On Mon, Oct 19, 2026 at 04:24:29PM -0700, Fan Wu wrote: > > > On 10/19/2026 2:40 PM, Manuel Huber via B4 Relay wrote: > > From: Manuel Huber <[email protected]> > > > > The IPE policy keyring is allocated unlinked, so userspace would > > otherwise have to scrape /proc/keys to name it. > > > > Signed-off-by: Manuel Huber <[email protected]> > > --- > > I'm ok with this id addition, but why can't Kata use keyctl to find the > keyring by name? e.g. keyctl padd asymmetric "" %:.ipe < cert.der. > > If the concern is that /proc/keys can be spoofed, that would mean other > processes are already running while the keyring is still unsealed, which > seems even less appropriate.
Why do you object to a reliable and trivial way for userspace to interact with a security sensitive kernel keyring in a dedicated reserved namespace just for this purpose?
