lkml.org 
[lkml]   [2016]   [Jun]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: [PATCH] keyrings: Allow searching the user session keyring
Date
Gwendal Grignou <gwendal@chromium.org> wrote:

> Currently, if a session keyring exists, we are not searching in the
> user session or user keyrings.

That is correct. New session keyrings are given a link to the user session if
created by pam_keyinit. If you don't want to search the user keyring, you can
just unlink it from your session keyring.

The user-session keyring is a fallback keyring in case there's no session
keyring. It seemed to make things easier at the time, but it shouldn't really
exist and I would deprecate it and remove it if I could - especially now that
persistent keyrings exist. The uid 0 user-session keyring is a potential
security hole because it allows implicit sharing of authentication data
between daemon processes.

David

\
 
 \ /
  Last update: 2016-06-14 12:21    [W:0.067 / U:0.992 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site