Linux – Does the linux kernel keyring store keys on disk

ecryptfskernellinux-kernel

I'm trying to learn a bit about the linux kernel keyring (as background for using ecryptfs). Does the kernel keyring store keys somewhere on disk, or does it get reinitiailized programmatically everytime the sytem is booted?

I've looked at the man pages and archlinux documentation on encryption but haven't found the answer. If there's other documentation on the kernel keyring, I'd like to know.

If the kernel keyring does store keys on the disk, where does it put the files?

Best Answer

The Linux kernel never stores anything on a disk of its own behalf. It stores the files that applications tell it to store through the filesystem interface, or data on block devices accessed directly, or metadata of mounted filesystems and disk volumes.

Besides it wouldn't make any sense to store the encryption key on the same media.

The encryption key is only stored in RAM. It is entered before mounting the encrypted filesystem. The key is typically derived from a passphrase typed by the user, but it can also be loaded from e.g. a smartcard. The kernel documentation has the details.

It is possible to store the encryption key for a volume in a file outside that volume, and load that. It can make sense to have a key on a removable drive that's inserted physically at boot time, for example. But the kernel won't do this on its own, it's up to the system's startup scripts to do that.

Related Question