Fedora Prepares to Drop AF_ALG in the Linux Kernel

The Linux kernel's userspace interface to the Crypto API, known as AF_ALG, has turned out to be tied to a string of high-profile security problems of late — among them the Copy Fail vulnerability and its “descendants.” This mechanism lets userspace programs call on the kernel's cryptographic functions, but in practice it has increasingly drawn attention not as a handy tool but as a source of bugs.

Earlier this year AF_ALG was marked as obsolete. Eric Biggers and other kernel developers are working toward eventually removing the interface from the codebase altogether.

In line with these plans, the Fedora project intends to restrict the use of AF_ALG as soon as the distribution's next release. The goal of the restriction is not so much to shut the interface down right away as to nudge those who still rely on it to prepare in advance for its final removal. This approach gives the remaining users time to switch to alternative ways of doing cryptography and to avoid nasty surprises when AF_ALG disappears from the kernel for good.

Source: LWN.net