* Revised request_key(2) man page for review
@ 2016-11-04 15:45 Michael Kerrisk (man-pages)
[not found] ` <528b203d-ac72-e4a6-8517-e8c5c11055a4-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
` (2 more replies)
0 siblings, 3 replies; 29+ messages in thread
From: Michael Kerrisk (man-pages) @ 2016-11-04 15:45 UTC (permalink / raw)
To: David Howells
Cc: mtk.manpages, keyrings, linux-man, Eugene Syromyatnikov, lkml
[-- Attachment #1: Type: text/plain, Size: 14431 bytes --]
Hi David (and anyone else with an interest to review)
Triggered by Eugene Syromyatnikov's recent input for the keyctl(2)
man page, I've been doing a fair bit of work on improving the key
management syscall man pages, and wonder if I could ask you for
some review assistance?
First off, below, I've pasted the current draft of the request_key(2)
page, which has seen quite a a lot of changes (increasing from around
100 rendered lines to nearly 300). Could you take a look (and also take
a look at the outstanding FIXME)? (The page source file is attached,
in case you want to see all the formatting.)
Thanks,
Michael
====
NAME
request_key - request a key from the kernel's key management
facility
SYNOPSIS
#include <sys/types.h>
#include <keyutils.h>
key_serial_t request_key(const char *type, const char *description,
const char *callout_info,
key_serial_t dest_keyring);
No glibc wrapper is provided for this system call; see NOTES.
DESCRIPTION
request_key() attempts to find a key of the given type with a
description (name) that matches the specified description. If
such a key could not be found, then the key is optionally cre‐
ated. If the key is found or created, request_key() attaches
it to the keyring whose ID is specified in dest_keyring and
returns the key's serial number.
┌─────────────────────────────────────────────────────┐
│FIXME │
├─────────────────────────────────────────────────────┤
│Is 'keyring' allowed to be 0? Reading the source, it │
│appears so. In this case, by default, the key is │
│assigned to the session keyring. But, the │
│KEYCTL_SET_REQKEY_KEYRING also seems to have an │
│influence here. What are the details here? │
│ │
└─────────────────────────────────────────────────────┘
request_key() first recursively searches for a matching key in
all of the keyrings attached to the calling process. The
keyrings are searched in the order: thread-specific keyring,
process-specific keyring, and then session keyring.
If request_key() is called from a program invoked by
request_key() on behalf of some other process to generate a
key, then the keyrings of that other process will be searched
next, using that other process's user ID, group ID, supplemen‐
tary group IDs, and security context to determine access.
The search of the keyring tree is breadth-first: the keys in
each keyring searched are checked for a match before any child
keyrings are recursed into. Only keys for which the caller has
search permission be found, and only keyrings for which the
caller has search permission may be searched.
If the key is not found and callout is NULL, then the call
fails with the error ENOKEY.
If the key is not found and callout is not NULL, then the ker‐
nel attempts to invoke a user-space program to instantiate the
key. The details are given below.
The dest_keyring serial number may be that of a valid keyring
for which the caller has write permission, or it may be one of
the following special keyring IDs:
KEY_SPEC_THREAD_KEYRING
This specifies the caller's thread-specific keyring
(thread-keyring(7)).
KEY_SPEC_PROCESS_KEYRING
This specifies the caller's process-specific keyring
(process-keyring(7)).
KEY_SPEC_SESSION_KEYRING
This specifies the caller's session-specific keyring
(session-keyring(7)).
KEY_SPEC_USER_KEYRING
This specifies the caller's UID-specific keyring (user-
keyring(7)).
KEY_SPEC_USER_SESSION_KEYRING
This specifies the caller's UID-session keyring (user-
session-keyring(7)).
Requesting user-space instantiation of a key
If the kernel cannot find a key matching type and description,
and callout is not NULL, then the kernel attempts to invoke a
user-space program to instantiate a key with the given type and
description. In this case, the following steps are performed:
a) The kernel creates an uninstantiated key, U, with the
requested type and description.
b) The kernel creates an authorization key, V, that refers to
the key U and records the facts that the caller of
request_key(2) is:
(1) the context in which the key U should be instantiated
and secured, and
(2) the context from which associated key requests may be
satisfied.
The authorization key is constructed as follows:
* The key type is ".request_key_auth".
* The key's UID and GID are the same as the corresponding
filesystem IDs of the requesting process.
* The key grants view, read, and search permissions to the
key possessor as well as view permission for the key
user.
* The description (name) of the key is the hexadecimal
string representing the ID of the key that is to be
instantiated in the requesting program.
* The payload of the key is taken from the data specified
in callout_info.
* Internally, the kernel also records a record of the PID
of the process that called request_key(2).
c) The kernel creates a process that executes a user-space
service such as request-key(8) with a new session keyring
that contains a link to the authorization key, V.
This program is supplied with the following command-line
arguments:
[0] The string "/sbin/request-key".
[1] The string "create" (indicating that a key is to be
created).
[2] The ID of the key that is to be instantiated.
[3] The filesystem UID of the caller of request_key().
[4] The filesystem GID of the caller of request_key().
[5] The ID of the thread keyring of the caller of
request_key(). This may be zero if that keyring hasn't
been created.
[6] The ID of the process keyring of the caller of
request_key(). This may be zero if that keyring hasn't
been created.
[7] The ID of the session keyring of the caller of
request_key().
Note: each of the command-line arguments that is a key ID
is encoded in decimal (unlike the key IDs shown in
/proc/keys, which are shown as hexadecimal values).
d) The program spawned in the previous step:
* Assumes the authority to instantiate the key U using the
keyctl(2) KEYCTL_ASSUME_AUTHORITY operation (typically
via the keyctl_assume_authority(3) function).
* Obtains the callout data from the payload of the autho‐
rization key V (using the keyctl(2) KEYCTL_READ opera‐
tion (or, more commonly, the keyctl_read(3) function)
with a key ID value of KEY_SPEC_REQKEY_AUTH_KEY).
* Instantiates the key (or execs another program that per‐
forms that task), specifying the payload and destination
keyring. (The destination keyring that the requestor
specified when calling request_key() can be accessed
using the special key ID KEY_SPEC_REQUESTOR_KEYRING.)
Instantiation is performed using the keyctl(2)
KEYCTL_INSTANTIATE operation (or, more commonly, the
keyctl_instantiate(3) function). At this point, the
request_key(2) call completes, and the requesting pro‐
gram can continue execution.
If these steps are unsuccessful, then an ENOKEY error will be
returned to the caller of request_key() and a temporary nega‐
tive key will be installed in the keyring specified by
dest_keyring. This will expire after a few seconds, but will
cause subsequent calls to request_key() to fail until it does.
The purpose of this negatively instantiated key is to prevent
(possibly different) processes making repeated requests (that
require expensive request-key(8) upcalls) for a key that can't
(at the moment) be positively instantiated.
Once the key has been instantiated, the authorization key
(KEY_SPEC_REQKEY_AUTH_KEY) is revoked, and the destination
keyring (KEY_SPEC_REQUESTOR_KEYRING) is no longer accessible
from the request-key(8) program.
If a key is created, then—regardless of whether it is a valid
key or a negative key—it will displace any other key with the
same type and description from the keyring specified in
dest_keyring.
RETURN VALUE
On success, request_key() returns the serial number of the key
it found or caused to be created. On error, -1 is returned and
errno is set to indicate the cause of the error.
ERRORS
EACCES The keyring wasn't available for modification by the
user.
EDQUOT The key quota for this user would be exceeded by creat‐
ing this key or linking it to the keyring.
EINTR The request was interrupted by a signal; see signal(7).
EINVAL The size of the string (including the terminating null
byte) specified in type or description exceeded the
limit (32 bytes and 4096 bytes respectively).
EINVAL The size of the string (including the terminating null
byte) specified in callout_info exceeded the system page
size.
EKEYEXPIRED
An expired key was found, but no replacement could be
obtained.
EKEYREJECTED
The attempt to generate a new key was rejected.
EKEYREVOKED
A revoked key was found, but no replacement could be
obtained.
ENOKEY No matching key was found.
ENOMEM Insufficient memory to create a key.
VERSIONS
This system call first appeared in Linux 2.6.10.
CONFORMING TO
This system call is a nonstandard Linux extension.
NOTES
No wrapper for this system call is provided in glibc. A wrap‐
per is provided in the libkeyutils package. When employing the
wrapper in that library, link with -lkeyutils.
EXAMPLE
The program below demonstrates the use of request_key(). The
type, description, and callout_info arguments for the system
call are taken from the values supplied in the command line
arguments. The call specifies the session keyring as the tar‐
get keyring.
In order to demonstrate this program, we first create a suit‐
able entry in the file /etc/request-key.conf.
$ sudo sh
# echo 'create user mtk:* * /bin/keyctl instantiate %k %c %S' \
> /etc/request-keys.conf
# exit
This entry specifies that when a new "user" key with the prefix
"mtk:" must be instantiated, that task should be performed via
the keyctl(1) command's instantiate operation. (The program
could The arguments supplied to the instantiate operation are:
the ID of the uninstantiated key (%k); the callout data sup‐
plied to the request_key() call (%c); and the session keyring
(%S) of the requestor (i.e., the caller of request)key()).
i(See request-key.conf(5) for details of these % specifiers.)
Then we run the program and check the contents of /proc/keys to
verify that the requested kay has been instantiated:
$ ./a.out user mtk:key1 "Payload data"
$ grep '2dddaf50' /proc/keys
2dddaf50 I--Q--- 1 perm 3f010000 1000 1000 user mtk:key1: 12
Program source
The program below
#include <sys/types.h>
#include <keyutils.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#define errExit(msg) do { perror(msg); exit(EXIT_FAILURE); \
} while (0)
int
main(int argc, char *argv[])
{
key_serial_t key;
if (argc != 4) {
fprintf(stderr, "Usage: %s type description callout-data\n",
argv[0]);
exit(EXIT_FAILURE);
}
key = request_key(argv[1], argv[2], argv[3],
KEY_SPEC_SESSION_KEYRING);
if (key == -1)
errExit("request_key");
printf("Key ID is %lx\n", (long) key);
exit(EXIT_SUCCESS);
}
SEE ALSO
keyctl(1), add_key(2), keyctl(2), keyctl(3), keyrings(7),
keyutils(7), capabilities(7), persistent-keyring(7),
process-keyring(7), session-keyring(7), thread-keyring(7),
user-keyring(7), user-session-keyring(7), request-key(8)
The kernel source files Documentation/security/keys.txt and
Documentation/security/keys-request-key.txt.
Linux 2016-10-08 REQUEST_KEY(2)
--
Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
Linux/UNIX System Programming Training: http://man7.org/training/
[-- Attachment #2: request_key.2 --]
[-- Type: application/x-troff-man, Size: 12609 bytes --]
^ permalink raw reply [flat|nested] 29+ messages in thread
[parent not found: <528b203d-ac72-e4a6-8517-e8c5c11055a4-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>]
* [PATCH 0/5] Re: Revised request_key(2) man page for review
[not found] ` <528b203d-ac72-e4a6-8517-e8c5c11055a4-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
@ 2016-11-21 20:59 ` Eugene Syromyatnikov
2016-11-21 22:33 ` Michael Kerrisk (man-pages)
2016-11-21 20:59 ` [PATCH 1/5] request_key.2: add information regarding default keyring Eugene Syromyatnikov
` (4 subsequent siblings)
5 siblings, 1 reply; 29+ messages in thread
From: Eugene Syromyatnikov @ 2016-11-21 20:59 UTC (permalink / raw)
To: mtk.manpages-Re5JQEeQqe8AvxtiuMwx3w; +Cc: linux-man-u79uwXL29TY76Z2rM5mHXA
Hello.
Possible amendments are in the following patches. The one thing i
couldn't comprehend properly is the following paragraph:
[[
This entry specifies that when a new "user" key with the prefix
"mtk:" must be instantiated, that task should be performed via the
.BR keyctl (1)
command's
.B instantiate
operation.
(The program could
The arguments supplied to the
.B instantiate
operation are:
the ID of the uninstantiated key
.RI ( %k );
the callout data supplied to the
.BR request_key ()
call
.RI ( %c );
and the session keyring
.RI ( %S )
of the requestor (i.e., the caller of
.BR request)key ()).
i(See
.BR request-key.conf (5)
for details of these
.I %
specifiers.)
]]
I suppose there's some sort of copy-paste mistake.
Eugene Syromyatnikov (5):
request_key.2: add information regarding default keyring
requesT_key.2: add information regarding minimal kernel version for
key instantiation on request
request_key.2: whitespace fix
request_key.2: wfix
request_key.2: additional error information
man2/request_key.2 | 64 +++++++++++++++++++++++++++++++++++++++++++++++-------
1 file changed, 56 insertions(+), 8 deletions(-)
--
2.10.2
--
To unsubscribe from this list: send the line "unsubscribe linux-man" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 29+ messages in thread
* Re: [PATCH 0/5] Re: Revised request_key(2) man page for review
2016-11-21 20:59 ` [PATCH 0/5] " Eugene Syromyatnikov
@ 2016-11-21 22:33 ` Michael Kerrisk (man-pages)
0 siblings, 0 replies; 29+ messages in thread
From: Michael Kerrisk (man-pages) @ 2016-11-21 22:33 UTC (permalink / raw)
To: Eugene Syromyatnikov
Cc: mtk.manpages-Re5JQEeQqe8AvxtiuMwx3w, linux-man-u79uwXL29TY76Z2rM5mHXA
Hello Eugene,
On 11/21/2016 09:59 PM, Eugene Syromyatnikov wrote:
> Hello.
>
> Possible amendments are in the following patches. The one thing i
> couldn't comprehend properly is the following paragraph:
>
> [[
> This entry specifies that when a new "user" key with the prefix
> "mtk:" must be instantiated, that task should be performed via the
> .BR keyctl (1)
> command's
> .B instantiate
> operation.
> (The program could
The above line should not have been present.
> The arguments supplied to the
> .B instantiate
> operation are:
> the ID of the uninstantiated key
> .RI ( %k );
> the callout data supplied to the
> .BR request_key ()
> call
> .RI ( %c );
> and the session keyring
> .RI ( %S )
> of the requestor (i.e., the caller of
> .BR request)key ()).
> i(See
> .BR request-key.conf (5)
> for details of these
> .I %
> specifiers.)
> ]]
>
> I suppose there's some sort of copy-paste mistake.
Yes. Fixed now.
Cheers,
Michael
> Eugene Syromyatnikov (5):
> request_key.2: add information regarding default keyring
> requesT_key.2: add information regarding minimal kernel version for
> key instantiation on request
> request_key.2: whitespace fix
> request_key.2: wfix
> request_key.2: additional error information
>
> man2/request_key.2 | 64 +++++++++++++++++++++++++++++++++++++++++++++++-------
> 1 file changed, 56 insertions(+), 8 deletions(-)
>
--
Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
Linux/UNIX System Programming Training: http://man7.org/training/
--
To unsubscribe from this list: send the line "unsubscribe linux-man" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 29+ messages in thread
* [PATCH 1/5] request_key.2: add information regarding default keyring
[not found] ` <528b203d-ac72-e4a6-8517-e8c5c11055a4-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2016-11-21 20:59 ` [PATCH 0/5] " Eugene Syromyatnikov
@ 2016-11-21 20:59 ` Eugene Syromyatnikov
2016-11-21 22:08 ` Michael Kerrisk (man-pages)
` (2 more replies)
2016-11-21 20:59 ` [PATCH 2/5] requesT_key.2: add information regarding minimal kernel version for key instantiation on request Eugene Syromyatnikov
` (3 subsequent siblings)
5 siblings, 3 replies; 29+ messages in thread
From: Eugene Syromyatnikov @ 2016-11-21 20:59 UTC (permalink / raw)
To: mtk.manpages-Re5JQEeQqe8AvxtiuMwx3w; +Cc: linux-man-u79uwXL29TY76Z2rM5mHXA
---
man2/request_key.2 | 47 ++++++++++++++++++++++++++++++++++++++++++-----
1 file changed, 42 insertions(+), 5 deletions(-)
diff --git a/man2/request_key.2 b/man2/request_key.2
index a9d0561..e29ca06 100644
--- a/man2/request_key.2
+++ b/man2/request_key.2
@@ -35,11 +35,6 @@ If the key is found or created,
attaches it to the keyring whose ID is specified in
.I dest_keyring
and returns the key's serial number.
-.\" FIXME Is 'keyring' allowed to be 0? Reading the source, it appears so.
-.\" In this case, by default, the key is assigned to the session keyring.
-.\" But, the KEYCTL_SET_REQKEY_KEYRING also seems to have an influence here.
-.\" What are the details here?
-.\"
.BR request_key ()
first recursively searches for a matching key in all of the keyrings
@@ -104,6 +99,48 @@ This specifies the caller's UID-specific keyring
.B KEY_SPEC_USER_SESSION_KEYRING
This specifies the caller's UID-session keyring
.RB ( user-session-keyring (7)).
+.PP
+When the
+.I dest_keyring
+is specified to
+.BR 0 ,
+and no key construction have been performed, then no additional linking is done.
+Otherwise, if new key is constructed, it would be linked to the "default"
+keyring (which can be specified via the
+.BR keyctl (2)
+command
+.BR KEYCTL_SET_REQKEY_KEYRING ).
+More specifically, when kernel tries to determine to which keyring the
+newly constructed key should be linked, it tries the following options, starting
+from the value set via
+.BR KEYCTL_SET_REQKEY_KEYRING " " keyctl (2)
+command until it finds the first available one:
+.IP \(bu 3
+.\" 8bbf4976b59fc9fc2861e79cab7beb3f6d647640
+Requestor keyring (specified via
+.BR KEY_REQKEY_DEFL_REQUESTOR_KEYRING ,
+since Linux 2.6.29)
+.IP \(bu
+Thread-specific keyring (specified via
+.BR KEY_REQKEY_DEFL_THREAD_KEYRING )
+.IP \(bu
+Process-specific keyring (specified via
+.BR KEY_REQKEY_DEFL_PROCESS_KEYRING )
+.IP \(bu
+Session-specific keyring (specified via
+.BR KEY_REQKEY_DEFL_SESSION_KEYRING )
+.IP \(bu
+Session keyring for the process's user ID (specified via
+.BR KEY_REQKEY_DEFL_USER_SESSION_KEYRING ).
+This keyring is expected to always exist.
+.IP \(bu
+UID-specific keyring (specified via
+.BR KEY_REQKEY_DEFL_USER_KEYRING ).
+This keyring is also expected to always exist.
+.PP
+Specifying
+.B KEY_REQKEY_DEFL_DEFAULT
+leads to starting from the beginning of the list.
.\"
.SS Requesting user-space instantiation of a key
If the kernel cannot find a key matching
--
2.10.2
--
To unsubscribe from this list: send the line "unsubscribe linux-man" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply related [flat|nested] 29+ messages in thread
* Re: [PATCH 1/5] request_key.2: add information regarding default keyring
2016-11-21 20:59 ` [PATCH 1/5] request_key.2: add information regarding default keyring Eugene Syromyatnikov
@ 2016-11-21 22:08 ` Michael Kerrisk (man-pages)
2016-11-25 10:01 ` Michael Kerrisk (man-pages)
2016-12-17 12:21 ` Michael Kerrisk (man-pages)
2 siblings, 0 replies; 29+ messages in thread
From: Michael Kerrisk (man-pages) @ 2016-11-21 22:08 UTC (permalink / raw)
To: Eugene Syromyatnikov
Cc: mtk.manpages-Re5JQEeQqe8AvxtiuMwx3w,
linux-man-u79uwXL29TY76Z2rM5mHXA, David Howells
Hi Eugene,
Thanks for taking a shot at this. I'd really be keen to hear from
David on this before I apply.
David, could you comment please?
Cheers,
Michael
On 11/21/2016 09:59 PM, Eugene Syromyatnikov wrote:
> ---
> man2/request_key.2 | 47 ++++++++++++++++++++++++++++++++++++++++++-----
> 1 file changed, 42 insertions(+), 5 deletions(-)
>
> diff --git a/man2/request_key.2 b/man2/request_key.2
> index a9d0561..e29ca06 100644
> --- a/man2/request_key.2
> +++ b/man2/request_key.2
> @@ -35,11 +35,6 @@ If the key is found or created,
> attaches it to the keyring whose ID is specified in
> .I dest_keyring
> and returns the key's serial number.
> -.\" FIXME Is 'keyring' allowed to be 0? Reading the source, it appears so.
> -.\" In this case, by default, the key is assigned to the session keyring.
> -.\" But, the KEYCTL_SET_REQKEY_KEYRING also seems to have an influence here.
> -.\" What are the details here?
> -.\"
>
> .BR request_key ()
> first recursively searches for a matching key in all of the keyrings
> @@ -104,6 +99,48 @@ This specifies the caller's UID-specific keyring
> .B KEY_SPEC_USER_SESSION_KEYRING
> This specifies the caller's UID-session keyring
> .RB ( user-session-keyring (7)).
> +.PP
> +When the
> +.I dest_keyring
> +is specified to
> +.BR 0 ,
> +and no key construction have been performed, then no additional linking is done.
> +Otherwise, if new key is constructed, it would be linked to the "default"
> +keyring (which can be specified via the
> +.BR keyctl (2)
> +command
> +.BR KEYCTL_SET_REQKEY_KEYRING ).
> +More specifically, when kernel tries to determine to which keyring the
> +newly constructed key should be linked, it tries the following options, starting
> +from the value set via
> +.BR KEYCTL_SET_REQKEY_KEYRING " " keyctl (2)
> +command until it finds the first available one:
> +.IP \(bu 3
> +.\" 8bbf4976b59fc9fc2861e79cab7beb3f6d647640
> +Requestor keyring (specified via
> +.BR KEY_REQKEY_DEFL_REQUESTOR_KEYRING ,
> +since Linux 2.6.29)
> +.IP \(bu
> +Thread-specific keyring (specified via
> +.BR KEY_REQKEY_DEFL_THREAD_KEYRING )
> +.IP \(bu
> +Process-specific keyring (specified via
> +.BR KEY_REQKEY_DEFL_PROCESS_KEYRING )
> +.IP \(bu
> +Session-specific keyring (specified via
> +.BR KEY_REQKEY_DEFL_SESSION_KEYRING )
> +.IP \(bu
> +Session keyring for the process's user ID (specified via
> +.BR KEY_REQKEY_DEFL_USER_SESSION_KEYRING ).
> +This keyring is expected to always exist.
> +.IP \(bu
> +UID-specific keyring (specified via
> +.BR KEY_REQKEY_DEFL_USER_KEYRING ).
> +This keyring is also expected to always exist.
> +.PP
> +Specifying
> +.B KEY_REQKEY_DEFL_DEFAULT
> +leads to starting from the beginning of the list.
> .\"
> .SS Requesting user-space instantiation of a key
> If the kernel cannot find a key matching
>
--
Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
Linux/UNIX System Programming Training: http://man7.org/training/
--
To unsubscribe from this list: send the line "unsubscribe linux-man" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 29+ messages in thread
* Re: [PATCH 1/5] request_key.2: add information regarding default keyring
2016-11-21 20:59 ` [PATCH 1/5] request_key.2: add information regarding default keyring Eugene Syromyatnikov
2016-11-21 22:08 ` Michael Kerrisk (man-pages)
@ 2016-11-25 10:01 ` Michael Kerrisk (man-pages)
[not found] ` <54aa766c-25de-74ba-fba5-59cd95b2ae91-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2016-12-17 12:21 ` Michael Kerrisk (man-pages)
2 siblings, 1 reply; 29+ messages in thread
From: Michael Kerrisk (man-pages) @ 2016-11-25 10:01 UTC (permalink / raw)
To: Eugene Syromyatnikov
Cc: mtk.manpages-Re5JQEeQqe8AvxtiuMwx3w, linux-man-u79uwXL29TY76Z2rM5mHXA
Hi Eugene,
On 11/21/2016 09:59 PM, Eugene Syromyatnikov wrote:
> ---
> man2/request_key.2 | 47 ++++++++++++++++++++++++++++++++++++++++++-----
> 1 file changed, 42 insertions(+), 5 deletions(-)
>
> diff --git a/man2/request_key.2 b/man2/request_key.2
> index a9d0561..e29ca06 100644
> --- a/man2/request_key.2
> +++ b/man2/request_key.2
> @@ -35,11 +35,6 @@ If the key is found or created,
> attaches it to the keyring whose ID is specified in
> .I dest_keyring
> and returns the key's serial number.
> -.\" FIXME Is 'keyring' allowed to be 0? Reading the source, it appears so.
> -.\" In this case, by default, the key is assigned to the session keyring.
> -.\" But, the KEYCTL_SET_REQKEY_KEYRING also seems to have an influence here.
> -.\" What are the details here?
> -.\"
>
> .BR request_key ()
> first recursively searches for a matching key in all of the keyrings
> @@ -104,6 +99,48 @@ This specifies the caller's UID-specific keyring
> .B KEY_SPEC_USER_SESSION_KEYRING
> This specifies the caller's UID-session keyring
> .RB ( user-session-keyring (7)).
> +.PP
> +When the
> +.I dest_keyring
> +is specified to
> +.BR 0 ,
> +and no key construction have been performed, then no additional linking is done.
> +Otherwise, if new key is constructed, it would be linked to the "default"
> +keyring (which can be specified via the
> +.BR keyctl (2)
> +command
> +.BR KEYCTL_SET_REQKEY_KEYRING ).
For the purpose of me reviewing this, could you outline how you verified
the following details:
> +More specifically, when kernel tries to determine to which keyring the
> +newly constructed key should be linked, it tries the following options, starting
> +from the value set via
> +.BR KEYCTL_SET_REQKEY_KEYRING " " keyctl (2)
> +command until it finds the first available one:
> +.IP \(bu 3
> +.\" 8bbf4976b59fc9fc2861e79cab7beb3f6d647640
> +Requestor keyring (specified via
> +.BR KEY_REQKEY_DEFL_REQUESTOR_KEYRING ,
> +since Linux 2.6.29)
> +.IP \(bu
> +Thread-specific keyring (specified via
> +.BR KEY_REQKEY_DEFL_THREAD_KEYRING )
> +.IP \(bu
> +Process-specific keyring (specified via
> +.BR KEY_REQKEY_DEFL_PROCESS_KEYRING )
> +.IP \(bu
> +Session-specific keyring (specified via
> +.BR KEY_REQKEY_DEFL_SESSION_KEYRING )
> +.IP \(bu
> +Session keyring for the process's user ID (specified via
> +.BR KEY_REQKEY_DEFL_USER_SESSION_KEYRING ).
> +This keyring is expected to always exist.
> +.IP \(bu
> +UID-specific keyring (specified via
> +.BR KEY_REQKEY_DEFL_USER_KEYRING ).
> +This keyring is also expected to always exist.
> +.PP
> +Specifying
> +.B KEY_REQKEY_DEFL_DEFAULT
> +leads to starting from the beginning of the list.
> .\"
> .SS Requesting user-space instantiation of a key
> If the kernel cannot find a key matching
>
Cheers,
Michael
--
Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
Linux/UNIX System Programming Training: http://man7.org/training/
--
To unsubscribe from this list: send the line "unsubscribe linux-man" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 29+ messages in thread
* Re: [PATCH 1/5] request_key.2: add information regarding default keyring
2016-11-21 20:59 ` [PATCH 1/5] request_key.2: add information regarding default keyring Eugene Syromyatnikov
2016-11-21 22:08 ` Michael Kerrisk (man-pages)
2016-11-25 10:01 ` Michael Kerrisk (man-pages)
@ 2016-12-17 12:21 ` Michael Kerrisk (man-pages)
[not found] ` <6df2c812-c2d6-321c-902f-93b4d3aaa953-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2 siblings, 1 reply; 29+ messages in thread
From: Michael Kerrisk (man-pages) @ 2016-12-17 12:21 UTC (permalink / raw)
To: Eugene Syromyatnikov
Cc: mtk.manpages-Re5JQEeQqe8AvxtiuMwx3w,
linux-man-u79uwXL29TY76Z2rM5mHXA, David Howells
Hello Eugene, (and David)
[David, could you take a look at the FIXMEs below?]
On 11/21/2016 09:59 PM, Eugene Syromyatnikov wrote:
> ---
> man2/request_key.2 | 47 ++++++++++++++++++++++++++++++++++++++++++-----
> 1 file changed, 42 insertions(+), 5 deletions(-)
>
> diff --git a/man2/request_key.2 b/man2/request_key.2
> index a9d0561..e29ca06 100644
> --- a/man2/request_key.2
> +++ b/man2/request_key.2
> @@ -35,11 +35,6 @@ If the key is found or created,
> attaches it to the keyring whose ID is specified in
> .I dest_keyring
> and returns the key's serial number.
> -.\" FIXME Is 'keyring' allowed to be 0? Reading the source, it appears so.
> -.\" In this case, by default, the key is assigned to the session keyring.
> -.\" But, the KEYCTL_SET_REQKEY_KEYRING also seems to have an influence here.
> -.\" What are the details here?
> -.\"
>
> .BR request_key ()
> first recursively searches for a matching key in all of the keyrings
> @@ -104,6 +99,48 @@ This specifies the caller's UID-specific keyring
> .B KEY_SPEC_USER_SESSION_KEYRING
> This specifies the caller's UID-session keyring
> .RB ( user-session-keyring (7)).
> +.PP
> +When the
> +.I dest_keyring
> +is specified to
> +.BR 0 ,
> +and no key construction have been performed, then no additional linking is done.
> +Otherwise, if new key is constructed, it would be linked to the "default"
> +keyring (which can be specified via the
> +.BR keyctl (2)
> +command
> +.BR KEYCTL_SET_REQKEY_KEYRING ).
> +More specifically, when kernel tries to determine to which keyring the
> +newly constructed key should be linked, it tries the following options, starting
> +from the value set via
> +.BR KEYCTL_SET_REQKEY_KEYRING " " keyctl (2)
> +command until it finds the first available one:
> +.IP \(bu 3
> +.\" 8bbf4976b59fc9fc2861e79cab7beb3f6d647640
> +Requestor keyring (specified via
> +.BR KEY_REQKEY_DEFL_REQUESTOR_KEYRING ,
> +since Linux 2.6.29)
> +.IP \(bu
> +Thread-specific keyring (specified via
> +.BR KEY_REQKEY_DEFL_THREAD_KEYRING )
> +.IP \(bu
> +Process-specific keyring (specified via
> +.BR KEY_REQKEY_DEFL_PROCESS_KEYRING )
> +.IP \(bu
> +Session-specific keyring (specified via
> +.BR KEY_REQKEY_DEFL_SESSION_KEYRING )
> +.IP \(bu
> +Session keyring for the process's user ID (specified via
> +.BR KEY_REQKEY_DEFL_USER_SESSION_KEYRING ).
> +This keyring is expected to always exist.
> +.IP \(bu
> +UID-specific keyring (specified via
> +.BR KEY_REQKEY_DEFL_USER_KEYRING ).
> +This keyring is also expected to always exist.
> +.PP
> +Specifying
> +.B KEY_REQKEY_DEFL_DEFAULT
> +leads to starting from the beginning of the list.
> .\"
> .SS Requesting user-space instantiation of a key
> If the kernel cannot find a key matching
Thanks. Everything that I tested concurs with your patch, but
I've done some rewording that makes things a bit clearer, and
I've added one or two details.
How does the following look:
The dest_keyring serial number may be that of a valid keyring for
which the caller has write permission, or it may be one of the
following special keyring IDs:
KEY_SPEC_THREAD_KEYRING
This specifies the caller's thread-specific keyring
(thread-keyring(7)).
KEY_SPEC_PROCESS_KEYRING
This specifies the caller's process-specific keyring
(process-keyring(7)).
KEY_SPEC_SESSION_KEYRING
This specifies the caller's session-specific keyring (ses‐
sion-keyring(7)).
KEY_SPEC_USER_KEYRING
This specifies the caller's UID-specific keyring (user-
keyring(7)).
KEY_SPEC_USER_SESSION_KEYRING
This specifies the caller's UID-session keyring (user-ses‐
sion-keyring(7)).
When the dest_keyring is specified to 0, and no key construction
have been performed, then no additional linking is done.
Otherwise, if dest_keyring is 0 and a new key is constructed, the new
key will be linked to the "default" keyring. More precisely, when the
kernel tries to determine to which keyring the newly constructed key
should be linked, it tries the following keyrings, beginning with the
keyring set via the keyctl(2) KEYCTL_SET_REQKEY_KEYRING command and
continuing in the order shown below until it finds the first keyring
that exists:
· The requestor keyring (KEY_REQKEY_DEFL_REQUESTOR_KEYRING, since
Linux 2.6.29).
┌─────────────────────────────────────────────────────┐
│FIXME │
├─────────────────────────────────────────────────────┤
│Actually, is the preceding point correct? If I │
│understand correctly, we'll only get here if won't │
│refer to a keyring. Have I misunderstood? │
└─────────────────────────────────────────────────────┘
· The thread-specific keyring (KEY_REQKEY_DEFL_THREAD_KEYRING).
· The process-specific keyring (KEY_REQKEY_DEFL_PROCESS_KEYRING).
· The session-specific keyring (KEY_REQKEY_DEFL_SESSION_KEYRING).
· The session keyring for the process's user ID
(KEY_REQKEY_DEFL_USER_SESSION_KEYRING). This keyring is expected to
always exist.
┌─────────────────────────────────────────────────────┐
│FIXME │
├─────────────────────────────────────────────────────┤
│Are there circumstances where the session keyring │
│does not exist? What are they? │
└─────────────────────────────────────────────────────┘
· The UID-specific keyring (KEY_REQKEY_DEFL_USER_KEYRING). This
keyring is also expected to always exist.
┌─────────────────────────────────────────────────────┐
│FIXME │
├─────────────────────────────────────────────────────┤
│Are there circumstances where the UID-specific │
│keyring does not exist? What are they? │
└─────────────────────────────────────────────────────┘
If the keyctl(2) KEYCTL_SET_REQKEY_KEYRING command specifies
KEY_REQKEY_DEFL_DEFAULT (or no KEYCTL_SET_REQKEY_KEYRING command is
performed), then the kernel looks for a keyring starting from the
beginning of the list.
These changes have been pushed to the public branch:
http://git.kernel.org/cgit/docs/man-pages/man-pages.git/log/?h=draft_2_keys
Cheers,
Michael
--
Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
Linux/UNIX System Programming Training: http://man7.org/training/
--
To unsubscribe from this list: send the line "unsubscribe linux-man" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 29+ messages in thread
* [PATCH 2/5] requesT_key.2: add information regarding minimal kernel version for key instantiation on request
[not found] ` <528b203d-ac72-e4a6-8517-e8c5c11055a4-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2016-11-21 20:59 ` [PATCH 0/5] " Eugene Syromyatnikov
2016-11-21 20:59 ` [PATCH 1/5] request_key.2: add information regarding default keyring Eugene Syromyatnikov
@ 2016-11-21 20:59 ` Eugene Syromyatnikov
2016-11-21 22:00 ` Michael Kerrisk (man-pages)
2016-11-21 20:59 ` [PATCH 3/5] request_key.2: whitespace fix Eugene Syromyatnikov
` (2 subsequent siblings)
5 siblings, 1 reply; 29+ messages in thread
From: Eugene Syromyatnikov @ 2016-11-21 20:59 UTC (permalink / raw)
To: mtk.manpages-Re5JQEeQqe8AvxtiuMwx3w; +Cc: linux-man-u79uwXL29TY76Z2rM5mHXA
---
man2/request_key.2 | 2 ++
1 file changed, 2 insertions(+)
diff --git a/man2/request_key.2 b/man2/request_key.2
index e29ca06..e46dd61 100644
--- a/man2/request_key.2
+++ b/man2/request_key.2
@@ -364,6 +364,8 @@ No matching key was found.
Insufficient memory to create a key.
.SH VERSIONS
This system call first appeared in Linux 2.6.10.
+.\" 3e30148c3d524a9c1c63ca28261bc24c457eb07a
+The ability to instantiate keys upon request has been added in Linux 2.6.13.
.SH CONFORMING TO
This system call is a nonstandard Linux extension.
.SH NOTES
--
2.10.2
--
To unsubscribe from this list: send the line "unsubscribe linux-man" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply related [flat|nested] 29+ messages in thread
* Re: [PATCH 2/5] requesT_key.2: add information regarding minimal kernel version for key instantiation on request
2016-11-21 20:59 ` [PATCH 2/5] requesT_key.2: add information regarding minimal kernel version for key instantiation on request Eugene Syromyatnikov
@ 2016-11-21 22:00 ` Michael Kerrisk (man-pages)
0 siblings, 0 replies; 29+ messages in thread
From: Michael Kerrisk (man-pages) @ 2016-11-21 22:00 UTC (permalink / raw)
To: Eugene Syromyatnikov
Cc: mtk.manpages-Re5JQEeQqe8AvxtiuMwx3w, linux-man-u79uwXL29TY76Z2rM5mHXA
Hello Eugene,
On 11/21/2016 09:59 PM, Eugene Syromyatnikov wrote:
> ---
> man2/request_key.2 | 2 ++
> 1 file changed, 2 insertions(+)
Applied. Thank you!
Cheers,
Michael
> diff --git a/man2/request_key.2 b/man2/request_key.2
> index e29ca06..e46dd61 100644
> --- a/man2/request_key.2
> +++ b/man2/request_key.2
> @@ -364,6 +364,8 @@ No matching key was found.
> Insufficient memory to create a key.
> .SH VERSIONS
> This system call first appeared in Linux 2.6.10.
> +.\" 3e30148c3d524a9c1c63ca28261bc24c457eb07a
> +The ability to instantiate keys upon request has been added in Linux 2.6.13.
> .SH CONFORMING TO
> This system call is a nonstandard Linux extension.
> .SH NOTES
>
--
Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
Linux/UNIX System Programming Training: http://man7.org/training/
--
To unsubscribe from this list: send the line "unsubscribe linux-man" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 29+ messages in thread
* [PATCH 3/5] request_key.2: whitespace fix
[not found] ` <528b203d-ac72-e4a6-8517-e8c5c11055a4-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
` (2 preceding siblings ...)
2016-11-21 20:59 ` [PATCH 2/5] requesT_key.2: add information regarding minimal kernel version for key instantiation on request Eugene Syromyatnikov
@ 2016-11-21 20:59 ` Eugene Syromyatnikov
2016-11-21 21:59 ` Michael Kerrisk (man-pages)
2016-11-21 21:00 ` [PATCH 4/5] request_key.2: wfix Eugene Syromyatnikov
2016-11-21 21:00 ` [PATCH 5/5] request_key.2: additional error information Eugene Syromyatnikov
5 siblings, 1 reply; 29+ messages in thread
From: Eugene Syromyatnikov @ 2016-11-21 20:59 UTC (permalink / raw)
To: mtk.manpages-Re5JQEeQqe8AvxtiuMwx3w; +Cc: linux-man-u79uwXL29TY76Z2rM5mHXA
---
man2/request_key.2 | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/man2/request_key.2 b/man2/request_key.2
index e46dd61..63e8206 100644
--- a/man2/request_key.2
+++ b/man2/request_key.2
@@ -169,7 +169,7 @@ is:
.RS
.IP (1) 4
the context in which the key U should be instantiated and secured, and
-.IP (2)
+.IP (2)
the context from which associated key requests may be satisfied.
.RE
.IP
--
2.10.2
--
To unsubscribe from this list: send the line "unsubscribe linux-man" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply related [flat|nested] 29+ messages in thread
* Re: [PATCH 3/5] request_key.2: whitespace fix
2016-11-21 20:59 ` [PATCH 3/5] request_key.2: whitespace fix Eugene Syromyatnikov
@ 2016-11-21 21:59 ` Michael Kerrisk (man-pages)
0 siblings, 0 replies; 29+ messages in thread
From: Michael Kerrisk (man-pages) @ 2016-11-21 21:59 UTC (permalink / raw)
To: Eugene Syromyatnikov
Cc: mtk.manpages-Re5JQEeQqe8AvxtiuMwx3w, linux-man-u79uwXL29TY76Z2rM5mHXA
Hi Eugene,
On 11/21/2016 09:59 PM, Eugene Syromyatnikov wrote:
> ---
> man2/request_key.2 | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
Applied. Thanks!
Cheers,
Michael
>
> diff --git a/man2/request_key.2 b/man2/request_key.2
> index e46dd61..63e8206 100644
> --- a/man2/request_key.2
> +++ b/man2/request_key.2
> @@ -169,7 +169,7 @@ is:
> .RS
> .IP (1) 4
> the context in which the key U should be instantiated and secured, and
> -.IP (2)
> +.IP (2)
> the context from which associated key requests may be satisfied.
> .RE
> .IP
>
--
Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
Linux/UNIX System Programming Training: http://man7.org/training/
--
To unsubscribe from this list: send the line "unsubscribe linux-man" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 29+ messages in thread
* [PATCH 4/5] request_key.2: wfix
[not found] ` <528b203d-ac72-e4a6-8517-e8c5c11055a4-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
` (3 preceding siblings ...)
2016-11-21 20:59 ` [PATCH 3/5] request_key.2: whitespace fix Eugene Syromyatnikov
@ 2016-11-21 21:00 ` Eugene Syromyatnikov
2016-11-21 21:59 ` Michael Kerrisk (man-pages)
2016-11-21 21:00 ` [PATCH 5/5] request_key.2: additional error information Eugene Syromyatnikov
5 siblings, 1 reply; 29+ messages in thread
From: Eugene Syromyatnikov @ 2016-11-21 21:00 UTC (permalink / raw)
To: mtk.manpages-Re5JQEeQqe8AvxtiuMwx3w; +Cc: linux-man-u79uwXL29TY76Z2rM5mHXA
---
man2/request_key.2 | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/man2/request_key.2 b/man2/request_key.2
index 63e8206..1a3af3f 100644
--- a/man2/request_key.2
+++ b/man2/request_key.2
@@ -198,8 +198,7 @@ in the requesting program.
The payload of the key is taken from the data specified in
.IR callout_info .
.IP *
-Internally, the kernel also records a record of the PID of the process
-that called
+Internally, the kernel also records the PID of the process that called
.BR request_key (2).
.RE
.IP c)
--
2.10.2
--
To unsubscribe from this list: send the line "unsubscribe linux-man" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply related [flat|nested] 29+ messages in thread
* Re: [PATCH 4/5] request_key.2: wfix
2016-11-21 21:00 ` [PATCH 4/5] request_key.2: wfix Eugene Syromyatnikov
@ 2016-11-21 21:59 ` Michael Kerrisk (man-pages)
0 siblings, 0 replies; 29+ messages in thread
From: Michael Kerrisk (man-pages) @ 2016-11-21 21:59 UTC (permalink / raw)
To: Eugene Syromyatnikov
Cc: mtk.manpages-Re5JQEeQqe8AvxtiuMwx3w, linux-man-u79uwXL29TY76Z2rM5mHXA
Hi Eugene
On 11/21/2016 10:00 PM, Eugene Syromyatnikov wrote:> ---
> man2/request_key.2 | 3 +--
> 1 file changed, 1 insertion(+), 2 deletions(-)
Applied. Thanks!
Cheers,
Michael
> diff --git a/man2/request_key.2 b/man2/request_key.2
> index 63e8206..1a3af3f 100644
> --- a/man2/request_key.2
> +++ b/man2/request_key.2
> @@ -198,8 +198,7 @@ in the requesting program.
> The payload of the key is taken from the data specified in
> .IR callout_info .
> .IP *
> -Internally, the kernel also records a record of the PID of the process
> -that called
> +Internally, the kernel also records the PID of the process that called
> .BR request_key (2).
> .RE
> .IP c)
>
--
Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
Linux/UNIX System Programming Training: http://man7.org/training/
--
To unsubscribe from this list: send the line "unsubscribe linux-man" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 29+ messages in thread
* [PATCH 5/5] request_key.2: additional error information
[not found] ` <528b203d-ac72-e4a6-8517-e8c5c11055a4-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
` (4 preceding siblings ...)
2016-11-21 21:00 ` [PATCH 4/5] request_key.2: wfix Eugene Syromyatnikov
@ 2016-11-21 21:00 ` Eugene Syromyatnikov
2016-11-21 22:00 ` Michael Kerrisk (man-pages)
5 siblings, 1 reply; 29+ messages in thread
From: Eugene Syromyatnikov @ 2016-11-21 21:00 UTC (permalink / raw)
To: mtk.manpages-Re5JQEeQqe8AvxtiuMwx3w; +Cc: linux-man-u79uwXL29TY76Z2rM5mHXA
---
man2/request_key.2 | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/man2/request_key.2 b/man2/request_key.2
index 1a3af3f..936989a 100644
--- a/man2/request_key.2
+++ b/man2/request_key.2
@@ -331,6 +331,11 @@ The keyring wasn't available for modification by the user.
The key quota for this user would be exceeded by creating this key or linking
it to the keyring.
.TP
+.B EFAULT
+(Part of)
+.IR type ", " description " or " callout_info
+points outside process' accessible address space.
+.TP
.B EINTR
The request was interrupted by a signal; see
.BR signal (7).
@@ -361,6 +366,11 @@ No matching key was found.
.TP
.B ENOMEM
Insufficient memory to create a key.
+.TP
+.B EPERM
+The
+.I type
+started from dot.
.SH VERSIONS
This system call first appeared in Linux 2.6.10.
.\" 3e30148c3d524a9c1c63ca28261bc24c457eb07a
--
2.10.2
--
To unsubscribe from this list: send the line "unsubscribe linux-man" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply related [flat|nested] 29+ messages in thread
* Re: [PATCH 5/5] request_key.2: additional error information
2016-11-21 21:00 ` [PATCH 5/5] request_key.2: additional error information Eugene Syromyatnikov
@ 2016-11-21 22:00 ` Michael Kerrisk (man-pages)
0 siblings, 0 replies; 29+ messages in thread
From: Michael Kerrisk (man-pages) @ 2016-11-21 22:00 UTC (permalink / raw)
To: Eugene Syromyatnikov
Cc: mtk.manpages-Re5JQEeQqe8AvxtiuMwx3w, linux-man-u79uwXL29TY76Z2rM5mHXA
On 11/21/2016 10:00 PM, Eugene Syromyatnikov wrote:
> ---
> man2/request_key.2 | 10 ++++++++++
> 1 file changed, 10 insertions(+)
Hello Eugene,
Applied. Thank you!
Cheers,
Michael
> diff --git a/man2/request_key.2 b/man2/request_key.2
> index 1a3af3f..936989a 100644
> --- a/man2/request_key.2
> +++ b/man2/request_key.2
> @@ -331,6 +331,11 @@ The keyring wasn't available for modification by the user.
> The key quota for this user would be exceeded by creating this key or linking
> it to the keyring.
> .TP
> +.B EFAULT
> +(Part of)
> +.IR type ", " description " or " callout_info
> +points outside process' accessible address space.
> +.TP
> .B EINTR
> The request was interrupted by a signal; see
> .BR signal (7).
> @@ -361,6 +366,11 @@ No matching key was found.
> .TP
> .B ENOMEM
> Insufficient memory to create a key.
> +.TP
> +.B EPERM
> +The
> +.I type
> +started from dot.
> .SH VERSIONS
> This system call first appeared in Linux 2.6.10.
> .\" 3e30148c3d524a9c1c63ca28261bc24c457eb07a
>
--
Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
Linux/UNIX System Programming Training: http://man7.org/training/
--
To unsubscribe from this list: send the line "unsubscribe linux-man" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 29+ messages in thread
* Re: Revised request_key(2) man page for review
2016-11-04 15:45 Revised request_key(2) man page for review Michael Kerrisk (man-pages)
[not found] ` <528b203d-ac72-e4a6-8517-e8c5c11055a4-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
@ 2016-12-14 14:23 ` Michael Kerrisk (man-pages)
2016-12-15 10:10 ` David Howells
2 siblings, 0 replies; 29+ messages in thread
From: Michael Kerrisk (man-pages) @ 2016-12-14 14:23 UTC (permalink / raw)
To: David Howells
Cc: Michael Kerrisk, keyrings, linux-man, Eugene Syromyatnikov, lkml
Hi David,
Might you also have a chance to take a look at this page?
Cheers,
Michael
On 4 November 2016 at 16:45, Michael Kerrisk (man-pages)
<mtk.manpages@gmail.com> wrote:
> Hi David (and anyone else with an interest to review)
>
> Triggered by Eugene Syromyatnikov's recent input for the keyctl(2)
> man page, I've been doing a fair bit of work on improving the key
> management syscall man pages, and wonder if I could ask you for
> some review assistance?
>
> First off, below, I've pasted the current draft of the request_key(2)
> page, which has seen quite a a lot of changes (increasing from around
> 100 rendered lines to nearly 300). Could you take a look (and also take
> a look at the outstanding FIXME)? (The page source file is attached,
> in case you want to see all the formatting.)
>
> Thanks,
>
> Michael
>
> ====
>
> NAME
> request_key - request a key from the kernel's key management
> facility
>
> SYNOPSIS
> #include <sys/types.h>
> #include <keyutils.h>
>
> key_serial_t request_key(const char *type, const char *description,
> const char *callout_info,
> key_serial_t dest_keyring);
>
> No glibc wrapper is provided for this system call; see NOTES.
>
> DESCRIPTION
> request_key() attempts to find a key of the given type with a
> description (name) that matches the specified description. If
> such a key could not be found, then the key is optionally cre‐
> ated. If the key is found or created, request_key() attaches
> it to the keyring whose ID is specified in dest_keyring and
> returns the key's serial number.
>
>
> ┌─────────────────────────────────────────────────────┐
> │FIXME │
> ├─────────────────────────────────────────────────────┤
> │Is 'keyring' allowed to be 0? Reading the source, it │
> │appears so. In this case, by default, the key is │
> │assigned to the session keyring. But, the │
> │KEYCTL_SET_REQKEY_KEYRING also seems to have an │
> │influence here. What are the details here? │
> │ │
> └─────────────────────────────────────────────────────┘
>
> request_key() first recursively searches for a matching key in
> all of the keyrings attached to the calling process. The
> keyrings are searched in the order: thread-specific keyring,
> process-specific keyring, and then session keyring.
>
> If request_key() is called from a program invoked by
> request_key() on behalf of some other process to generate a
> key, then the keyrings of that other process will be searched
> next, using that other process's user ID, group ID, supplemen‐
> tary group IDs, and security context to determine access.
>
> The search of the keyring tree is breadth-first: the keys in
> each keyring searched are checked for a match before any child
> keyrings are recursed into. Only keys for which the caller has
> search permission be found, and only keyrings for which the
> caller has search permission may be searched.
>
> If the key is not found and callout is NULL, then the call
> fails with the error ENOKEY.
>
> If the key is not found and callout is not NULL, then the ker‐
> nel attempts to invoke a user-space program to instantiate the
> key. The details are given below.
>
> The dest_keyring serial number may be that of a valid keyring
> for which the caller has write permission, or it may be one of
> the following special keyring IDs:
>
> KEY_SPEC_THREAD_KEYRING
> This specifies the caller's thread-specific keyring
> (thread-keyring(7)).
>
> KEY_SPEC_PROCESS_KEYRING
> This specifies the caller's process-specific keyring
> (process-keyring(7)).
>
> KEY_SPEC_SESSION_KEYRING
> This specifies the caller's session-specific keyring
> (session-keyring(7)).
>
> KEY_SPEC_USER_KEYRING
> This specifies the caller's UID-specific keyring (user-
> keyring(7)).
>
> KEY_SPEC_USER_SESSION_KEYRING
> This specifies the caller's UID-session keyring (user-
> session-keyring(7)).
>
> Requesting user-space instantiation of a key
> If the kernel cannot find a key matching type and description,
> and callout is not NULL, then the kernel attempts to invoke a
> user-space program to instantiate a key with the given type and
> description. In this case, the following steps are performed:
>
> a) The kernel creates an uninstantiated key, U, with the
> requested type and description.
>
> b) The kernel creates an authorization key, V, that refers to
> the key U and records the facts that the caller of
> request_key(2) is:
>
> (1) the context in which the key U should be instantiated
> and secured, and
>
> (2) the context from which associated key requests may be
> satisfied.
>
> The authorization key is constructed as follows:
>
> * The key type is ".request_key_auth".
>
> * The key's UID and GID are the same as the corresponding
> filesystem IDs of the requesting process.
>
> * The key grants view, read, and search permissions to the
> key possessor as well as view permission for the key
> user.
>
> * The description (name) of the key is the hexadecimal
> string representing the ID of the key that is to be
> instantiated in the requesting program.
>
> * The payload of the key is taken from the data specified
> in callout_info.
>
> * Internally, the kernel also records a record of the PID
> of the process that called request_key(2).
>
> c) The kernel creates a process that executes a user-space
> service such as request-key(8) with a new session keyring
> that contains a link to the authorization key, V.
>
> This program is supplied with the following command-line
> arguments:
>
> [0] The string "/sbin/request-key".
>
> [1] The string "create" (indicating that a key is to be
> created).
>
> [2] The ID of the key that is to be instantiated.
>
> [3] The filesystem UID of the caller of request_key().
>
> [4] The filesystem GID of the caller of request_key().
>
> [5] The ID of the thread keyring of the caller of
> request_key(). This may be zero if that keyring hasn't
> been created.
>
> [6] The ID of the process keyring of the caller of
> request_key(). This may be zero if that keyring hasn't
> been created.
>
> [7] The ID of the session keyring of the caller of
> request_key().
>
> Note: each of the command-line arguments that is a key ID
> is encoded in decimal (unlike the key IDs shown in
> /proc/keys, which are shown as hexadecimal values).
>
> d) The program spawned in the previous step:
>
> * Assumes the authority to instantiate the key U using the
> keyctl(2) KEYCTL_ASSUME_AUTHORITY operation (typically
> via the keyctl_assume_authority(3) function).
>
> * Obtains the callout data from the payload of the autho‐
> rization key V (using the keyctl(2) KEYCTL_READ opera‐
> tion (or, more commonly, the keyctl_read(3) function)
> with a key ID value of KEY_SPEC_REQKEY_AUTH_KEY).
>
> * Instantiates the key (or execs another program that per‐
> forms that task), specifying the payload and destination
> keyring. (The destination keyring that the requestor
> specified when calling request_key() can be accessed
> using the special key ID KEY_SPEC_REQUESTOR_KEYRING.)
> Instantiation is performed using the keyctl(2)
> KEYCTL_INSTANTIATE operation (or, more commonly, the
> keyctl_instantiate(3) function). At this point, the
> request_key(2) call completes, and the requesting pro‐
> gram can continue execution.
>
> If these steps are unsuccessful, then an ENOKEY error will be
> returned to the caller of request_key() and a temporary nega‐
> tive key will be installed in the keyring specified by
> dest_keyring. This will expire after a few seconds, but will
> cause subsequent calls to request_key() to fail until it does.
> The purpose of this negatively instantiated key is to prevent
> (possibly different) processes making repeated requests (that
> require expensive request-key(8) upcalls) for a key that can't
> (at the moment) be positively instantiated.
>
> Once the key has been instantiated, the authorization key
> (KEY_SPEC_REQKEY_AUTH_KEY) is revoked, and the destination
> keyring (KEY_SPEC_REQUESTOR_KEYRING) is no longer accessible
> from the request-key(8) program.
>
> If a key is created, then—regardless of whether it is a valid
> key or a negative key—it will displace any other key with the
> same type and description from the keyring specified in
> dest_keyring.
>
> RETURN VALUE
> On success, request_key() returns the serial number of the key
> it found or caused to be created. On error, -1 is returned and
> errno is set to indicate the cause of the error.
>
> ERRORS
> EACCES The keyring wasn't available for modification by the
> user.
>
> EDQUOT The key quota for this user would be exceeded by creat‐
> ing this key or linking it to the keyring.
>
> EINTR The request was interrupted by a signal; see signal(7).
>
> EINVAL The size of the string (including the terminating null
> byte) specified in type or description exceeded the
> limit (32 bytes and 4096 bytes respectively).
>
> EINVAL The size of the string (including the terminating null
> byte) specified in callout_info exceeded the system page
> size.
>
> EKEYEXPIRED
> An expired key was found, but no replacement could be
> obtained.
>
> EKEYREJECTED
> The attempt to generate a new key was rejected.
>
> EKEYREVOKED
> A revoked key was found, but no replacement could be
> obtained.
>
> ENOKEY No matching key was found.
>
> ENOMEM Insufficient memory to create a key.
>
> VERSIONS
> This system call first appeared in Linux 2.6.10.
>
> CONFORMING TO
> This system call is a nonstandard Linux extension.
>
> NOTES
> No wrapper for this system call is provided in glibc. A wrap‐
> per is provided in the libkeyutils package. When employing the
> wrapper in that library, link with -lkeyutils.
>
> EXAMPLE
> The program below demonstrates the use of request_key(). The
> type, description, and callout_info arguments for the system
> call are taken from the values supplied in the command line
> arguments. The call specifies the session keyring as the tar‐
> get keyring.
>
> In order to demonstrate this program, we first create a suit‐
> able entry in the file /etc/request-key.conf.
>
> $ sudo sh
> # echo 'create user mtk:* * /bin/keyctl instantiate %k %c %S' \
> > /etc/request-keys.conf
> # exit
>
> This entry specifies that when a new "user" key with the prefix
> "mtk:" must be instantiated, that task should be performed via
> the keyctl(1) command's instantiate operation. (The program
> could The arguments supplied to the instantiate operation are:
> the ID of the uninstantiated key (%k); the callout data sup‐
> plied to the request_key() call (%c); and the session keyring
> (%S) of the requestor (i.e., the caller of request)key()).
> i(See request-key.conf(5) for details of these % specifiers.)
>
> Then we run the program and check the contents of /proc/keys to
> verify that the requested kay has been instantiated:
>
> $ ./a.out user mtk:key1 "Payload data"
> $ grep '2dddaf50' /proc/keys
> 2dddaf50 I--Q--- 1 perm 3f010000 1000 1000 user mtk:key1: 12
>
> Program source
> The program below
> #include <sys/types.h>
> #include <keyutils.h>
> #include <stdio.h>
> #include <stdlib.h>
> #include <string.h>
>
> #define errExit(msg) do { perror(msg); exit(EXIT_FAILURE); \
> } while (0)
>
> int
> main(int argc, char *argv[])
> {
> key_serial_t key;
>
> if (argc != 4) {
> fprintf(stderr, "Usage: %s type description callout-data\n",
> argv[0]);
> exit(EXIT_FAILURE);
> }
>
> key = request_key(argv[1], argv[2], argv[3],
> KEY_SPEC_SESSION_KEYRING);
> if (key == -1)
> errExit("request_key");
>
> printf("Key ID is %lx\n", (long) key);
>
> exit(EXIT_SUCCESS);
> }
>
> SEE ALSO
> keyctl(1), add_key(2), keyctl(2), keyctl(3), keyrings(7),
> keyutils(7), capabilities(7), persistent-keyring(7),
> process-keyring(7), session-keyring(7), thread-keyring(7),
> user-keyring(7), user-session-keyring(7), request-key(8)
>
> The kernel source files Documentation/security/keys.txt and
> Documentation/security/keys-request-key.txt.
>
>
>
> Linux 2016-10-08 REQUEST_KEY(2)
>
> --
> Michael Kerrisk
> Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
> Linux/UNIX System Programming Training: http://man7.org/training/
--
Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
Linux/UNIX System Programming Training: http://man7.org/training/
^ permalink raw reply [flat|nested] 29+ messages in thread
* Re: Revised request_key(2) man page for review
@ 2016-12-15 10:10 ` David Howells
0 siblings, 0 replies; 29+ messages in thread
From: David Howells @ 2016-12-15 10:10 UTC (permalink / raw)
To: mtk.manpages; +Cc: dhowells, keyrings, linux-man, Eugene Syromyatnikov, lkml
Michael Kerrisk (man-pages) <mtk.manpages@gmail.com> wrote:
> > │Is 'keyring' allowed to be 0? Reading the source, it │
> > │appears so. In this case, by default, the key is │
> > │assigned to the session keyring. But, the │
> > │KEYCTL_SET_REQKEY_KEYRING also seems to have an │
> > │influence here. What are the details here? │
Yes, the destination keyring can be 0. If you don't specify a destination
keyring, then:
(1) If the key is found to already exist, the serial number is returned, but
no extra link is made.
(2) If an error occurs other than "this key doesn't exist", then you'll just
get the error.
(3) If we have to construct a new key, this will be attached to the default
keyring (as there's no destination keyring to attach to).
> > # echo 'create user mtk:* * /bin/keyctl instantiate %k %c %S' \
> > > /etc/request-keys.conf
There's a /etc/request-keys.d/ directory now.
David
^ permalink raw reply [flat|nested] 29+ messages in thread
* Re: Revised request_key(2) man page for review
@ 2016-12-15 10:10 ` David Howells
0 siblings, 0 replies; 29+ messages in thread
From: David Howells @ 2016-12-15 10:10 UTC (permalink / raw)
To: mtk.manpages-Re5JQEeQqe8AvxtiuMwx3w
Cc: dhowells-H+wXaHxf7aLQT0dZR+AlfA, keyrings-u79uwXL29TY76Z2rM5mHXA,
linux-man, Eugene Syromyatnikov, lkml
Michael Kerrisk (man-pages) <mtk.manpages-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> wrote:
> > │Is 'keyring' allowed to be 0? Reading the source, it │
> > │appears so. In this case, by default, the key is │
> > │assigned to the session keyring. But, the │
> > │KEYCTL_SET_REQKEY_KEYRING also seems to have an │
> > │influence here. What are the details here? │
Yes, the destination keyring can be 0. If you don't specify a destination
keyring, then:
(1) If the key is found to already exist, the serial number is returned, but
no extra link is made.
(2) If an error occurs other than "this key doesn't exist", then you'll just
get the error.
(3) If we have to construct a new key, this will be attached to the default
keyring (as there's no destination keyring to attach to).
> > # echo 'create user mtk:* * /bin/keyctl instantiate %k %c %S' \
> > > /etc/request-keys.conf
There's a /etc/request-keys.d/ directory now.
David
--
To unsubscribe from this list: send the line "unsubscribe linux-man" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 29+ messages in thread
* Re: Revised request_key(2) man page for review
@ 2016-12-17 10:34 ` Michael Kerrisk (man-pages)
0 siblings, 0 replies; 29+ messages in thread
From: Michael Kerrisk (man-pages) @ 2016-12-17 10:34 UTC (permalink / raw)
To: David Howells
Cc: mtk.manpages, keyrings, linux-man, Eugene Syromyatnikov, lkml
Hello David,
On 12/15/2016 11:10 AM, David Howells wrote:
> Michael Kerrisk (man-pages) <mtk.manpages@gmail.com> wrote:
>
>>> │Is 'keyring' allowed to be 0? Reading the source, it │
>>> │appears so. In this case, by default, the key is │
>>> │assigned to the session keyring. But, the │
>>> │KEYCTL_SET_REQKEY_KEYRING also seems to have an │
>>> │influence here. What are the details here? │
>
> Yes, the destination keyring can be 0. If you don't specify a destination
> keyring, then:
>
> (1) If the key is found to already exist, the serial number is returned, but
> no extra link is made.
>
> (2) If an error occurs other than "this key doesn't exist", then you'll just
> get the error.
>
> (3) If we have to construct a new key, this will be attached to the default
> keyring (as there's no destination keyring to attach to).
Okay. Please take a look at the revised text that I'll send out
after applying Eugene's patch. (Mail in a few minutes.)
>>> # echo 'create user mtk:* * /bin/keyctl instantiate %k %c %S' \
>>> > /etc/request-keys.conf
>
> There's a /etc/request-keys.d/ directory now.
Yes, I'm aware. Did you mean I should fix something on this page?
Cheers,
Michael
--
Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
Linux/UNIX System Programming Training: http://man7.org/training/
^ permalink raw reply [flat|nested] 29+ messages in thread
* Re: Revised request_key(2) man page for review
@ 2016-12-17 10:34 ` Michael Kerrisk (man-pages)
0 siblings, 0 replies; 29+ messages in thread
From: Michael Kerrisk (man-pages) @ 2016-12-17 10:34 UTC (permalink / raw)
To: David Howells
Cc: mtk.manpages-Re5JQEeQqe8AvxtiuMwx3w,
keyrings-u79uwXL29TY76Z2rM5mHXA, linux-man, Eugene Syromyatnikov,
lkml
Hello David,
On 12/15/2016 11:10 AM, David Howells wrote:
> Michael Kerrisk (man-pages) <mtk.manpages-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> wrote:
>
>>> │Is 'keyring' allowed to be 0? Reading the source, it │
>>> │appears so. In this case, by default, the key is │
>>> │assigned to the session keyring. But, the │
>>> │KEYCTL_SET_REQKEY_KEYRING also seems to have an │
>>> │influence here. What are the details here? │
>
> Yes, the destination keyring can be 0. If you don't specify a destination
> keyring, then:
>
> (1) If the key is found to already exist, the serial number is returned, but
> no extra link is made.
>
> (2) If an error occurs other than "this key doesn't exist", then you'll just
> get the error.
>
> (3) If we have to construct a new key, this will be attached to the default
> keyring (as there's no destination keyring to attach to).
Okay. Please take a look at the revised text that I'll send out
after applying Eugene's patch. (Mail in a few minutes.)
>>> # echo 'create user mtk:* * /bin/keyctl instantiate %k %c %S' \
>>> > /etc/request-keys.conf
>
> There's a /etc/request-keys.d/ directory now.
Yes, I'm aware. Did you mean I should fix something on this page?
Cheers,
Michael
--
Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
Linux/UNIX System Programming Training: http://man7.org/training/
--
To unsubscribe from this list: send the line "unsubscribe linux-man" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 29+ messages in thread
* Re: Revised request_key(2) man page for review
@ 2016-12-19 8:13 ` David Howells
0 siblings, 0 replies; 29+ messages in thread
From: David Howells @ 2016-12-19 8:13 UTC (permalink / raw)
To: Michael Kerrisk (man-pages)
Cc: dhowells, keyrings, linux-man, Eugene Syromyatnikov, lkml
Michael Kerrisk (man-pages) <mtk.manpages@gmail.com> wrote:
> >>> # echo 'create user mtk:* * /bin/keyctl instantiate %k %c %S' \
> >>> > /etc/request-keys.conf
> >
> > There's a /etc/request-keys.d/ directory now.
>
> Yes, I'm aware. Did you mean I should fix something on this page?
I mean you probably shouldn't modify /etc/request-keys.conf, but rather put
something in the .d dir.
David
^ permalink raw reply [flat|nested] 29+ messages in thread
* Re: Revised request_key(2) man page for review
@ 2016-12-19 8:13 ` David Howells
0 siblings, 0 replies; 29+ messages in thread
From: David Howells @ 2016-12-19 8:13 UTC (permalink / raw)
To: Michael Kerrisk (man-pages)
Cc: dhowells-H+wXaHxf7aLQT0dZR+AlfA, keyrings-u79uwXL29TY76Z2rM5mHXA,
linux-man, Eugene Syromyatnikov, lkml
Michael Kerrisk (man-pages) <mtk.manpages-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> wrote:
> >>> # echo 'create user mtk:* * /bin/keyctl instantiate %k %c %S' \
> >>> > /etc/request-keys.conf
> >
> > There's a /etc/request-keys.d/ directory now.
>
> Yes, I'm aware. Did you mean I should fix something on this page?
I mean you probably shouldn't modify /etc/request-keys.conf, but rather put
something in the .d dir.
David
--
To unsubscribe from this list: send the line "unsubscribe linux-man" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 29+ messages in thread
end of thread, other threads:[~2016-12-20 9:14 UTC | newest]
Thread overview: 29+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-11-04 15:45 Revised request_key(2) man page for review Michael Kerrisk (man-pages)
[not found] ` <528b203d-ac72-e4a6-8517-e8c5c11055a4-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2016-11-21 20:59 ` [PATCH 0/5] " Eugene Syromyatnikov
2016-11-21 22:33 ` Michael Kerrisk (man-pages)
2016-11-21 20:59 ` [PATCH 1/5] request_key.2: add information regarding default keyring Eugene Syromyatnikov
2016-11-21 22:08 ` Michael Kerrisk (man-pages)
2016-11-25 10:01 ` Michael Kerrisk (man-pages)
[not found] ` <54aa766c-25de-74ba-fba5-59cd95b2ae91-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2016-11-25 20:11 ` Eugene Syromyatnikov
2016-12-13 13:20 ` Michael Kerrisk (man-pages)
2016-12-17 12:21 ` Michael Kerrisk (man-pages)
[not found] ` <6df2c812-c2d6-321c-902f-93b4d3aaa953-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2016-12-18 6:40 ` Eugene Syromyatnikov
2016-12-19 8:19 ` David Howells
[not found] ` <15546.1482135577-S6HVgzuS8uM4Awkfq6JHfwNdhmdF6hFW@public.gmane.org>
2016-12-19 8:47 ` Michael Kerrisk (man-pages)
[not found] ` <f06829ea-1d7c-3f9a-1f4b-e6880aacbdc2-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2016-12-19 9:31 ` Eugene Syromyatnikov
2016-12-20 9:14 ` David Howells
2016-11-21 20:59 ` [PATCH 2/5] requesT_key.2: add information regarding minimal kernel version for key instantiation on request Eugene Syromyatnikov
2016-11-21 22:00 ` Michael Kerrisk (man-pages)
2016-11-21 20:59 ` [PATCH 3/5] request_key.2: whitespace fix Eugene Syromyatnikov
2016-11-21 21:59 ` Michael Kerrisk (man-pages)
2016-11-21 21:00 ` [PATCH 4/5] request_key.2: wfix Eugene Syromyatnikov
2016-11-21 21:59 ` Michael Kerrisk (man-pages)
2016-11-21 21:00 ` [PATCH 5/5] request_key.2: additional error information Eugene Syromyatnikov
2016-11-21 22:00 ` Michael Kerrisk (man-pages)
2016-12-14 14:23 ` Revised request_key(2) man page for review Michael Kerrisk (man-pages)
2016-12-15 10:10 ` David Howells
2016-12-15 10:10 ` David Howells
2016-12-17 10:34 ` Michael Kerrisk (man-pages)
2016-12-17 10:34 ` Michael Kerrisk (man-pages)
2016-12-19 8:13 ` David Howells
2016-12-19 8:13 ` David Howells
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.