{"action":"created","issue":{"url":"https://api.github.com/repos/systemd/systemd/issues/6281","repository_url":"https://api.github.com/repos/systemd/systemd","labels_url":"https://api.github.com/repos/systemd/systemd/issues/6281/labels{/name}","comments_url":"https://api.github.com/repos/systemd/systemd/issues/6281/comments","events_url":"https://api.github.com/repos/systemd/systemd/issues/6281/events","html_url":"https://github.com/systemd/systemd/issues/6281","id":240377663,"number":6281,"title":"Ignore session keyring if the kernel does not support chown","user":{"login":"a1any","id":29888554,"avatar_url":"https://avatars0.githubusercontent.com/u/29888554?v=3","gravatar_id":"","url":"https://api.github.com/users/a1any","html_url":"https://github.com/a1any","followers_url":"https://api.github.com/users/a1any/followers","following_url":"https://api.github.com/users/a1any/following{/other_user}","gists_url":"https://api.github.com/users/a1any/gists{/gist_id}","starred_url":"https://api.github.com/users/a1any/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/a1any/subscriptions","organizations_url":"https://api.github.com/users/a1any/orgs","repos_url":"https://api.github.com/users/a1any/repos","events_url":"https://api.github.com/users/a1any/events{/privacy}","received_events_url":"https://api.github.com/users/a1any/received_events","type":"User","site_admin":false},"labels":[{"id":221925707,"url":"https://api.github.com/repos/systemd/systemd/labels/pid1","name":"pid1","color":"c7def8","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":10,"created_at":"2017-07-04T10:19:15Z","updated_at":"2017-07-11T17:03:43Z","closed_at":null,"body":"### Submission type\r\n\r\n - Request for enhancement (RFE)\r\n\r\n### systemd version the issue has been seen with\r\n\r\n> 233\r\n\r\n### Used distribution\r\n\r\n> Arch Linux (on OpenVZ containers)\r\n\r\nOpenVZ kernels support keyctl, but fails to implement the chown/chgrp functionality correctly. It returns permission denied when trying to chown/chgrp to anybody other than oneself. For example,\r\n\r\n```\r\n# keyctl session\r\nJoined session keyring: 556756508\r\n# keyctl chown 556756508 1000\r\nkeyctl_chown: Permission denied\r\n# keyctl chown 556756508 0\r\n# echo $?\r\n0\r\n```\r\n\r\nYes, I know this is a bug on the OpenVZ kernel side, not systemd's (hence this is an RFE rather than a bug report). I think it's a good idea to ignore the keyring issue and continue exec instead of failing in this case. Right now it fails to start all the services that are restricted to users' privilege. Instead of waiting years to fix OpenVZ kernel or switching to other init, it would be lot easier to let systemd handle this.\r\n\r\n**ALSO**, there actually is a bug. It appears log_...() functions in setup_keyring() is not enclosed with log_open(). Logs are not showing at all, and that wasted some time for me to investigate this issue."},"comment":{"url":"https://api.github.com/repos/systemd/systemd/issues/comments/314508882","html_url":"https://github.com/systemd/systemd/issues/6281#issuecomment-314508882","issue_url":"https://api.github.com/repos/systemd/systemd/issues/6281","id":314508882,"user":{"login":"poettering","id":2130732,"avatar_url":"https://avatars2.githubusercontent.com/u/2130732?v=3","gravatar_id":"","url":"https://api.github.com/users/poettering","html_url":"https://github.com/poettering","followers_url":"https://api.github.com/users/poettering/followers","following_url":"https://api.github.com/users/poettering/following{/other_user}","gists_url":"https://api.github.com/users/poettering/gists{/gist_id}","starred_url":"https://api.github.com/users/poettering/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/poettering/subscriptions","organizations_url":"https://api.github.com/users/poettering/orgs","repos_url":"https://api.github.com/users/poettering/repos","events_url":"https://api.github.com/users/poettering/events{/privacy}","received_events_url":"https://api.github.com/users/poettering/received_events","type":"User","site_admin":false},"created_at":"2017-07-11T17:03:43Z","updated_at":"2017-07-11T17:03:43Z","body":"hmm, it appears to me the kernel really should be fixed, and permit the chown keyctl if CAP_CHOWN is available... i.e. make the chowning of keys logic identical to the chowning of files logic...\r\n\r\nThat said, I'd accept a PR that skips the whole keyring setup code if a `have_effective_cap(CAP_SYS_ADMIN)` returns > 0 and `uid_is_valid(uid) || gid_is_valid(gid)` holds true, too.\r\n\r\nThat'd be a two-liner, and make things work for you:\r\n\r\n```c\r\n/* If we are running without CAP_SYS_ADMIN the KEYCTL_CHOWN operation will fail, hence let's skip the setup here, if we need to chown the keys. */\r\nif (have_effective_cap(CAP_SYS_ADMIN) > 0 && (uid_is_valid(uid) || gid_is_valid(gid))\r\n        return 0;\r\n```\r\n\r\nsomewhere up in setup_keyring()...\r\n"}}
{"actor":{"display_login":"poettering"}}