linuxgolinux-kernelkeyring

What Does "user" Scope Mean in Linux Kernel Keyring (Golang)?


Since the official documentation for this Go package is scarce on details, I'd like to know what "user" scope means exactly on this page ?
Does it mean the secret is stored for the lifetime of the UID i.e. as long as the user exists or does it mean the key can be created, updated and read by userspace programs as described here ?

Based on a very simple test, I noticed that whenever I reboot my Linux VM, the keyring is also wiped off, it isn't persisted anywhere, that means it doesn't last as long as the UID exists.


Solution

  • It refers to the "user" keyring, one of the "anchoring keyrings" that can be used through the Linux kernel keyring API. This is documented by man 7 keyrings (see the section "Anchoring keys") and also man 7 user-keyring.

    This seems to be what the library you are referring to uses. It imports github.com/99designs/keyring (as you can see here), which uses KEY_SPEC_USER_KEYRING for internal operations through keyctl and similar syscalls (as you can see here).

    I noticed that whenever I reboot my Linux VM, the keyring is also wiped off, it isn't persisted anywhere

    Yes, this is intended. That's how the API works. Keys anchored to the "user" keyring for a specific UID will last as long as there is at least one process running with that real UID or as long as any files opened by such a process remain open. Everything sits in RAM and is wiped off regardless when the system is rebooted or powered off.