[systemd-devel] Sharing kernel keyring between systemd services

[Nikita Krasnov]

Well, both actually. If that's possible, I would prefer to keep my
service files intact (some of them are inside
"/usr/lib/systemd/system" and some are inside "/usr/lib/systemd/user")
and only alter the one that creates the key inside the keyring. The
directory is decrypted transparently if the key is present inside the
keyring. I would like to keep this behavior.

Offtopic. Should I use "Reply All" or "Reply" to answer to messages on
this list? Sorry if I accidentally pinged a lot of people right now or
created a new thread, I'm new on this mailing list.


пн, 22 июл. 2024 г. в 13:42, Andrei Borzenkov <arvidjaar at gmail.com>:

>
> On Mon, Jul 22, 2024 at 12:18 PM Nikita Krasnov
> <nikita.nikita.krasnov at gmail.com> wrote:
> >
> > I am working with kernel keyring (`e4crypt` tool stores its keys there). The end goal, basically, is there is one service that decrypts a folder (creates a key in the kernel keyring) and then every service has access to that key, thus having access to the encrypted folder.
> >
>
> Are you talking about system or user services?
>
> > For some reason systemd doesn't share kernel keyrings between services. Service A launches a script that creates a key and then it's nowhere to be found inside service B (running `keyctl show` there doesn't show the key).
> >
> > I've tried running `keyctl setperm $KEY_ID 0x3f3f3f3f` (giving everyone all writes to the key) but to no avail.
> >
> > I've found systemd has a `KeyringMode=shared` option, so I've added `User=root` and `KeyringMode=shared` to both A and B service files. Unfortunately, this had no effect. The keyring of service B is still empty when it launches.
> >
> > Running `keyctl show` inside A and B gives this. Service A output:
> > ```
> > Session Keyring
> >  275477083 --alswrv 0 0 keyring: _ses
> >  511348864 ----s-rv 0 0 \_ user: invocation_id
> >  916643668 --alswrv 0 0 \_ logon: ext4:018b44e44e88466a
> > ```
> >
> > Service B output:
> > ```
> > Session Keyring
> >  922937713 --alswrv 100000 100000 keyring: _ses
> >  91724620 --alswrv 100000 65534 \_ keyring: _uid.100000
> > ```
> >
> > This output is when not using `User=root` and `KeyringMode=shared` since adding this to every service file isn't feasible (and I also can't have everything running as root).
> >
> > --
> > Sincerely, Nikita Krasnov