Fedora 45 Looks To Begin Phasing Out In-Kernel Crypto Userspace API
([Fedora] 2 Hours Ago
Crypto Userspace API)
- Reference: 0001648053
- News link: https://www.phoronix.com/news/Fedora-45-Disable-Kernel-Crypt
- Source link:
Going along with the upstream [1]Linux 7.2 kernel deprecation of AF_ALG and [2]Linux 7.3 to further restrict this interface for letting user-space programs interact directly with the Linux kernel crypto API, Fedora 45 is looking to follow and help support this transition.
A change proposal was filed as the first phase of disabling the in-kernel crypto user-space API for Fedora Linux. With the upstream Linux kernel moving toward the elimination of AF_ALG / CRYPTO_USER_API, Fedora 45 is looking to honor it too but at the same time ensuring existing user-space software will not suddenly break.
As for Fedora's known users of the in-kernel crypto user-space API and for the plans with Fedora 45:
"The known Fedora users of the Crypto Userspace API are iwd, cryptsetup (just used for TrueCrypt, tcplay, or VeraCrypt and some kernel level benchmarking) and libkcapi (used by dracut, kernel build process). These users are unaffected by this phase of the change. The cryptsetup already has the ability to fall back to other mechanisms. The iwd users will continue to function but users likely should migrate to wpa_supplicant (the iwd package is currently unmaintained upstream).
The first phase uses the upstream patches due to land shortly, likely in 7.3, to limit the use of the API to the known apps and restricts the use. This allows Fedora to identify unknown users and gracefully deal with them before the active demise of the interface upstream providing users a more graceful process rather than universally pulling the rug without any notice."
More details for those interested can be found via the [3]change proposal . It still needs to be voted on by the Fedora Engineering and Steering Committee (FESCo) but given the upstream kernel deprecation, it's a pretty safe bet the change proposal will proceed for Fedora 45.
Separately, sad that [4]IWD development is on hiatus and the Fedora change proposal being another indicator of IWD being " currently unmaintained upstream. "
[1] https://www.phoronix.com/news/Linux-AF-ALG-Deprecation
[2] https://www.phoronix.com/news/AF-ALG-Restrict-Sysctl-Linux
[3] https://fedoraproject.org/wiki/Changes/Disable_CRYPTO_USER_API
[4] https://www.phoronix.com/news/Intel-IWD-Development-Halts
A change proposal was filed as the first phase of disabling the in-kernel crypto user-space API for Fedora Linux. With the upstream Linux kernel moving toward the elimination of AF_ALG / CRYPTO_USER_API, Fedora 45 is looking to honor it too but at the same time ensuring existing user-space software will not suddenly break.
As for Fedora's known users of the in-kernel crypto user-space API and for the plans with Fedora 45:
"The known Fedora users of the Crypto Userspace API are iwd, cryptsetup (just used for TrueCrypt, tcplay, or VeraCrypt and some kernel level benchmarking) and libkcapi (used by dracut, kernel build process). These users are unaffected by this phase of the change. The cryptsetup already has the ability to fall back to other mechanisms. The iwd users will continue to function but users likely should migrate to wpa_supplicant (the iwd package is currently unmaintained upstream).
The first phase uses the upstream patches due to land shortly, likely in 7.3, to limit the use of the API to the known apps and restricts the use. This allows Fedora to identify unknown users and gracefully deal with them before the active demise of the interface upstream providing users a more graceful process rather than universally pulling the rug without any notice."
More details for those interested can be found via the [3]change proposal . It still needs to be voted on by the Fedora Engineering and Steering Committee (FESCo) but given the upstream kernel deprecation, it's a pretty safe bet the change proposal will proceed for Fedora 45.
Separately, sad that [4]IWD development is on hiatus and the Fedora change proposal being another indicator of IWD being " currently unmaintained upstream. "
[1] https://www.phoronix.com/news/Linux-AF-ALG-Deprecation
[2] https://www.phoronix.com/news/AF-ALG-Restrict-Sysctl-Linux
[3] https://fedoraproject.org/wiki/Changes/Disable_CRYPTO_USER_API
[4] https://www.phoronix.com/news/Intel-IWD-Development-Halts