Skip to content

shared: fix keyring handling in ask-password-api#6145

Closed
eworm-de wants to merge 1 commit intosystemd:masterfrom
eworm-de:keyring
Closed

shared: fix keyring handling in ask-password-api#6145
eworm-de wants to merge 1 commit intosystemd:masterfrom
eworm-de:keyring

Conversation

@eworm-de
Copy link
Copy Markdown
Contributor

Commit 74dd6b5 (core: run each system
service with a fresh session keyring) broke keyring handling in ask-password.
The key was added to user keyring, but permissions denied to access it. So
instead add the key to session keyring, set permission, link to user keyring
and unlink from session keyring.

For whatever reason requesting a key does not longer work. Search instead.

@eworm-de
Copy link
Copy Markdown
Contributor Author

This deals with #5522 , at least parts of it.

@eworm-de eworm-de force-pushed the keyring branch 4 times, most recently from 0d84cb7 to 7890fcc Compare June 24, 2017 20:52
@eworm-de
Copy link
Copy Markdown
Contributor Author

Any news or comments on this one?

@eworm-de eworm-de force-pushed the keyring branch 2 times, most recently from 88a08c1 to 065ceaa Compare June 27, 2017 21:58
@eworm-de
Copy link
Copy Markdown
Contributor Author

Oh, a simple rebase makes the CI tests fail? What's wrong here?

Commit 74dd6b5 (core: run each system
service with a fresh session keyring) broke keyring handling in ask-password.
The key was added to user keyring, but permissions denied to access it. So
instead add the key to session keyring, set permission, link to user keyring
and unlink from session keyring.

For whatever reason requesting a key does not longer work. Search instead.
@eworm-de
Copy link
Copy Markdown
Contributor Author

Rebased again, CI tests pass again.

@keszybz keszybz added this to the v234 milestone Jun 28, 2017
Copy link
Copy Markdown
Member

@poettering poettering left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am tempted to say that we should instead change the keyring code in the service activation logic after all, so that the user keyring of system users is linked into the session keyring we create...

serial = keyctl(KEYCTL_SEARCH,
KEY_SPEC_USER_KEYRING,
(unsigned long) "user",
(unsigned long) keyname, 0);
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

KEYCTL_SEARCH and request_key() are substantially different, as the latter might result in a userspace callout from the kernel, and the fomer won't. I don't think it's OK to just replace one by the other...

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we want the kernel to do a user callback? IMHO using KEYCTL_SEARCH would be the correct thing to do, no?

Anyway... request_key() does not work with current code. Let's see how things go if we link the keyrings.

return r;

serial = add_key("user", keyname, p, n, KEY_SPEC_USER_KEYRING);
serial = add_key("user", keyname, p, n, KEY_SPEC_SESSION_KEYRING);
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am not sure I follow on this one? why not place this in the user keyring directly?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's the whole point about this commit (and issue #5522): Adding a key to user keyring results in a key that can not be access any more.

@eworm-de
Copy link
Copy Markdown
Contributor Author

eworm-de commented Jul 3, 2017

Ok, will have a look at the code about service activation logic then.

@poettering
Copy link
Copy Markdown
Member

OK, let's close this one in favour of #6275

@poettering poettering closed this Jul 3, 2017
@eworm-de eworm-de deleted the keyring branch July 4, 2017 10:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

3 participants