Introduction to keyutils
Keyutils is a set of utilities for
managing the key retention facility in the kernel, which can be
used by filesystems, block devices and more to gain and retain the
authorization and encryption keys required to perform secure
operations.
![[Note]](../images/note.png)
Note
Development versions of BLFS may not build or run some packages
properly if LFS or dependencies have been updated since the most
recent stable versions of the books.
Package Information
Keyutils Dependencies
Optional
lsb-tools-0.12 (referred by the test suite)
Kernel
Configuration
If running the test suite, some tests needs the following kernel
features enabled:
Security options --->
[*] Enable access key retention support ---> [KEYS]
[*] Large payload keys [BIG_KEYS]
[*] Diffie-Hellman operations on retained keys [KEY_DH_OPERATIONS]
-*- Cryptographic API ---> [CRYPTO]
Public-key cryptography --->
<*/M> RSA (Rivest-Shamir-Adleman) [CRYPTO_RSA]
Hashes, digests, and MACs --->
<*/M> SHA-1 [CRYPTO_SHA1]
[*] Asymmetric (public-key cryptographic) key type ---> [ASYMMETRIC_KEY_TYPE]
<*> Asymmetric public-key crypto algorithm subtype
... [ASYMMETRIC_PUBLIC_KEY_SUBTYPE]
# If not built into the kernel, [SYSTEM_TRUSTED_KEYRING] won't show up;
# building as a module won't work:
<*> X.509 certificate parser [X509_CERTIFICATE_PARSER]
Certificates for signature checking --->
[*] Provide system-wide ring of trusted keys [SYSTEM_TRUSTED_KEYRING]
[*] Provide a keyring to which extra trustable keys may be added
... [SECONDARY_TRUSTED_KEYRING]
[*] Provide system-wide ring of blacklisted keys [SYSTEM_BLACKLIST_KEYRING]
Installation of keyutils
Install keyutils by running the
following commands:
make
Now, as the root user:
make NO_ARLIB=1 LIBDIR=/usr/lib BINDIR=/usr/bin SBINDIR=/usr/sbin install
The test suite can only run after installing this package. A
support file in the test suite needs to be adapted for File 5.48 or newer. To test the results,
issue, as the root user:
sed 's/\$\$/self/' -i tests/toolbox.inc.sh &&
make -k test
If lsb-tools-0.12 is not installed, the test
suite will output some lines complaining the lsb_release command is not
available but it won't affect the test result. The tests do not
work in a chroot environment.
The tests are currently known to fail once it attempts to add
user-generated keys to the keyring if CONFIG_SYSTEM_BLACKLIST_AUTH_UPDATE is enabled in
the configuration of the currently running kernel.