From 74dd6b515fa968c5710b396a7664cac335e25ca8 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Fri, 2 Dec 2016 01:54:41 +0100 Subject: core: run each system service with a fresh session keyring This patch ensures that each system service gets its own session kernel keyring automatically, and implicitly. Without this a keyring is allocated for it on-demand, but is then linked with the user's kernel keyring, which is OK behaviour for logged in users, but not so much for system services. With this change each service gets a session keyring that is specific to the service and ceases to exist when the service is shut down. The session keyring is not linked up with the user keyring and keys hence only search within the session boundaries by default. (This is useful in a later commit to store per-service material in the keyring, for example the invocation ID) (With input from David Howells) --- src/core/execute.h | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) (limited to 'src/core/execute.h') diff --git a/src/core/execute.h b/src/core/execute.h index 951c8f4da3..b376a6db55 100644 --- a/src/core/execute.h +++ b/src/core/execute.h @@ -228,12 +228,13 @@ typedef enum ExecFlags { EXEC_APPLY_PERMISSIONS = 1U << 0, EXEC_APPLY_CHROOT = 1U << 1, EXEC_APPLY_TTY_STDIN = 1U << 2, + EXEC_NEW_KEYRING = 1U << 3, /* The following are not used by execute.c, but by consumers internally */ - EXEC_PASS_FDS = 1U << 3, - EXEC_IS_CONTROL = 1U << 4, - EXEC_SETENV_RESULT = 1U << 5, - EXEC_SET_WATCHDOG = 1U << 6, + EXEC_PASS_FDS = 1U << 4, + EXEC_IS_CONTROL = 1U << 5, + EXEC_SETENV_RESULT = 1U << 6, + EXEC_SET_WATCHDOG = 1U << 7, } ExecFlags; struct ExecParameters { -- cgit v1.2.3-54-g00ecf