Re: [PATCH] keyrings: Allow searching the user session keyring

From	David Howells <dhowells@redhat.com>
Newsgroups	linux.kernel
Subject	Re: [PATCH] keyrings: Allow searching the user session keyring
Date	2016-06-14 11:50 +0200
Message-ID	<rJT8S-32Y-13@gated-at.bofh.it> (permalink)
References	<rdJAS-1Mf-3@gated-at.bofh.it> <rdJAS-1Mf-5@gated-at.bofh.it> <rdJAS-1Mf-3@gated-at.bofh.it>
Organization	Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 3798903

Show all headers | View raw

Gwendal Grignou <gwendal@chromium.org> wrote:

> Currently, if a session keyring exists, we are not searching in the
> user session or user keyrings.

That is correct.  New session keyrings are given a link to the user session if
created by pam_keyinit.  If you don't want to search the user keyring, you can
just unlink it from your session keyring.

The user-session keyring is a fallback keyring in case there's no session
keyring.  It seemed to make things easier at the time, but it shouldn't really
exist and I would deprecate it and remove it if I could - especially now that
persistent keyrings exist.  The uid 0 user-session keyring is a potential
security hole because it allows implicit sharing of authentication data
between daemon processes.

David

Back to linux.kernel | Previous | Next | Find similar | Unroll thread

Thread

Re: [PATCH] keyrings: Allow searching the user session keyring David Howells <dhowells@redhat.com> - 2016-06-14 11:50 +0200

csiph-web