Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1736748

Summary: systemd-udev: The user keyring is not linked into the session keyring
Product: Red Hat Enterprise Linux 8 Reporter: Jeff Moyer <jmoyer>
Component: systemdAssignee: systemd-maint
Status: CLOSED NOTABUG QA Contact: Frantisek Sumsal <fsumsal>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 8.2CC: dan.j.williams, dhowells, dtardon, fjc, systemd-maint-list, yizhan
Target Milestone: rcFlags: msekleta: mirror+
Target Release: 8.0   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-07-22 17:10:21 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Jeff Moyer 2019-08-01 20:47:06 UTC
Description of problem:
Some non-volatile dimms support encryption.  The keys for unlocking the dimms must be loaded before the driver.  This is done via a modprobe.d configuration file:

$ cat /etc/modprobe.d/nvdimm-security.conf 
install libnvdimm /usr/bin/ndctl load-keys ; /sbin/modprobe --ignore-install libnvdimm $CMDLINE_OPTS

Unfortunately, this doesn't work on RHEL 8.  The master key can be loaded, but the dimm keys fail to load because they cannot find the master key.  The reason is that the master key is associated with %:_uid.0, but that keyring is not linked into the session keyring:

systemd-udevd[995]: Session Keyring
systemd-udevd[995]:  243101195 --alswrv      0     0  keyring: _ses
systemd-udevd[995]:   74421988 ----s-rv      0     0   \_ user: invocation_id

I'm not sure what _user:invocation_id is!

Anwyay, if I do this before calling 'ndctl load-keys', everything works:

  keyctl link @u @s

I honestly don't know if this is a systemd-udev problem, or if it lies elsewhere.  Sorry for dumping this on you to triage.

Version-Release number of selected component (if applicable):
systemd-udev-239-15.el8.x86_64

How reproducible:
100%

Steps to Reproduce:
You can probably see the problem by just putting a modprobe.d file in place for any module with the following contents:

install <kmod> keyctl show ; /usr/sbin/modprobe --ignore-install <kmod> $CMDLINE_OPTS

NOTE: You'll have to re-run dracut, and pass "--install modprobe".  Something like this:

dracut -f /boot/initramfs-`uname -r`.img `uname -r --install modprobe

Actual results:
You should see the keyring laid out as I described above:
systemd-udevd[995]: Session Keyring
systemd-udevd[995]:  243101195 --alswrv      0     0  keyring: _ses
systemd-udevd[995]:   74421988 ----s-rv      0     0   \_ user: invocation_id

Expected results:
Session Keyring
 516075342 --alswrv      0     0  keyring: _ses
 874048103 ----s-rv      0     0   \_ user: invocation_id
 743796955 --alswrv      0 65534   \_ keyring: _uid.0

Additional info:

Comment 1 Jeff Moyer 2019-08-01 20:53:58 UTC
Um, that dracut line should have been:

dracut -f /boot/initramfs-`uname -r`.img `uname -r` --install keyctl

Whoops!

Comment 2 Iambchop 2020-06-16 16:57:43 UTC
Trying to load evm-key in dracut using the 97masterkey and 98integrity modules from the upstream dracut git repo.

97masterkey loads the kmk-user.blob:

pre-pivot/60-masterkey.sh@64(load_masterkey): info 'Loading the kernel master key'
pre-pivot/60-masterkey.sh@65(load_masterkey): keyctl add user kmk-user '...' @u
60-masterkey.sh@70(load_masterkey): return 0

But, 98integrity fails to load the evm-user.blob:

: Session Keyring
:  809562929 --alswrv      0     0  keyring: _ses
:   98782915 ----s-rv      0     0   \_ user: invocation_id
pre-pivot/61-evm-enable.sh@48(load_evm_key): keyctl add encrypted evm-key 'load default user:kmk-user 64 ...' @u
: add_key: Required key not available
pre-pivot/61-evm-enable.sh@50(load_evm_key): info 'integrity: failed to load the EVM encrypted key: evm-key'
pre-pivot/61-evm-enable.sh@51(load_evm_key): return 1

After boot:

Session Keyring
 132420879 --alswrv      0     0  keyring: _ses
 319303296 --alswrv      0 65534   \_ keyring: _uid.0
 510913995 --alswrv      0     0       \_ user: kmk-user

And, the same keyctl add encrypted evm-key command works:

Session Keyring
 132420879 --alswrv      0     0  keyring: _ses
 319303296 --alswrv      0 65534   \_ keyring: _uid.0
 510913995 --alswrv      0     0       \_ user: kmk-user
 501353903 --alswrv      0     0       \_ encrypted: evm-key

Comment 3 Iambchop 2020-06-16 17:07:28 UTC
Like the original poster, running keyctl link @u @s gets past that:

pre-pivot/61-evm-enable.sh@42(load_evm_key): keyctl show
: Session Keyring
:  870034873 --alswrv      0     0  keyring: _ses
: 1010636326 ----s-rv      0     0   \_ user: invocation_id
pre-pivot/61-evm-enable.sh@43(load_evm_key): keyctl link @u @s
pre-pivot/61-evm-enable.sh@44(load_evm_key): keyctl show
: Session Keyring
:  870034873 --alswrv      0     0  keyring: _ses
: 1010636326 ----s-rv      0     0   \_ user: invocation_id
: 1049739001 --alswrv      0 65534   \_ keyring: _uid.0
:   87760311 --alswrv      0     0       \_ user: kmk-user
pre-pivot/61-evm-enable.sh@50(load_evm_key): keyctl add encrypted evm-key 'load default user:kmk-user 64 ...' @u
pre-pivot/61-evm-enable.sh@50(load_evm_key): EVMKEYID=...
pre-pivot/61-evm-enable.sh@135(enable_evm): evm_configured=1
pre-pivot/61-evm-enable.sh@146(enable_evm): info 'Enabling EVM'

And, after boot:

# cat /sys/kernel/security/evm
1

Comment 4 David Tardon 2020-07-22 17:10:21 UTC
This is intentional behavior for KeyringMode=private (the default for system services). From systemd.exec(5):

      KeyringMode=
           Controls how the kernel session keyring is set up for the service (see session-
           keyring(7) for details on the session keyring). Takes one of inherit, private,
           shared. If set to inherit no special keyring setup is done, and the kernel's
           default behaviour is applied. If private is used a new session keyring is
           allocated when a service process is invoked, and it is not linked up with any
           user keyring. This is the recommended setting for system services, as this
           ensures that multiple services running under the same system user ID (in
           particular the root user) do not share their key material among each other. If
           shared is used a new session keyring is allocated as for private, but the user
           keyring of the user configured with User= is linked into it, so that keys
           assigned to the user may be requested by the unit's processes. In this modes
           multiple units running processes under the same user ID may share key material.
           Unless inherit is selected the unique invocation ID for the unit (see below) is
           added as a protected key by the name "invocation_id" to the newly created session
           keyring. Defaults to private for services of the system service manager and to
           inherit for non-service units and for services of the user service manager.