Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[question] user keyring still linked to root keyring after fscrypt purge command #60

Closed
ghost opened this issue Sep 8, 2017 · 1 comment
Labels

Comments

@ghost
Copy link

ghost commented Sep 8, 2017

I noticed that fscrypt purge correctly clear user keyring but it keeps it linked to root keyring

Before user unlocks encrypted directory:

# keyctl show
Session Keyring
 500577725 --alswrv      0     0  keyring: _ses
 749555953 --alswrv      0 65534   \_ keyring: _uid.0

After user unlocks encrypted directory:

# keyctl show
Session Keyring
 500577725 --alswrv      0     0  keyring: _ses
 749555953 --alswrv      0 65534   \_ keyring: _uid.0
 173465956 ---lswrv   1001 65534       \_ keyring: _uid.1001
 462364131 --alsw-v   1001  1001           \_ logon: ext4:949471831dcf55cf

After fscrypt purge / --force --user=user1

# keyctl show
Session Keyring
 500577725 --alswrv      0     0  keyring: _ses
 749555953 --alswrv      0 65534   \_ keyring: _uid.0
 173465956 ---lswrv   1001 65534       \_ keyring: _uid.1001

Is it correct behavior? I think it should be back to clean state which means unlinking user keyring from root keyring.

@ebiggers
Copy link
Collaborator

I'm considering this to be WONTFIX, since fscrypt using the user keyrings is deprecated. New systems set up with a recent version of fscrypt and a recent kernel use filesystem-level keyrings instead of the user keyrings; on such systems, fscrypt won't link user keyrings into root's user keyring anymore. Also this question never really made sense in the first place given that fscrypt purge is a per-filesystem thing, but the user keyrings are a per-user thing.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants