On 24.08.21 17:23, Tim Harvey wrote:

On Tue, Aug 24, 2021 at 12:33 AM Ahmad Fatoum [off-list ref] wrote:

quoted

On 23.08.21 19:50, Tim Harvey wrote:

quoted

On Mon, Aug 23, 2021 at 6:29 AM Ahmad Fatoum [off-list ref] wrote:

quoted

On 20.08.21 23:19, Tim Harvey wrote:

quoted

On Fri, Aug 20, 2021 at 1:36 PM Ahmad Fatoum [off-list ref] wrote:

quoted

On 20.08.21 22:20, Tim Harvey wrote:

It works for a user keyring but not a session keyring... does that
explain anything?
# keyctl add trusted mykey 'new 32' @u
941210782
# keyctl print 941210782
83b7845cb45216496aead9ee2c6a406f587d64aad47bddc539d8947a247e618798d9306b36398b5dc2722a4c3f220a3a763ee175f6bd64758fdd49ca4db597e8ce328121b60edbba9b8d8d55056be896
# keyctl add trusted mykey 'new 32' @s
310571960
# keyctl print 310571960
keyctl_read_alloc: Unknown error 126

Both sequences work for me.

My getty is started by systemd. I think systemd allocates a new session
keyring for the getty that's inherited by the shell and the commands I run
it in. If you don't do that, each command will get its own session key.

quoted

Sorry, I'm still trying to wrap my head around the differences in
keyrings and trusted vs user keys.

No problem. HTH.

Ahmad,

Ok that explains it - my testing is using a very basic buildroot
ramdisk rootfs. If I do a 'keyctl new_session' first I can use the
system keyring fine as well.

Great. Does this mean I can get your Tested-by: ? :)

Absolutely,

For the series:

I tested this series on top of v5.14.rc-7 on a Gateworks
imx8mm-venice-gw73xx board with kernel param trusted.source=caam and
keyutils-1.6:
# keyctl new_session
22544757
# keyctl add trusted mykey 'new 32' @s
160701809
# keyctl print 160701809
990e03aa4515aee420eede17e26a58d0c5568c8bd2c9c2ee2f22a0583181d20d4f65cf9cb1f944a3cc92c0e3184a44a29a7e511f0a55a6af11a70ac2b2924514002475e73ae09820042896b9ee00a5ec

Tested-By: Tim Harvey <tharvey@gateworks.com>

Thanks. I'll apply it to the whole series then.

One more question: I've got a user that wants to blob/deblob generic
data. They can use the caam_encap_blob/caam_decap_blob functions in
kernel code but could you give me a suggestion for how they could use
this in:
a) userspace code (using the keyctl syscall I assume)
b) userspace cmdline (via keyutils I assume)

Trusted keys aren't disclosed to userspace in plain text, only in sealed
form (bar vulnerabilities of course).

Cheers,
Ahmad

Many thanks,

Tim

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |