Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.kernel > #59109 > unrolled thread

Bug#877760: linux: KEYS: request_key() does not update/replace expired keys

Back to article view | Back to linux.debian.kernel

Contents

  Bug#877760: linux: KEYS: request_key() does not update/replace expired keys Salvatore Bonaccorso <carnil@debian.org> - 2017-10-05 09:10 +0200
    Bug#877760: linux: KEYS: request_key() does not update/replace expired keys Salvatore Bonaccorso <carnil@debian.org> - 2017-10-05 21:10 +0200
    Processed: Re: Bug#877760: linux: KEYS: request_key() does not  update/replace expired keys owner@bugs.debian.org (Debian Bug Tracking System) - 2017-10-05 21:10 +0200

#59109 — Bug#877760: linux: KEYS: request_key() does not update/replace expired keys

Source: linux
Version: 3.16.7-ckt7-1
Severity: normal

Hi 

In 3.16.7-ckt7-1 we applied a backport of "EYS: request_key() should
reget expired keys rather than give EKEYEXPIRED", adressing #758870,
0b0a84154eff56913e91df29de5c3a03a0029e38.

I noticed that in jessie, with still up to 3.16.43-2+deb8u5 the
following test-rocedure 

,---- [ keytest.sh ]
| #!/bin/sh
| keyctl request2 user debug:dummy a @s
| keyctl timeout %user:debug:dummy 3
| keyctl show  %user:debug:dummy
| sleep 4
| keyctl request2 user debug:dummy a @s
`----

still leads to:

root@jessie-amd64:~# ./keytest 
542551421
Keyring
 542551421 --alswrv      0     0  user: debug:dummy
request_key: Key has expired
root@jessie-amd64:~# ./keytest 
request_key: Key has expired
Can't find 'user:debug:dummy'
Can't find 'user:debug:dummy'
request_key: Key has expired
root@jessie-amd64:~#

In stretch, this does not happen (with 4.9.30-2+deb9u5)

root@stretch-amd64:~# ./keytest 
89439986
Keyring
  89439986 --alswrv      0     0  user: debug:dummy
25490408
root@stretch-amd64:~# ./keytest 
25490408
Keyring
  25490408 --alswrv      0     0  user: debug:dummy
546453714
root@stretch-amd64:~#

or with 4.9.30-2+deb9u5~bpo8+1 from backports:

root@jessie-amd64:~# ./keytest 
142545203
Keyring
 142545203 --alswrv      0     0  user: debug:dummy
86582269
root@jessie-amd64:~# ./keytest 
86582269
Keyring
  86582269 --alswrv      0     0  user: debug:dummy
358240859
root@jessie-amd64:~#

Are we potentially miss any relevant needed commits between v3.16..v3.18?
(054f6180d8b5602b431b5924976c956e760488b1, "KEYS: Simplify
KEYRING_SEARCH_{NO,DO}_STATE_CHECK flags"?).

Regards,
Salvatore

[toc] | [next] | [standalone]

#59121

[Multipart message — attachments visible in raw view] — view raw

Control: tags -1 + patch

Hi

On Thu, Oct 05, 2017 at 09:06:33AM +0200, Salvatore Bonaccorso wrote:
> Source: linux
> Version: 3.16.7-ckt7-1
> Severity: normal
> 
> Hi 
> 
> In 3.16.7-ckt7-1 we applied a backport of "EYS: request_key() should
> reget expired keys rather than give EKEYEXPIRED", adressing #758870,
> 0b0a84154eff56913e91df29de5c3a03a0029e38.
[...]
> Are we potentially miss any relevant needed commits between v3.16..v3.18?
> (054f6180d8b5602b431b5924976c956e760488b1, "KEYS: Simplify
> KEYRING_SEARCH_{NO,DO}_STATE_CHECK flags"?).

I did some bisecting, and indeed it seems we were missing the second
change as mentioned as well in the merge:

https://git.kernel.org/linus/23c836ce5c1e1e0bb942f58a3cbc2f7fc05a08b5

> The second and third fix a bug in NFS idmapper handling whereby a key
> representing a mapping between an id and a name expires and causing
> EKEYEXPIRED to be seen internally in NFS (which prevents the mapping
> from happening) rather than re-looking up the mapping"

With attached patch on top of the (current) jessie branch in git, the
problem is solved.

Regards,
Salvatore

[toc] | [prev] | [next] | [standalone]

#59122 — Processed: Re: Bug#877760: linux: KEYS: request_key() does not update/replace expired keys

Processing control commands:

> tags -1 + patch
Bug #877760 [src:linux] linux: KEYS: request_key() does not update/replace expired keys
Added tag(s) patch.

-- 
877760: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=877760
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.kernel

csiph-web