On Mon, Jul 22, 2024 at 2:15 PM Nikita Krasnov <nikita.nikita.kras...@gmail.com> wrote: > > Well, both actually. If that's possible, I would prefer to keep my > service files intact (some of them are inside > "/usr/lib/systemd/system" and some are inside "/usr/lib/systemd/user") > and only alter the one that creates the key inside the keyring. The > directory is decrypted transparently if the key is present inside the > keyring. I would like to keep this behavior. >
For user services the default (KeyringMode=inherit) should just work. For system services - I do not know. Putting systemd aside - how is it possible to add a key that is accessible by any other process on the system? > Offtopic. Should I use "Reply All" or "Reply" to answer to messages on > this list? Sorry if I accidentally pinged a lot of people right now or > created a new thread, I'm new on this mailing list. > I personally do not care :) > > пн, 22 июл. 2024 г. в 13:42, Andrei Borzenkov <arvidj...@gmail.com>: > > > > > On Mon, Jul 22, 2024 at 12:18 PM Nikita Krasnov > > <nikita.nikita.kras...@gmail.com> wrote: > > > > > > I am working with kernel keyring (`e4crypt` tool stores its keys there). > > > The end goal, basically, is there is one service that decrypts a folder > > > (creates a key in the kernel keyring) and then every service has access > > > to that key, thus having access to the encrypted folder. > > > > > > > Are you talking about system or user services? > > > > > For some reason systemd doesn't share kernel keyrings between services. > > > Service A launches a script that creates a key and then it's nowhere to > > > be found inside service B (running `keyctl show` there doesn't show the > > > key). > > > > > > I've tried running `keyctl setperm $KEY_ID 0x3f3f3f3f` (giving everyone > > > all writes to the key) but to no avail. > > > > > > I've found systemd has a `KeyringMode=shared` option, so I've added > > > `User=root` and `KeyringMode=shared` to both A and B service files. > > > Unfortunately, this had no effect. The keyring of service B is still > > > empty when it launches. > > > > > > Running `keyctl show` inside A and B gives this. Service A output: > > > ``` > > > Session Keyring > > > 275477083 --alswrv 0 0 keyring: _ses > > > 511348864 ----s-rv 0 0 \_ user: invocation_id > > > 916643668 --alswrv 0 0 \_ logon: ext4:018b44e44e88466a > > > ``` > > > > > > Service B output: > > > ``` > > > Session Keyring > > > 922937713 --alswrv 100000 100000 keyring: _ses > > > 91724620 --alswrv 100000 65534 \_ keyring: _uid.100000 > > > ``` > > > > > > This output is when not using `User=root` and `KeyringMode=shared` since > > > adding this to every service file isn't feasible (and I also can't have > > > everything running as root). > > > > > > -- > > > Sincerely, Nikita Krasnov
