Re: [PATCH RFC 2/4] keys: add KEY_SPEC_IPE_KEYRING

[Fan Wu]

On 10/19/2026 2:40 PM, Manuel Huber via B4 Relay wrote:
> From: Manuel Huber <manuelh@xxxxxxxxxx>
> 
> The IPE policy keyring is allocated unlinked, so userspace would
> otherwise have to scrape /proc/keys to name it.
> 
> Signed-off-by: Manuel Huber <manuelh@xxxxxxxxxx>
> ---

I'm ok with this id addition, but why can't Kata use keyctl to find the keyring by name? e.g. keyctl padd asymmetric "" %:.ipe < cert.der.

If the concern is that /proc/keys can be spoofed, that would mean other processes are already running while the keyring is still unsealed, which seems even less appropriate.

Fan