From 437a85112e02042b62751395b9e7225628c1b708 Mon Sep 17 00:00:00 2001
From: Christian Hesse <mail@eworm.de>
Date: Tue, 4 Jul 2017 09:38:31 +0200
Subject: [PATCH] core: link user keyring to session keyring (#6275)

Commit  74dd6b515fa968c5710b396a7664cac335e25ca8 (core: run each system
service with a fresh session keyring) broke adding keys to user keyring.
Added keys could not be accessed with error message:

keyctl_read_alloc: Permission denied

So link the user keyring to our session keyring.
---
 src/basic/missing.h | 4 ++++
 src/core/execute.c  | 8 ++++++++
 2 files changed, 12 insertions(+)

diff --git a/src/basic/missing.h b/src/basic/missing.h
index 7c323c61cf..a563187a2b 100644
--- a/src/basic/missing.h
+++ b/src/basic/missing.h
@@ -1093,6 +1093,10 @@ typedef int32_t key_serial_t;
 #define KEYCTL_DESCRIBE 6
 #endif
 
+#ifndef KEYCTL_LINK
+#define KEYCTL_LINK 8
+#endif
+
 #ifndef KEYCTL_READ
 #define KEYCTL_READ 11
 #endif
diff --git a/src/core/execute.c b/src/core/execute.c
index d72e5bf08c..643a209af7 100644
--- a/src/core/execute.c
+++ b/src/core/execute.c
@@ -2099,6 +2099,14 @@ static int setup_keyring(Unit *u, const ExecParameters *p, uid_t uid, gid_t gid)
                 return 0;
         }
 
+        /* Having our own session keyring is nice, but results in keys added
+         * to the user keyring being inaccessible with permission denied.
+         * So link the user keyring to our session keyring. */
+        if (keyctl(KEYCTL_LINK,
+                   KEY_SPEC_USER_KEYRING,
+                   keyring,  0, 0) < 0)
+                return log_debug_errno(errno, "Failed to link user keyring to session keyring.");
+
         /* Populate they keyring with the invocation ID by default. */
         if (!sd_id128_is_null(u->invocation_id)) {
                 key_serial_t key;