[Freeipa-devel] [PATCH] 439 Allow kernel keyring CCACHE when supported

[Petr Viktorin]

On 12/02/2013 02:01 PM, Martin Kosek wrote:
> On 12/02/2013 01:58 PM, Petr Viktorin wrote:
>> On 11/29/2013 01:48 PM, Martin Kosek wrote:
>>> On 11/19/2013 12:35 PM, Petr Viktorin wrote:
>>>> On 11/05/2013 07:22 PM, Martin Kosek wrote:
>>>>> Server and client installer should allow kernel keyring ccache when
>>>>> supported.
>>
>>>>
>>>> How do I enable the kernel keyring? On f20 I get this:
>>>>
>>>> 2013-11-19T11:28:07Z DEBUG Starting external process
>>>> 2013-11-19T11:28:07Z DEBUG args=keyctl get_persistent @s 0
>>>> 2013-11-19T11:28:07Z DEBUG Process finished, return code=1
>>>> 2013-11-19T11:28:07Z DEBUG stdout=
>>>> 2013-11-19T11:28:07Z DEBUG stderr=keyctl_get_persistent: Key has been revoked
>>>
>>> It should be enabled out of the box. But there were some initial issues with
>>> persistent keyring in the first versions of kernel with a support, hopefully
>>> this was just a fluke which disappeared.
>>>
>>> This is what I see on my F20 with kernel-3.11.9-300.fc20.x86_64:
>>>
>>> # keyctl get_persistent @s 0
>>> 637466038
>>
>> With kernel-3.11.10-300.fc20.x86_64, I get an error again:
>> $ keyctl get_persistent @s 0
>> keyctl_get_persistent: Key has been revoked
>
> Not sure if it is a typo, but you won't surely get a root's keyring as a
> non-root user...

It is just a typo, but it looks like you got me on the right track. 
keyctl apparently needs a real root login:

$ sudo keyctl get_persistent @s 0
keyctl_get_persistent: Key has been revoked

$ sudo su
# keyctl get_persistent @s 0
keyctl_get_persistent: Key has been revoked
# exit

$ sudo su -
Last login: Mon Dec  2 14:09:36 CET 2013 on pts/1
# keyctl get_persistent @s 0
968622527
# logout


Unsurprisingly, when ipa-server-install is run from sudo, it complains 
that the key is unsupported. From a root login all is OK.

Is that expected?

-- 
Petr³