Re: Revised request_key(2) man page for review

[David Howells <dhowells@redhat.com>]

Michael Kerrisk (man-pages) <mtk.manpages@gmail.com> wrote:

> >        │Is 'keyring' allowed to be 0? Reading the source, it │
> >        │appears so.  In this case, by default,  the  key  is │
> >        │assigned   to   the   session   keyring.   But,  the │
> >        │KEYCTL_SET_REQKEY_KEYRING  also  seems  to  have  an │
> >        │influence here.  What are the details here?          │

Yes, the destination keyring can be 0.  If you don't specify a destination
keyring, then:

 (1) If the key is found to already exist, the serial number is returned, but
     no extra link is made.

 (2) If an error occurs other than "this key doesn't exist", then you'll just
     get the error.

 (3) If we have to construct a new key, this will be attached to the default
     keyring (as there's no destination keyring to attach to).

> >            # echo 'create user mtk:* *   /bin/keyctl instantiate %k %c %S' \
> >                      > /etc/request-keys.conf

There's a /etc/request-keys.d/ directory now.

David