Bug 2044486

Summary:	[spec] keyctl read or revoke fail with access denied , when try to retrive the previous key added from the same user
Product:	Red Hat Enterprise Linux 9	Reporter:	Giancarlo del Rossi <gdelross>
Component:	systemd	Assignee:	Jan Macku <jamacku>
Status:	CLOSED ERRATA	QA Contact:	Frantisek Sumsal <fsumsal>
Severity:	medium	Docs Contact:
Priority:	high
Version:	9.2	CC:	amdas, dhowells, dtardon, dwysocha, esandeen, jamacku, mkolbas, msekleta, qguo, systemd-maint-list, vikpatil, xzhou, zjedrzej
Target Milestone:	rc	Keywords:	Bugfix, Reproducer, Triaged
Target Release:	---	Flags:	pm-rhel: mirror+
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:	systemd-252-16.el9	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-11-07 08:54:03 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Comment 9 Michal Sekletar 2022-11-04 17:33:10 UTC

This is caused by packaging error in systemd. We ship outdated systemd-user config file which doesn't call pam_keyinit.so. Hence gnome-terminal-server.service user service inherits session keyring from systemd --user instance which gets has KeyringMode=private (i.e. new session keyring not linked with user keyring). If pam_keyinit.so was invoked from systemd-user then this private keyring (setup by PID 1 when starting user instance) would be linked to user keyring and that is then inherited by gnome-terminal.

Comment 10 Zbigniew Jędrzejewski-Szmek 2022-11-23 15:14:42 UTC

We discussed this during a meeting with PAM maintainers today… The issue is even more subtle:
we call 'pam_keyinit revoke' via the shared configuration, but we need to call 'pam_keyinit force revoke'.
This will need to be done in our own config. As Michal wrote, this is already done upstream,
so the fix will be to just make sure that those upstream changes are present in our downstream
version of this file.

Comment 12 Jan Macku 2023-06-27 12:46:04 UTC

I have posted MR fixing this issue, thank you for your patience.

https://gitlab.com/redhat/centos-stream/rpms/systemd/-/merge_requests/80

Comment 16 errata-xmlrpc 2023-11-07 08:54:03 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (systemd bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2023:6640