summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* test: Fix test expectation based on kernel configHEADmasterPavel Reichl2023-03-202-2/+30
| | | | | | | | | | | | | Some test results are dependent on the kernel configuration option CONFIG_SYSTEM_BLACKLIST_AUTH_UPDATE. Check the kernel configuration file for its presence and expect appropriate test results. Function has_kernel_config is based on its xfstsests counterpart. Signed-off-by: Pavel Reichl <preichl@redhat.com> Signed-off-by: David Howells <dhowells@redhat.com>
* keyutils.spec - change the UrlPavel Reichl2023-03-201-2/+2
| | | | | Signed-off-by: Pavel Reichl <preichl@redhat.com> Signed-off-by: David Howells <dhowells@redhat.com>
* Provide a pkgconfig file with libkeyutils.aDaniel Hill2023-03-201-0/+2
| | | | | | Signed-off-by: Daniel Hill <daniel@gluo.nz> Signed-off-by: David Howells <dhowells@redhat.com> Link: https://lore.kernel.org/r/CAMtG=2qKrGC-QzPENXsV8_7VBbi6sEnA6joV=SL8MQP1pfV8KA@mail.gmail.com/
* Fix format specifier for pointer subtractionAlyssa Ross2023-03-201-1/+1
| | | | | | | | | | | | | | | | | | | | Resolves the following compiler error: keyctl_watch.c: In function 'consumer': keyctl_watch.c:177:61: error: format '%zx' expects argument of type 'size_t', but argument 3 has type 'int' [-Werror=format=] 177 | fprintf(stderr, "NOTIFY[%03zx]: ty=%06x sy=%02x i=%08x\n", | ~~~~^ | | | long unsigned int | %03x 178 | p - buffer, n.n.type, n.n.subtype, n.n.info); | ~~~~~~~~~~ | | | int Signed-off-by: Alyssa Ross <hi@alyssa.is> Signed-off-by: David Howells <dhowells@redhat.com> Link: https://lore.kernel.org/r/20230301134250.301819-1-hi@alyssa.is/
* man: fix a formatting on the keyctl.1 man pageVladis Dronov2023-03-201-2/+3
| | | | | | | | | Fix a formatting and a command output on the keyctl.1 man page in a couple of places. Signed-off-by: Vladis Dronov <vdronov@redhat.com> Signed-off-by: David Howells <dhowells@redhat.com> Link: https://lore.kernel.org/r/20220510110444.14192-1-vdronov@redhat.com/
* Ignore the cxx.stamp fileDavid Howells2023-03-201-0/+1
| | | | | | Ignore the cxx.stamp file created during the build. Signed-off-by: David Howells <dhowells@redhat.com
* Move to version 1.6.3v1.6.3David Howells2020-07-071-1/+5
|
* Add the ability to supply filters to watches set with keyctlDavid Howells2020-07-077-24/+276
| | | | | | | Add the ability to supply filters to watches set with "keyctl watch" and "keyctl watch_session". Signed-off-by: David Howells <dhowells@redhat.com>
* test: Use notifications in testingDavid Howells2020-07-072-20/+348
| | | | | | | Make the testing infrastructure do automatic checking for notifications as tests manipulate keys. Signed-off-by: David Howells <dhowells@redhat.com>
* Add a notification facility for watching for key changesDavid Howells2020-07-0712-9/+970
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add keyctl commands and library functions to handle the setting and removal of watches on keys for notifications of change events. Five keyctl commands are defined: (1) keyctl watch <key> Watch the specified key for changes, logging notifications to stdout. (2) keyctl watch_session [-n <name>] <notifylog> <gclog> <fd> prog [<arg>...] Create a new session keyring and attach a watch to it that an auxiliary logging process monitors. The nominated program is run with the session program with the arguments given. The session keyring can be given a name. The logging process will log synchronous events to file notifylog and asynchronous events to file gclog. The specified file descriptor will be attached to the watch_queue and left open across the exec. This can be made use of by the next few commands. (3) keyctl watch_add <fd> <key> (4) keyctl watch_rm <fd> <key> Add/remove a watch on the specified key to/from the given watch_queue derived from watch_session. (5) keyctl watch_sync <fd> Wait for the logging process that's watching the given watch_queue to synchronise. Commands (2) to (5) are primarily provided for the testsuite's purposes. Signed-off-by: David Howells <dhowells@redhat.com>
* Revert "Add a notification facility for watching for key changes"David Howells2020-07-0712-963/+9
| | | | | | | This reverts commit 1aafbdcf1d60c5c9eb34fe404f9a9195c8ea415e which was from the wrong branch and expects /dev/watch_queue to be available. Signed-off-by: David Howells <dhowells@redhat.com>
* Revert "test: Use notifications in testing"David Howells2020-07-072-348/+20
| | | | | | | This reverts commit 9419ac428efe8385cb2c19680d6b90c90e5335d1 which was from the wrong branch and expects /dev/watch_queue to be available. Signed-off-by: David Howells <dhowells@redhat.com>
* Revert "Add the ability to supply filters to watches set with keyctl"David Howells2020-07-076-269/+23
| | | | | | | This reverts commit 5ac409b01cc4fcb69d903408da90df2d34d4f32a which was from the wrong branch and expects /dev/watch_queue to be available. Signed-off-by: David Howells <dhowells@redhat.com>
* Version 1.6.2v1.6.2David Howells2020-07-061-1/+13
|
* Build: Remove libkeyutils.pc on make cleanDavid Howells2020-07-061-1/+1
| | | | Signed-off-by: David Howells <dhowells@redhat.com>
* Fix error when a C++ program is linked with libkeyutilsChristophe Vu-Brugier2020-07-061-0/+8
| | | | | | | | Declare all the functions as extern "C" in keyutils.h to instruct a C++ compiler that these functions are not mangled. Signed-off-by: Christophe Vu-Brugier <cvubrugier@fastmail.fm> Signed-off-by: David Howells <dhowells@redhat.com>
* Check that keyutils.h has valid C++ syntax at build timeChristophe Vu-Brugier2020-07-061-1/+15
| | | | | Signed-off-by: Christophe Vu-Brugier <cvubrugier@fastmail.fm> Signed-off-by: David Howells <dhowells@redhat.com>
* Fix compilation error when keyutils.h is used in C++Christophe Vu-Brugier2020-07-062-3/+3
| | | | | | | | | | | | | | The declaration of the keyctl_dh_compute_kdf() function contains a parameter named "private". Unfortunately, "private" is a C++ reserved keyword. As a consequence, compiling a C++ program that includes keyutils.h fails. This patch renames the "private" variable to "priv" since a similar parameter is named this way in the nearby keyctl_dh_compute() function. Signed-off-by: Christophe Vu-Brugier <cvubrugier@fastmail.fm> Signed-off-by: David Howells <dhowells@redhat.com>
* man: fix typosChristophe Vu-Brugier2020-07-0611-16/+12
| | | | | Signed-off-by: Christophe Vu-Brugier <cvubrugier@fastmail.fm> Signed-off-by: David Howells <dhowells@redhat.com>
* Add the ability to supply filters to watches set with keyctlDavid Howells2020-07-066-23/+269
| | | | | | | Add the ability to supply filters to watches set with "keyctl watch" and "keyctl watch_session". Signed-off-by: David Howells <dhowells@redhat.com>
* test: Use notifications in testingDavid Howells2020-07-062-20/+348
| | | | | | | Make the testing infrastructure do automatic checking for notifications as tests manipulate keys. Signed-off-by: David Howells <dhowells@redhat.com>
* Add a notification facility for watching for key changesDavid Howells2020-07-0612-9/+963
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add keyctl commands and library functions to handle the setting and removal of watches on keys for notifications of change events. Five keyctl commands are defined: (1) keyctl watch <key> Watch the specified key for changes, logging notifications to stdout. (2) keyctl watch_session [-n <name>] <notifylog> <gclog> <fd> prog [<arg>...] Create a new session keyring and attach a watch to it that an auxiliary logging process monitors. The nominated program is run with the session program with the arguments given. The session keyring can be given a name. The logging process will log synchronous events to file notifylog and asynchronous events to file gclog. The specified file descriptor will be attached to the watch_queue and left open across the exec. This can be made use of by the next few commands. (3) keyctl watch_add <fd> <key> (4) keyctl watch_rm <fd> <key> Add/remove a watch on the specified key to/from the given watch_queue derived from watch_session. (5) keyctl watch_sync <fd> Wait for the logging process that's watching the given watch_queue to synchronise. Commands (2) to (5) are primarily provided for the testsuite's purposes. Signed-off-by: David Howells <dhowells@redhat.com>
* lib: Open version KEYUTILS_1.10David Howells2020-07-062-1/+5
| | | | | | Open API version KEYUTILS_1.10 in the shared library. Signed-off-by: David Howells <dhowells@redhat.com>
* dns: Apply a default TTL to records obtained from getaddrinfo()David Howells2020-07-066-25/+277
| | | | | | | | | | | | | | | | | | | | Address records obtained from getaddrinfo() don't come with any TTL information, even if they're obtained from the DNS, with the result that key.dns_resolver upcall program doesn't set an expiry time on dns_resolver records unless they include a component obtained directly from the DNS, such as an SRV or AFSDB record. Fix this to apply a default TTL of 10mins in the event that we haven't got one. This can be configured in /etc/keyutils/key.dns_resolver.conf by adding the line: default_ttl = <number-of-seconds> to the file. Signed-off-by: David Howells <dhowells@redhat.com> Reviewed-by: Ben Boeckel <me@benboeckel.net> Reviewed-by: Jeff Layton <jlayton@kernel.org>
* Makefile: Use rpmspec to calculate package nameDavid Howells2020-05-181-6/+6
| | | | | | | Use the rpmspec program to calculate the package name rather than trying to substitute macros that keep changing. Signed-off-by: David Howells <dhowells@redhat.com>
* man: the info strings are actually space or tab separatedBen Boeckel2020-05-183-5/+5
| | | | | Signed-off-by: Ben Boeckel <mathstuf@gmail.com> Signed-off-by: David Howells <dhowells@redhat.com>
* man: clarify that keyctl_set_reqkey_keyring(3) returns the old defaultBen Boeckel2020-05-181-2/+2
| | | | | | | | The prose mentions this, but the return value section gave conflicting information. Signed-off-by: Ben Boeckel <mathstuf@gmail.com> Signed-off-by: David Howells <dhowells@redhat.com>
* keyctl: try to wipe keys from memory after useMaciej S. Szmigiero2019-10-311-7/+41
| | | | | | | | | | | | | | The key being added or updated likely contains secrets so it would be best not to leave it in memory or in a core dump when no longer needed. Glibc 2.25+ provides the explicit_bzero() function that can be used for this purpose, let's utilize it if it is present. Tested by redefining exit(n) to abort() and inspecting the resulting core file for key data. Signed-off-by: Maciej S. Szmigiero <mail@maciej.szmigiero.name> Signed-off-by: David Howells <dhowells@redhat.com>
* tests: Use hex input for keyctl/dh_compute/bad-argsDavid Howells2019-09-041-41/+41
| | | | | | | Use keyctl add's hex input capability for keyctl/dh_compute/bad-args rather than an "echo -e | keyctl padd" construct. Signed-off-by: David Howells <dhowells@redhat.com>
* tests/search: test a found key without search permissionsBen Boeckel2019-09-041-5/+29
| | | | | | | | | | | | | | These stanzas were essentially duplicates of the previous blocks. Fix them to test first disabling Search on the first keyring and then the second keyring. Also add disabling of Search on the target key and checking searches from the session keyring. [DH: Modified to fix the searches and add Ben's change as a separate test in its own right] Signed-off-by: Ben Boeckel <mathstuf@gmail.com> Signed-off-by: David Howells <dhowells@redhat.com>
* tests/search: test searching with a mismatched typeBen Boeckel2019-09-041-0/+5
| | | | | | | This should fail because the actually found key has a type mismatch. Signed-off-by: Ben Boeckel <mathstuf@gmail.com> Signed-off-by: David Howells <dhowells@redhat.com>
* tests/reading: fix test commentBen Boeckel2019-09-041-1/+1
| | | | | | | | This comment was copied from another test. This one actually fails because search permissions were also removed. Signed-off-by: Ben Boeckel <mathstuf@gmail.com> Signed-off-by: David Howells <dhowells@redhat.com>
* test/instantiating: test bad arguments for `keyctl reject`Ben Boeckel2019-09-042-0/+36
| | | | | Signed-off-by: Ben Boeckel <mathstuf@gmail.com> Signed-off-by: David Howells <dhowells@redhat.com>
* tests/instantiating: test the unlinked keyidBen Boeckel2019-09-041-3/+3
| | | | | | | | Testing the `0` ID just repeats the "BAD KEY" tests at the beginning of the file. Signed-off-by: Ben Boeckel <mathstuf@gmail.com> Signed-off-by: David Howells <dhowells@redhat.com>
* tests/timeout: test actions on an expired keyring as wellBen Boeckel2019-09-041-0/+15
| | | | | Signed-off-by: Ben Boeckel <mathstuf@gmail.com> Signed-off-by: David Howells <dhowells@redhat.com>
* tests: fix typos in test commentsBen Boeckel2019-09-049-11/+11
| | | | | Signed-off-by: Ben Boeckel <mathstuf@gmail.com> Signed-off-by: David Howells <dhowells@redhat.com>
* keyctl: unify spelling of "unparsable"Ben Boeckel2019-09-041-3/+3
| | | | | | | | Both spelling seems to be accepted, but the majority of uses agreed on the "unparsable" variant. Signed-off-by: Ben Boeckel <mathstuf@gmail.com> Signed-off-by: David Howells <dhowells@redhat.com>
* tests: remove some trailing whitespaceBen Boeckel2019-09-044-15/+15
| | | | | Signed-off-by: Ben Boeckel <mathstuf@gmail.com> Signed-off-by: David Howells <dhowells@redhat.com>
* tests: fix some typos in marker linesBen Boeckel2019-09-041-1/+1
| | | | | Signed-off-by: Ben Boeckel <mathstuf@gmail.com> Signed-off-by: David Howells <dhowells@redhat.com>
* tests/toolbox: detect endianness with PIE executablesBen Boeckel2019-09-041-2/+2
| | | | | Signed-off-by: Ben Boeckel <mathstuf@gmail.com> Signed-off-by: David Howells <dhowells@redhat.com>
* test: Fold expect_keyid into create_key and suchlikeDavid Howells2019-09-0451-468/+559
| | | | | | | | Fold the use of expect_keyid into create_key and suchlike to make it easier to integrate notification checks into the existing superstructure, thereby making them happen automatically rather than having to manually code them. Signed-off-by: David Howells <dhowells@redhat.com>
* rpm: Fix version determination for "make rpm"David Howells2019-09-041-5/+9
| | | | | | | Fix the determination of the version string for "make rpm" by making sure that all otherwise unhandled %{...} variable substitutions get deleted. Signed-off-by: David Howells <dhowells@redhat.com>
* Fix the guess for the default LIBDIRDavid Howells2019-09-041-1/+1
| | | | | | | | | | | The guesser for the default LIBDIR examines the libraries used by make, looking for libc. Make uses libcrypt as well as libc, so if libcrypt happens to come first, that matches and the sed command to extract the library path fails. Fix this by looking for a match on "libc." instead of "libc". Signed-off-by: David Howells <dhowells@redhat.com>
* test: Test trusted keyring featuresDavid Howells2019-08-191-0/+101
| | | | | | Test kernel features like the builtin trusted keyring. Signed-off-by: David Howells <dhowells@redhat.com>
* test: Use hex-converting padd for dh_compute testsDavid Howells2019-08-191-124/+124
| | | | | | Use hex-converting padd to load data for dh_compute tests. Signed-off-by: David Howells <dhowells@redhat.com>
* keyctl: Allow add, padd and suchlike to take hex-encoded dataDavid Howells2019-08-198-36/+202
| | | | | | | | | | | | | Allow add, padd, update, pupdate, instantiate, pinstantiate and dh_compute_kdf_oi to take hex-encoded data which is then converted into binary before being passed to the kernel, e.g.: $ keyctl add -x user foo 686578 @s $ echo 686578 | keyctl padd -x user foo @s This makes it easier to stash data in scripts. Signed-off-by: David Howells <dhowells@redhat.com>
* test: Check that KEYCTL_SESSION_TO_PARENT worksDavid Howells2019-08-192-0/+68
| | | | | | Check that the KEYCTL_SESSION_TO_PARENT keyctl function works. Signed-off-by: David Howells <dhowells@redhat.com>
* Allow keyctl new_session to name the session keyringDavid Howells2019-08-192-6/+9
| | | | | | | | | | Allow "keyctl new_session" to name the session keyring it creates and attaches to the parent: $ keyctl new_session fred 52095209 Signed-off-by: David Howells <dhowells@redhat.com>
* Add a symbolic ID to numeric ID keyctl commandDavid Howells2019-08-196-0/+176
| | | | | | | | | | | | | Add a keyctl command to look up a symbolic key ID (such as "@s") or a named reference (such as "%user:foo") and return the numeric ID for the key or keyring, eg: $ keyctl id @s 259509209 The command will also just convert numeric IDs to themselves. Signed-off-by: David Howells <dhowells@redhat.com>
* Put the keyctl get_persistent command in the right orderDavid Howells2019-08-191-1/+1
| | | | | | | Put the keyctl get_persistent command in the right place in the alphabetic command order. Signed-off-by: David Howells <dhowells@redhat.com>
View Lorry Controller Status