Keyrings Archive mirror
 help / color / mirror / Atom feed

From: Linus Heckemann <linus@schreibt.jetzt>
To: keyrings@vger.kernel.org
Cc: maximilian@mbosch.me
Subject: Allowing empty keys? or: setting attributes on keys safely
Date: Sat, 17 Feb 2024 19:20:10 +0100	[thread overview]
Message-ID: <ygar0hbrm05.fsf@localhost> (raw)

Hi all,

We've been fiddling with the keyring functionality; I want to set up a
key with an expiry time safely -- i.e. the key data should never be
loaded without the expiry time being set.

I'd expect that I could create a user key with an empty payload, e.g.

add_key("user", "some-key", NULL, 0, KEY_SPEC_SESSION_KEYRING);

or

add_key("user", "some-key", "", 0, KEY_SPEC_SESSION_KEYRING);

in order to use keyctl_set_timeout to apply a timeout _before_ the
payload is populated using keyctl_update. However, both of these add_key
calls return -EINVAL.

I found [1] which removed documentation that suggested that this would
be allowed, but the reason for not allowing an empty payload is unclear
to me; I think it would make sense for my exact use case, and placing a
dummy nonempty payload in the keyring first seems like it would be more
semantically weird and painful to deal with when reading from the keyring.

Is there any reason why this restriction is in place, and is there a
more sensible way to apply the timeout before a payload is loaded?

Cheers
Linus

[1]: https://lore.kernel.org/all/alpine.LNX.2.00.1603281843250.15978@sisyphus/

next             reply	other threads:[~2024-02-17 18:29 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-02-17 18:20 Linus Heckemann [this message]
2024-02-19 19:47 ` Allowing empty keys? or: setting attributes on keys safely Jarkko Sakkinen
2024-02-20  9:28   ` Linus Heckemann
2024-02-20 17:49     ` Jarkko Sakkinen
2024-02-20 17:52       ` Jarkko Sakkinen
2024-03-23 13:44   ` Maximilian Bosch

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=ygar0hbrm05.fsf@localhost \
    --to=linus@schreibt.jetzt \
    --cc=keyrings@vger.kernel.org \
    --cc=maximilian@mbosch.me \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).