docker 中无法使用命令 sha512hmac（4.19 内核）

针对 openEuler 版本 openEuler 20.03 LTS、openEuler 20.09

现象： docker 容器中执行命令 sha512hmac 报错：

bash-5.0# sha512hmac
libkcapi - Error: Netlink error: sendmsg failed
libkcapi - Error: Netlink error: sendmsg failed
libkcapi - Error: NETLINK_CRYPTO: cannot obtain cipher information for hmac(sha512) (is required crypto_user.c patch missing? see documentation)
Allocation of hmac(sha512) cipher failed (ret=-111)

上游补丁： https://lore.kernel.org/linux-crypto/CAFqZXNs2XysEWVzmfXSczH-+oX5iwwRC3+9fL3tWYEfDRbqLig@mail.gmail.com/T/

该补丁在 Linux Kernel 5.4 中。Linux kernel 4.19 stable 分支认为这个补丁属于 new feature，所以不会合并在 4.19 stable 分支上。另外该补丁需要针对 Linux kernel 4.19 做修改，修改后适用于 4.19 的补丁见附件。

参考：

Hey woqidaideshi, Welcome to openEuler Community.
All of the projects in openEuler Community are maintained by @openeuler-ci-bot.
That means the developers can comment below every pull request or issue to trigger Bot Commands.
Please follow instructions at https://gitee.com/openeuler/community/blob/master/en/sig-infrastructure/command.md to find the details.

此commit最终没有被upstream接受，关闭此issue。
commit 91b05a7e7d8033a90a64f5fc0e3808db423e420a
Author: Ondrej Mosnacek omosnace@redhat.com
Date: Tue, 9 Jul 2019 13:11:24 +0200

Currently, NETLINK_CRYPTO works only in the init network namespace. It
doesn't make much sense to cut it out of the other network namespaces,
so do the minor plumbing work necessary to make it work in any network
namespace. Code inspired by net/core/sock_diag.c.

GVP openEuler / kernel

内容风险标识

评论 (2)

GVPopenEuler / kernel

内容风险标识