Giters

pmem / ndctl

A "device memory" enabling project encompassing tools and libraries for CXL, NVDIMMs, DAX, memory tiering and other platform memory device topics.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

problem with unconditional "load-keys" in modprobe udev rule

jchu314atgithub opened this issue · comments

commented

With /etc/modprobe.d/nvdimm-security.conf udev rule, "ndctl load-keys" is invoked regardless whether sys-admin has created nvdimm-master key or not. When there is no intention to exercise nvdimm secure lock and the master key isn't created, the udev rule generates failure messages upon reboot/reload libnvdimm.

Although the failure messages are benign and can be safely ignored in this case, but database customers who may not be savvy with kernel features could be alarmed and follow up with customer calls. And we'd like to avoid the unnecessary customer calls.

Is there a way for the udev rule to conditionally run "ndctl load-keys" IFF the master key was ever created? Is it sufficient to make decision based on whether the /etc/ndctl/keys/nvdimm-master.blob file exists? what about the TPM case?

Thanks!

commented

Hmm, any one? Does it make sense to update the udev rule such that "load-keys" is run only if a master exists somewhere?
Thanks!