3 ms·

in these cases, it does. I dont have knowledge of selinux for IPC usecases... but in all the cases that I have seen, most of them have been file based access th

in these cases, it does. I dont have knowledge of selinux for IPC usecases... but in all the cases that I have seen, most of them have been file based access that are being guarded by selinux. Not that selinux is wrong.. my point is that these files should never have been used in the first place. Linux keyring is a kernel level infrastructure. However, we still have ssh keyfiles being stored in ~/.ssh . Not sure if I'm right, but it seems to me that openssh wants to be cross platform friendly. So it doesnt play with linuxism very well.

drvdevd 10y ago
Interesting. I'm surprised I haven't read more about the Linux kernel keyring infrastructure. Are you sure that portable openssh ssh-agent doesn't implement access to it?
- sandGorgon 10y ago
  in a few distros, they hack it together using "ssh agent" . You can read about it here - https://wiki.gnome.org/Projects/GnomeKeyring/Ssh https://wiki.gnome.org/Projects/GnomeKeyring/Ssh AFAIK - its the same story on OSX. I dont begrudge openssh - I'm not sure how it would work with multiple systems, but I dont know if it was ever a priority. But in this day and age of a "reloaded" Lavabit... these are infrastructure decisions that must be solved ! Interestingly, for all the hate that Lennart gets, he refused to implement "systemd-keyring" and suggested people should use the kernel level keyring service that already exists [1]. You can test it out using "keyctl". Remember however, that IMHO kernel keys do not persist across powercycles.. There is some kind of funky interplay between ecryptfs, kernel keyring and gnome-keyring that I dont completely understand (and is the basis of encrypted home directory in Linux) [1] https://lists.freedesktop.org/archives/systemd-devel/2014-June/020638.html https://lists.freedesktop.org/archives/systemd-devel/2014-Ju...
lima 10y ago
Gnome-Keyring does not use the kernel keyring facility (correct me if I'm wrong). It also doesn't limit access in any way. Anyone who can connect to the keyring socket gets access to everything. How is this better than storing it in files?
- sandGorgon 10y ago
  > Anyone who can connect to the keyring socket gets access to everything. How is this better than storing it in files? That is not something im personally qualified to answer. However, ypu should ask that question of selinux. Assuming something like selinux makes sense, and gnome-keyring is protected by selinux.. my point is to use builtin infrastructure.
  - lima 10y ago
    Well, SELinux can differentiate between different subjects whereas gnome-keyring cannot. Fedora's default policy prevents openvpn from accessing your SSH keys.
    - sandGorgon 10y ago
      You are misunderstanding user screen fatigue. This [1] is the error message spit out by openvpn when it asks you to restorecon on your cert directory - https://bugzilla.gnome.org/show_bug.cgi?id=689818#c3 https://bugzilla.gnome.org/show_bug.cgi?id=689818#c3 It is NOT asking you to do some specific openvpn restricted setting. Its basically setting it to the same permission level as gnome-keyring. Except - not even password protected. And the biggest issue - obviously an end-user has to muck about this stuff.
      - lima 10y ago
        You're misunderstand what SELinux does with OpenVPN. OpenVPN runs confined, so the only thing it's allowed to access in your profile directory is the certificate files. The OpenVPN SELinux policy says "OpenVPN may only access files marked home_cert_t". With gnome-keyring, it would have access to all your secrets.

drvdevd 10y ago

Interesting. I'm surprised I haven't read more about the Linux kernel keyring infrastructure. Are you sure that portable openssh ssh-agent doesn't implement access to it?

sandGorgon 10y ago
in a few distros, they hack it together using "ssh agent" . You can read about it here - https://wiki.gnome.org/Projects/GnomeKeyring/Ssh https://wiki.gnome.org/Projects/GnomeKeyring/Ssh AFAIK - its the same story on OSX. I dont begrudge openssh - I'm not sure how it would work with multiple systems, but I dont know if it was ever a priority. But in this day and age of a "reloaded" Lavabit... these are infrastructure decisions that must be solved ! Interestingly, for all the hate that Lennart gets, he refused to implement "systemd-keyring" and suggested people should use the kernel level keyring service that already exists [1]. You can test it out using "keyctl". Remember however, that IMHO kernel keys do not persist across powercycles.. There is some kind of funky interplay between ecryptfs, kernel keyring and gnome-keyring that I dont completely understand (and is the basis of encrypted home directory in Linux) [1] https://lists.freedesktop.org/archives/systemd-devel/2014-June/020638.html https://lists.freedesktop.org/archives/systemd-devel/2014-Ju...

lima 10y ago

Gnome-Keyring does not use the kernel keyring facility (correct me if I'm wrong). It also doesn't limit access in any way. Anyone who can connect to the keyring socket gets access to everything. How is this better than storing it in files?

sandGorgon 10y ago
> Anyone who can connect to the keyring socket gets access to everything. How is this better than storing it in files? That is not something im personally qualified to answer. However, ypu should ask that question of selinux. Assuming something like selinux makes sense, and gnome-keyring is protected by selinux.. my point is to use builtin infrastructure.
- lima 10y ago
  Well, SELinux can differentiate between different subjects whereas gnome-keyring cannot. Fedora's default policy prevents openvpn from accessing your SSH keys.
  - sandGorgon 10y ago
    You are misunderstanding user screen fatigue. This [1] is the error message spit out by openvpn when it asks you to restorecon on your cert directory - https://bugzilla.gnome.org/show_bug.cgi?id=689818#c3 https://bugzilla.gnome.org/show_bug.cgi?id=689818#c3 It is NOT asking you to do some specific openvpn restricted setting. Its basically setting it to the same permission level as gnome-keyring. Except - not even password protected. And the biggest issue - obviously an end-user has to muck about this stuff.
    - lima 10y ago
      You're misunderstand what SELinux does with OpenVPN. OpenVPN runs confined, so the only thing it's allowed to access in your profile directory is the certificate files. The OpenVPN SELinux policy says "OpenVPN may only access files marked home_cert_t". With gnome-keyring, it would have access to all your secrets.