From: Dave Jiang <dave.jiang@intel.com>
To: vishal.l.verma@intel.com, dan.j.williams@intel.com
Cc: linux-nvdimm@lists.01.org
Subject: [PATCH v10 00/12] ndctl: add security support
Date: Thu, 24 Jan 2019 16:07:04 -0700 [thread overview]
Message-ID: <154837084784.37086.4597479371733088393.stgit@djiang5-desk3.ch.intel.com> (raw)
The following series implements mechanisms that utilize the sysfs knobs
provided by the kernel in order to support the Intel DSM v1.8 spec
that provides security to NVDIMM. The following abilities are added:
1. display security state
2. enable/update passphrase
3. disable passphrase
4. freeze security
5. secure erase
6. overwrite
7. master passphrase enable/update
v10:
- Remove install-encrypt-key support. setup-passphrase will take a master
key handle in order to allow per NVDIMM master key. update-passphrase can
take optional master key handle. (Dan)
- Rebased to latest ndctl. (Vishal)
- Moved the key management calls to ndctl/util and stop exporting. (Dan)
v9:
- Add install-encrypt-key command. (Dan)
- Change enable-passphrase to setup-passphrase. (Dan)
- Change disable-passphrase to remove-passphrase. (Dan)
- Change ndctl_dimm_get_security() to return state directly and remove
ndctl_dimm_security_supported(). (Dan)
- Remove ND_SECURITY_UNSUPPORTED state
- change ND_SECURITY_* to NDCTL_SECURITY_*
- Fix man page issues (Dan, Jane)
- Define NDCTL_KEYSDIR in config.h (Dan)
- Break check_key_run_and_discard() to 3 helper functions. (Dan)
- Remove key path input parameter. (Dan)
- Remove master key input parameter. (Dan)
- Fixup various issues in security unit test script. (Vishal)
v8:
- Additional cleanup on test script. (Vishal)
- Change load-keys script into internal command for ndctl. (Dan)
v7:
- Added option to provide path to key directory. (Vishal)
- Cleaned up shell scripts. (Vishal)
- Cleaned up documentation. (Vishal)
- Addressed various comments from Vishal.
v6:
- Fix spelling and grammar errors for documentation. (Jing)
- Change bool for indicate master passphrase and old passphrase to enum.
- Fix key load script master key name.
- Update to match v15 of kernel patch series.
v5:
- Updated to match latest kernel interface (encrypted keys)
- Added overwrite support
- Added support for DSM v1.8 master passphrase operations
- Removed upcall related code
- Moved security state to enum (Dan)
- Change security output "security_state" to just "security". (Dan)
- Break out enable and update passphrase operation. (Dan)
- Security build can be compiled out when keyutils does not exist. (Dan)
- Move all keyutils related operations to libndctl. (Dan)
v4:
- Updated to match latest kernel interface.
- Added unit test for all security calls
v3:
- Added support to inject keys in order to update nvdimm security.
v2:
- Fixup the upcall util to match recent kernel updates for nvdimm security.
---
Dave Jiang (12):
ndctl: add support for display security state
ndctl: add passphrase update to ndctl
ndctl: add disable security support
ndctl: add support for freeze security
ndctl: add support for sanitize dimm
ndctl: add unit test for security ops (minus overwrite)
ndctl: add modprobe conf file and load-keys ndctl command
ndctl: add overwrite operation support
ndctl: add wait-overwrite support
ndctl: master phassphrase management support
ndctl: add master secure erase support
ndctl: documentation for security and key management
Documentation/ndctl/Makefile.am | 10
Documentation/ndctl/intel-nvdimm-security.txt | 141 +++++
Documentation/ndctl/ndctl-freeze-security.txt | 60 ++
Documentation/ndctl/ndctl-list.txt | 8
Documentation/ndctl/ndctl-load-keys.txt | 45 ++
Documentation/ndctl/ndctl-remove-passphrase.txt | 28 +
Documentation/ndctl/ndctl-sanitize-dimm.txt | 52 ++
Documentation/ndctl/ndctl-setup-passphrase.txt | 54 ++
Documentation/ndctl/ndctl-update-passphrase.txt | 58 ++
Documentation/ndctl/ndctl-wait-overwrite.txt | 31 +
Makefile.am | 4
configure.ac | 17 +
contrib/nvdimm-security.conf | 1
ndctl.spec.in | 3
ndctl/Makefile.am | 6
ndctl/builtin.h | 7
ndctl/dimm.c | 242 ++++++++-
ndctl/lib/Makefile.am | 4
ndctl/lib/dimm.c | 183 ++++++
ndctl/lib/libndctl.sym | 9
ndctl/libndctl.h | 28 +
ndctl/load-keys.c | 256 +++++++++
ndctl/ndctl.c | 7
ndctl/util/keys.c | 650 +++++++++++++++++++++++
ndctl/util/keys.h | 60 ++
test/Makefile.am | 4
test/security.sh | 220 ++++++++
util/json.c | 17 +
28 files changed, 2193 insertions(+), 12 deletions(-)
create mode 100644 Documentation/ndctl/intel-nvdimm-security.txt
create mode 100644 Documentation/ndctl/ndctl-freeze-security.txt
create mode 100644 Documentation/ndctl/ndctl-load-keys.txt
create mode 100644 Documentation/ndctl/ndctl-remove-passphrase.txt
create mode 100644 Documentation/ndctl/ndctl-sanitize-dimm.txt
create mode 100644 Documentation/ndctl/ndctl-setup-passphrase.txt
create mode 100644 Documentation/ndctl/ndctl-update-passphrase.txt
create mode 100644 Documentation/ndctl/ndctl-wait-overwrite.txt
create mode 100644 contrib/nvdimm-security.conf
create mode 100644 ndctl/load-keys.c
create mode 100644 ndctl/util/keys.c
create mode 100644 ndctl/util/keys.h
create mode 100755 test/security.sh
--
_______________________________________________
Linux-nvdimm mailing list
Linux-nvdimm@lists.01.org
https://lists.01.org/mailman/listinfo/linux-nvdimm
next reply other threads:[~2019-01-24 23:07 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-01-24 23:07 Dave Jiang [this message]
2019-01-24 23:07 ` [PATCH v10 01/12] ndctl: add support for display security state Dave Jiang
2019-01-24 23:07 ` [PATCH v10 02/12] ndctl: add passphrase update to ndctl Dave Jiang
2019-01-30 2:35 ` Verma, Vishal L
2019-01-30 2:59 ` Dan Williams
2019-01-30 18:56 ` Verma, Vishal L
2019-01-24 23:07 ` [PATCH v10 03/12] ndctl: add disable security support Dave Jiang
2019-01-31 0:52 ` Verma, Vishal L
2019-01-24 23:07 ` [PATCH v10 04/12] ndctl: add support for freeze security Dave Jiang
2019-01-24 23:07 ` [PATCH v10 05/12] ndctl: add support for sanitize dimm Dave Jiang
2019-01-24 23:07 ` [PATCH v10 06/12] ndctl: add unit test for security ops (minus overwrite) Dave Jiang
2019-01-24 23:07 ` [PATCH v10 07/12] ndctl: add modprobe conf file and load-keys ndctl command Dave Jiang
2019-01-24 23:07 ` [PATCH v10 08/12] ndctl: add overwrite operation support Dave Jiang
2019-01-24 23:07 ` [PATCH v10 09/12] ndctl: add wait-overwrite support Dave Jiang
2019-01-24 23:08 ` [PATCH v10 10/12] ndctl: master phassphrase management support Dave Jiang
2019-01-24 23:08 ` [PATCH v10 11/12] ndctl: add master secure erase support Dave Jiang
2019-01-24 23:08 ` [PATCH v10 12/12] ndctl: documentation for security and key management Dave Jiang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=154837084784.37086.4597479371733088393.stgit@djiang5-desk3.ch.intel.com \
--to=dave.jiang@intel.com \
--cc=dan.j.williams@intel.com \
--cc=linux-nvdimm@lists.01.org \
--cc=vishal.l.verma@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.