[PATCH RFC 2/4] keys: add KEY_SPEC_IPE_KEYRING

[Christian Brauner]

On Mon, Oct 19, 2026 at 04:24:29PM -0700, Fan Wu wrote:
> 
> 
> On 10/19/2026 2:40 PM, Manuel Huber via B4 Relay wrote:
> > From: Manuel Huber <manuelh at nvidia.com>
> > 
> > The IPE policy keyring is allocated unlinked, so userspace would
> > otherwise have to scrape /proc/keys to name it.
> > 
> > Signed-off-by: Manuel Huber <manuelh at nvidia.com>
> > ---
> 
> I'm ok with this id addition, but why can't Kata use keyctl to find the keyring by name? e.g. keyctl padd asymmetric "" %:.ipe < cert.der.
> 
> If the concern is that /proc/keys can be spoofed, that would mean other processes are already running while the keyring is still unsealed, which seems even less appropriate.

Why do you object to a reliable and trivial way for userspace to
interact with a security sensitive kernel keyring in a dedicated
reserved namespace just for this purpose?