F45 Change Proposal: Disable in Kernel Crypto Userspace API (Phase 1) (self-contained)

Project Discussion Change Proposals
,
1

:link: Disable in Kernel Crypto Userspace API (Phase 1)

This is a proposed Change for Fedora Linux.
This document represents a proposed Change. As part of the Changes process, proposals are publicly announced in order to receive community feedback. This proposal will only be implemented if approved by the Fedora Engineering Steering Committee.

Wiki
Announced

:link: Summary

The in kernel Crypto Userspace API (CRYPTO_USER_API) is now deprecated upstream, with some parts of it being actively removed early in the 7.2 cycle, because of the security risk it contains. It is due to be disabled and actively removed from upstream in the near future. Restrict it’s use in Fedora to known active users early so we can do a controlled ending of support and can make the community aware of it’s pending disappearance and gracefully deal with unknown users.

:link: Owner

:link: Detailed Description

The in kernel Crypto Userspace API (CRYPTO_USER_API) is now deprecated upstream, with some parts of it being actively removed early in the 7.2 cycle, because of the security risk it contains. It is due to be disabled and actively removed from upstream in the near future. The first phase will restrict it’s use in Fedora early so we can do a controlled ending of support and can make the community aware of it’s pending disappearance and gracefully deal with unknown users.

There’s not a lot of known users of the in kernel Crypto Userspace API so the impact should be minimal and there’s upstream planning for most of those.

The known Fedora users of the Crypto Userspace API are iwd, cryptsetup (just used for TrueCrypt, tcplay, or VeraCrypt and some kernel level benchmarking) and libkcapi (used by dracut, kernel build process). These users are unaffected by this phase of the change. The cryptsetup already has the ability to fall back to other mechanisms. The iwd users will continue to function but users likely should migrate to wpa_supplicant (the iwd package is currently unmaintained upstream).

The first phase uses the upstream patches due to land shortly, likely in 7.3, to limit the use of the API to the known apps and restricts the use. This allows Fedora to identify unknown users and gracefully deal with them before the active demise of the interface upstream providing users a more graceful process rather than universally pulling the rug without any notice.

:link: Benefit to Fedora

The benefit to Fedora is to allow users of the in kernel crypto API to be aware of the impending disappearance of the interface and to give them some time to gracefully migrate to other userspace interfaces before the API is gone for good.

:link: Scope

  • Proposal owners:

    • Ensure all the components that use the crypto userspace APIs have migrated to other userspace crypto APIs.
    • Document the the replacements

  • Other developers:

    • No impact

  • Release engineering: #XXXX

  • Policies and guidelines: N/A (not a System Wide Change)

  • Trademark approval: N/A (not needed for this Change)

:link: Upgrade/compatibility impact

No current known users of the crypto userspace kAPIs are affected and will continue to work. There may be third party users which will be identified as part of this process to allow us to work with them to mitigate/migrate to more suitable interfaces.

:link: How To Test

  • Install a Fedora 7.2 kernel build

:link: User Experience

Generally users should not notice. The kernel Crypto Userspace API was never widely used and the in Fedora packages that make use of it will migrate to other mechanisms without users being aware of the change.

:link: Dependencies

No external dependencies.

:link: Contingency Plan

  • Contingency mechanism: Re-enable
  • Contingency deadline: GA
  • Blocks release? No.
  • Blocks product? No.

:link: Documentation

There’s no specific kernel Crypto Userspace API documentation in Fedora.

:link: Release Notes

Fedora has actively deprecated the in kernel Crypto Userspace API and no longer actively supports it’s use. If you currently use the userspace crypto API please migrate to another suitable userspace crypto API.

Last edited by @amoloney 2026-07-22T14:35:10Z

Last edited by @amoloney 2026-07-22T14:35:10Z

2

How do you feel about the proposal as written?

  • Strongly in favor
  • In favor, with reservations
  • Neutral
  • Opposed, but could be convinced
  • Strongly opposed
0 voters

If you are in favor but have reservations, or are opposed but something could change your mind, please explain in a reply.

We want everyone to be heard, but many posts repeating the same thing actually makes that harder. If you have something new to say, please say it. If, instead, you find someone has already covered what you’d like to express, please simply give that post a :heart: instead of reiterating. You can even do this by email, by replying with the heart emoji or just “+1”. This will make long topics easier to follow.

Please note that this is an advisory “straw poll” meant to gauge sentiment. It isn’t a vote or a scientific survey. See About the Change Proposals category for more about the Change Process and moderation policy.

3

I’m in favor of that change. I think it would be good to also turn those config options into modules as I suggested in Turn CONFIG_CRYPTO_USER_API* into modules (!4498) · Merge requests · cki-project / kernel-ark · GitLab so that users could block those modules from loading entirely until this is removed.

4

CC @pbrobinson @jforbes as they are not mentioned in the change post.

5

It would break a number of current usecases. You can also disable/restrict it in this proposal with the use of a sysctl knob.

1 Like
6

Should the release notes mention it is deprecated in the upstreams kernel too? As it stands it kind of sounds like it is a Fedora specific change.

7

This change proposal has now been submitted to FESCo with ticket [#3667](Making sure you're not a bot!) for voting.

To find out more, please visit our [Changes Policy](Making sure you're not a bot!) documentation.