SSSD / sssd

#2268 use keycreatecon when adding keys to the kernel keyring
Closed: Invalid Opened by jhrozek.

Closed: Invalid
Reopen Issue

Ticket was cloned from Red Hat Bugzilla (product Red Hat Enterprise Linux 7): Bug 1072615

There exists kernel functionality allowing a userspace daemon to determine the
label on a key that is about to be created.  It is called 'setkeycreatecon'
After the kernel adds support to allow for the label on keys to be determined
by policy, sssd should make use of this (along with obviously knowledge of the
label on the process expected to use the key [haha, maybe this is the hard
part]) to make sure that keys is creates are done so in the right type.
This would stop sshd_t from needing to be able to manage sssd_t keys.  As both
would be allowed to manage user_key_t and sssd would be sure to create keys to
be used by users in that type...
I think details and example code will only make sense after BZ 1072613 is
complete.

Fields changed

blockedby: =>
blocking: =>
changelog: =>
coverity: =>
design: =>
design_review: => 0
feature_milestone: =>
fedora_test_page: =>
milestone: NEEDS_TRIAGE => SSSD 1.12 beta
review: True => 0
selected: =>
testsupdated: => 0

Need to find out from Eric if this is still worth pursuing.

milestone: SSSD 1.12 beta => NEEDS_TRIAGE

Related bugzilla ticket was closed with status WONTFIX.

resolution: => wontfix
status: new => closed

Metadata Update from @jhrozek:
- Issue set to the milestone: NEEDS_TRIAGE

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/3310

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.
Metadata
None
None
None
None
Normal
defect
SSSD
None
None
0
0
https://bugzilla.redhat.com/show_bug.cgi?id=1072615
0
0
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.