Hi David, On Mon, Aug 24, 2020 at 08:00:38 +0200, Antony Antony wrote: > On Thu, Aug 20, 2020 at 15:42:22 -0700, David Miller wrote: > > From: Antony Antony <antony.ant...@secunet.com> > > Date: Thu, 20 Aug 2020 20:35:49 +0200 > > > > > Redacting secret is a FIPS 140-2 requirement. > > > > Why not control this via the kernel lockdown mode rather than making > > an ad-hoc API for this? > > Let me try to use kernel lockdown mode. thanks for the idea. > > From a quick googling I guess it would be part of "lockdown= confidentiality". > I wonder if kernel lockdown would allow disabling just this one feature > independent of other lockdowns.
I looked at kernel lockdown mode code and documentation. I am thinking xfrm_redact is probably not a kernel lockdown mode feature. There is no kernel lockdown setting per net namespace. During an initial discussions of xfrm_redact we thought per namespace would be useful in some use cases. If there is a way to set lockdown per net namespace it would be better than /proc/sys/core/net/xfrm_redact_secret.
