<div dir="ltr"><div dir="ltr"><div dir="ltr">I wanted to de some kind of tutorial (<a href="https://gitlab.com/BrunoVernay/systemd-playground/tree/master/12-keyring">https://gitlab.com/BrunoVernay/systemd-playground/tree/master/12-keyring</a>) on the subject, but I don't find a lot of resources (apart from "reference documentation")<div><br></div><div>This might be helpful: <a href="https://mjg59.dreamwidth.org/37333.html">https://mjg59.dreamwidth.org/37333.html</a> </div><div><br></div></div></div></div><br><div class="gmail_quote"><div dir="ltr">On Thu, Dec 6, 2018 at 12:57 PM Sietse van Zanen <<a href="mailto:sietse@wizdom.nu">sietse@wizdom.nu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi Dinesh,<br>
<br>
Did you do a 'keyctl link @us @s' after logging in?<br>
<br>
And could you tell me how you aceive 2. Because according to documentation it is not possible to have systemd-ask-password insert a key into a users keylist:<br>
--keyname=<br>
Configure a kernel keyring key name to use as cache for the password. If set, then the tool will try to push any collected passwords into the<br>
kernel keyring of the root user<br>
<br>
-Sietse<br>
________________________________________<br>
From: systemd-devel <<a href="mailto:systemd-devel-bounces@lists.freedesktop.org" target="_blank">systemd-devel-bounces@lists.freedesktop.org</a>> on behalf of Dinesh Prasanth Moluguwan Krishnamoorthy <<a href="mailto:dmoluguw@redhat.com" target="_blank">dmoluguw@redhat.com</a>><br>
Sent: Thursday, December 6, 2018 04:11<br>
To: <a href="mailto:systemd-devel@lists.freedesktop.org" target="_blank">systemd-devel@lists.freedesktop.org</a><br>
Subject: [systemd-devel] Systemd and kernel keyring<br>
<br>
Hi team,<br>
<br>
I'm working on accessing kernel keyring in my application started using<br>
systemd.<br>
<br>
The list of steps I'm doing:<br>
<br>
1. Starting a systemd service with `KeyringMode=shared` as a SPECIFIC<br>
USER<br>
2. In the `ExecStartPre`, I'm launching a subprocess that invokes<br>
`systemd-ask-password` to accept the input and store it in the USER's<br>
kernel keyring<br>
3. In the main program started using `ExecStart`, I'm accessing the<br>
value stored in the keyring<br>
<br>
I'm able to access the values from my main program -- everything works<br>
as expected! When I try to login as that specific user and do a `keyctl<br>
show @u`, I find the entry.<br>
<br>
However, when I try to do `keyctl print <keyID>`, it throws "Permission<br>
Denied" error. IIUC, this protects the keys in the keyring from<br>
accessing outside the systemd service. Is it the desired behaviour?<br>
<br>
I have the sample systemd unit file available in [1].<br>
<br>
[1]<br>
<a href="https://github.com/SilleBille/keyctl-java-test/blob/master/pki-tomcatd-nuxwdog%40pki-tomcat.service" rel="noreferrer" target="_blank">https://github.com/SilleBille/keyctl-java-test/blob/master/pki-tomcatd-nuxwdog%40pki-tomcat.service</a><br>
<br>
Thanks,<br>
Dinesh<br>
<br>
_______________________________________________<br>
systemd-devel mailing list<br>
<a href="mailto:systemd-devel@lists.freedesktop.org" target="_blank">systemd-devel@lists.freedesktop.org</a><br>
<a href="https://lists.freedesktop.org/mailman/listinfo/systemd-devel" rel="noreferrer" target="_blank">https://lists.freedesktop.org/mailman/listinfo/systemd-devel</a><br>
_______________________________________________<br>
systemd-devel mailing list<br>
<a href="mailto:systemd-devel@lists.freedesktop.org" target="_blank">systemd-devel@lists.freedesktop.org</a><br>
<a href="https://lists.freedesktop.org/mailman/listinfo/systemd-devel" rel="noreferrer" target="_blank">https://lists.freedesktop.org/mailman/listinfo/systemd-devel</a><br>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature">Bruno VERNAY<br></div>