Ubuntu
keyutils package

  1. Bug #400484
  2. Comment #11

Comment 11 for bug 400484

Revision history for this message
David Howells (dhowells) wrote :

> kirkland@t61p:~$ keyctl show
> Session Keyring
> -3 --alswrv 1000 -1 keyring: _uid_ses.1000
> 698440950 --alswrv 1000 -1 \_ keyring: _uid.1000
> 575594151 --alswrv 1000 0 \_ user: 67354f2e3a6c1216
> 940463712 --alswrv 1000 0 \_ user: 1cb12fd405033223

Interesting. You shouldn't have seen this at all. PAM should have given you your own session keyring when you logged in, which should be called "_ses". "_uid_ses.<UID>" is the backup session keyring you fall back to if you don't get a session keyring for some reason.

PAM (pam_keyinit.so) should then make a link to the user keyring in the session keyring. This is done in userspace, not in the kernel.

Can you try stracing "su - kirkland" from root? I see:

keyctl(0x1, 0, 0xffffffffffffffff, 0xfcb, 0) = 355497645
keyctl(0x8, 0xfffffffc, 0xfffffffd, 0, 0x1132700) = 0

which is KEYCTL_JOIN_SESSION_KEYRING followed by KEYCTL_LINK.

David