helper and PAM module in userspace. Uses include filesystem tokens, NFS UID mapping, DNS resolver results, Kerberos credential caching and module-signing keys; TPM-backed and trusted keys keep secret material inside kernel memory and are nonextractable. Recent work adds public-key operations via keyctl, TPM-wrapped symmetric keys and watch/notification, finer ACLs and container/namespace fixes.
AI-written summary · about
chapters (10)
- 0:00Start
- 0:05Kernel Keyrings
- 0:54Purpose
- 3:22Types of payload
- 14:01Utilities
- 16:16Current usage
- 21:21Upcoming Changes
- 22:47Future: Access controls
- 25:05Future: Notifications
- 27:38Future: Containers
related talks
55mWhat is Linux kernel keystore and why you should use it in your next application
43mWhat is Linux kernel keystore and why you should use it in your next app
28mUsing and Implementing Keyring Restrictions for Userspace
41mWhat Is Linux Kernel Keystore and Why You Should Use It in Your Next...
58mWhat is Linux kernel keystore and why you should use it in your next application
45mTPMs & The Linux Kernel: Unlocking A Better Path To Hardware Security
47mTPMs and the Linux Kernel: unlocking a better path to hardware security
42mTPMs and the Linux Kernel: unlocking a better path to hardware security