Dinesh, That's linking the key to the session keyring. Also because you're adding keys in a subprocess you do need to take care with setting correct permissions on the key.
What does keyctl show @us say? -Sietse -----Original Message----- From: Dinesh Prasanth Moluguwan Krishnamoorthy <dmolu...@redhat.com> Sent: Thursday, 6 December, 2018 23:21 To: Sietse van Zanen <sie...@wizdom.nu>; systemd-devel@lists.freedesktop.org Subject: Re: [systemd-devel] Systemd and kernel keyring Hi Sietse, I tried doing that, but I wasn't able to link it: [pkiuser@localhost] $ keyctl show @u Keyring 461086211 --alswrv 17 65534 keyring: _uid.3 189019025 --alswrv 17 17 \_ user: nuxwdog:user [pkiuser@localhost] $ keyctl link 189019025 @s keyctl_link: Permission denied I achieve 2 by doing a subprocess call that runs `keyctl add user <key Desc> <password> @u` Regards, Dinesh On Thu, 2018-12-06 at 11:57 +0000, Sietse van Zanen wrote: > Hi Dinesh, > > Did you do a 'keyctl link @us @s' after logging in? > > And could you tell me how you aceive 2. Because according to > documentation it is not possible to have systemd-ask-password insert a > key into a users keylist: > --keyname= > Configure a kernel keyring key name to use as cache for the > password. If set, then the tool will try to push any collected > passwords into the > kernel keyring of the root user > > -Sietse > ________________________________________ > From: systemd-devel <systemd-devel-boun...@lists.freedesktop.org> on > behalf of Dinesh Prasanth Moluguwan Krishnamoorthy < > dmolu...@redhat.com> > Sent: Thursday, December 6, 2018 04:11 > To: systemd-devel@lists.freedesktop.org > Subject: [systemd-devel] Systemd and kernel keyring > > Hi team, > > I'm working on accessing kernel keyring in my application started > using systemd. > > The list of steps I'm doing: > > 1. Starting a systemd service with `KeyringMode=shared` as a SPECIFIC > USER 2. In the `ExecStartPre`, I'm launching a subprocess that invokes > `systemd-ask-password` to accept the input and store it in the USER's > kernel keyring 3. In the main program started using `ExecStart`, I'm > accessing the value stored in the keyring > > I'm able to access the values from my main program -- everything works > as expected! When I try to login as that specific user and do a > `keyctl show @u`, I find the entry. > > However, when I try to do `keyctl print <keyID>`, it throws > "Permission Denied" error. IIUC, this protects the keys in the keyring > from accessing outside the systemd service. Is it the desired > behaviour? > > I have the sample systemd unit file available in [1]. > > [1] > https://github.com/SilleBille/keyctl-java-test/blob/master/pki-tomcatd-nuxwdog%40pki-tomcat.service > > Thanks, > Dinesh > > _______________________________________________ > systemd-devel mailing list > systemd-devel@lists.freedesktop.org > https://lists.freedesktop.org/mailman/listinfo/systemd-devel _______________________________________________ systemd-devel mailing list systemd-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/systemd-devel