PKCS#11 Access

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/

ecryptfs & 2.6.24

Will ecryptfs be made to work with 2.6.24.x series kernels? At one time I know 
there were problems of segfaults with 2.6.24 and the user-space daemon. 
Indeed, attempting to access the files while running 2.6.24.1 results in a 
segfault. I just tried ecryptfs-utils-38, and this time just starting 
ecryptfsd resulted in a series of 3 kernel oops as soon as it ran. The machine 
required a reboot and fsck'ing fsck each time.

This wouldn't be so bad to use an older kernel, but as of right now, it seems 
all modern kernels less than or equal to 2.6.24.1 (without the extra patch) 
are vulnerable to a local root exploit ( http://www.milw0rm.com/exploits/5092 
) via vmsplice.

--

-- 
Sadly, I've found that when people speak of free
speech and freedom, what they really want is for
their moral ideals and definitions of what is
objectable or not to be applied to everyone else.

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/

Re: ecryptfs & 2.6.24

On Sun, Feb 10, 2008 at 10:39:02PM -0500, jayjwa wrote:
> Will ecryptfs be made to work with 2.6.24.x series kernels? At one
> time I know there were problems of segfaults with 2.6.24 and the
> user-space daemon.  Indeed, attempting to access the files while
> running 2.6.24.1 results in a segfault.

Something recently went askew with netlink. I'll take a look at it to
see if I can figure out what it is.

Or maybe I will just do away with netlink altogether and just use a
boring old device.

In the meantime, you can apply the vmsplice fix patch to your older
kernel. There's even a hack to close the vulnerability on a live
system.

Mike

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/

Re: ecryptfs & 2.6.24

On Sun, 10 Feb 2008, Michael Halcrow wrote:

-> Something recently went askew with netlink. I'll take a look at it to
-> see if I can figure out what it is.

Lots of changes in this kernel series. It broke my modem driver, 
svgalib_helper, iptable's iprange match, and of course ecryptfsd. :(

-> Or maybe I will just do away with netlink altogether and just use a
-> boring old device.

It seems like it would be more resistant to kernel changes in the future, but 
wouldn't it be more work to program?

-> In the meantime, you can apply the vmsplice fix patch to your older
-> kernel. There's even a hack to close the vulnerability on a live
-> system.

I saw the live system one, and put 2.6.24.1 + the small Feb. 10 patch from 
Bastian Blank on system #2. Now I don't know what to do, as 2.6.24.1 I've 
fixed the problems with several other modules I had and all that remains now 
is ecryptfs, while for the old 2.6.23.x series I'd have to find the pieces of 
the needed patches and apply them. All the patches I've seen so far have been 
by discussions on mailing lists, with no easy-to-download, one-file, 
patch-and-build solutions yet. I don't run a distribution, so there won't be 
any updated old 2.6.23.x series kernels; my versions are in fact the vanilla 
kernel.org versions (with local modifications). Of those, 2.6.24.1 was the 
easiest to turn into a full-fixed kernel (with a few files of code changes). 
Besides, at some point I must move to the 2.6.24 series anyway.

If I do try to use one of the various distro's patch sets, I'll have to hope 
they didn't do anything else to their kernel to change it from a vanilla one 
else it likely won't apply clean. I guess I'll have to consider my options  
carefully here. Also, it is possible to have two kernels, for the most part, 
and boot either one as needed.

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/

真诚合作

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/

_______________________________________________
eCryptfs-devel mailing list
eCryptfs-devel <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/ecryptfs-devel

agenda de cursos atualizada: mar�o/abril 2008.

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/

A Very Basic Issue?

I seem to have a very basic issue.

I am running OpenSuse 10.2 and am using the OpenSSL key module.
I can mount an ecryptfs in overlay mode, create a new file and read it  
back.
However, if I umount the file and remount it, using exactly the same  
options, the new file is not properly decrypted.
I would expect that I can read the file again. Am I missing something?

eng-1:~ # mount -t ecryptfs -o key=openssl:keyfile=/root/.ecryptfs/pki/ 
openssl/key.pem /secret /secret
Passphrase:
Cipher
1) Blowfish
2) CAST5
3) CAST6
4) Triple-DES
Selection [Blowfish]: 4
Enable plaintext passthrough (y/n): y
Attempting to mount with the following options:
   ecryptfs_passthrough
   ecryptfs_cipher=des3_ede
   ecryptfs_key_bytes=24
   ecryptfs_sig=2cd3f104ecab25e4
Mounted eCryptfs
eng-1:~ #
eng-1:~ #
eng-1:~ #
eng-1:~ # date > /secret/date
eng-1:~ # cat /secret/date
Fri Feb 29 14:49:22 PST 2008
eng-1:~ #
eng-1:~ #
eng-1:~ # umount /secret
eng-1:~ #
eng-1:~ # mount -t ecryptfs -o key=openssl:keyfile=/root/.ecryptfs/pki/ 
openssl/key.pem /secret /secret
Passphrase:
Cipher
1) Blowfish
2) CAST5
3) CAST6
4) Triple-DES
Selection [Blowfish]: 4
Enable plaintext passthrough (y/n): y
Attempting to mount with the following options:
   ecryptfs_passthrough
   ecryptfs_cipher=des3_ede
   ecryptfs_key_bytes=24
   ecryptfs_sig=2cd3f104ecab25e4
Mounted eCryptfs
eng-1:~ # cat /secret/date
???
k???r??|9q?r??|9q?r??|9eng-1:~ #
eng-1:~ #

Thanks in advance.
Mike Davis

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/

Re: A Very Basic Issue?

On Fri, Feb 29, 2008 at 03:10:56PM -0800, Mike Davis wrote:
> I seem to have a very basic issue.
> 
> I am running OpenSuse 10.2 and am using the OpenSSL key module.

What is your kernel version (uname -r)?

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/