Re: [RFC] Keyrings: How to make them more useful

[Ben Boeckel <me@benboeckel.net>]

On Mon, Jun 30, 2025 at 16:04:01 +0200, David 'equinox' Lamparter wrote:
> * the trusted key / TPM bits are incredibly poorly documented.  It's
>   basically "cobble together things from old patch descriptions", e.g.
>   https://marc.info/?l=linux-keyrings&m=160074197025246
>   (I still have not figured out how to do this correctly.  Some of that
>   is to blame on the TPM bits, but not all.)
> 
> I guess the kernel itself doesn't care about the blocking API, but for
> trusted keys...  you'll have to tie things together from user space, and
> I don't see how anyone can do that, especially with any level of
> confidence that they didn't accidentally leave some wide-open hole (as
> in - you might well get something to work, but without docs you can't
> check you actually did it *right*.)  This is really improving keyctl
> itself (i.e. how its commands are invoked) and also its documentation.

You may be interested in some of the work I've done here:

    https://github.com/mathstuf/rust-keyutils

In particular:

    https://github.com/mathstuf/rust-keyutils/blob/master/src/keytypes/trusted.rs

There are assorted issues and PRs that may be of interest for trusted
keys as well.

Unfortunately, I've not had the time to dedicate to it, so it has
languished a bit over time.

--Ben