Re: [PATCH v2 6/6] KEYS: Verify the key identity in __keyctl_unlink

[Jarkko Sakkinen <jarkko@kernel.org>]

On Tue, Oct 20, 2026 at 12:06:30AM +0300, Jarkko Sakkinen wrote:
> On Mon, Oct 19, 2026 at 12:35:02PM -0700, Eric Biggers wrote:
> > On Mon, Oct 19, 2026 at 09:17:26PM +0300, Jarkko Sakkinen wrote:
> > > [PATCH v2 6/6] KEYS: Verify the key identity in __keyctl_unlink
> > 
> > There is no __keyctl_unlink.  Seems you mean __key_unlink_begin.
> 
> This is definitely my typo :-) I was looking at the implementation
> in other terminal while writing this and apparently lost focus.
> 
> > 
> > > Let's define the following preconditions:
> > > 
> > > - Two keys: A and B.
> > > - R is a keyring.
> > > - Both have the same type/description/domain.
> > > 
> > > Then:
> > > 
> > > 1. KEYCTL_LINK(A, R) => {A}
> > > 1. KEYCTL_LINK(B, R) => {B}
> > > 2. KEYCTL_UNLINK(A, R) => {}
> > 
> > Should be 1, 2, and 3?
> 
> I tried to describe the scenarion but apparently was not so successful.
> 
> I.e. unlinking A removes B given the match in attributes while you would
> expect getting -ENOENT and B retained. Or this is the idea.

Here's a little bit tweaked version of David's example:

#!/bin/sh

set -e

keyctl new_session >/dev/null
keyctl newring ring_a @s
keyctl newring ring_b @s
A=`keyctl add user A ss %:ring_a`
B=`keyctl add user A qq %:ring_b`
keyctl newring R @s
keyctl show
keyctl link $A %:R
keyctl link $B %:R
keyctl unlink $A %:R
keyctl show

What I get is:

77968717
178740336
781765689
Session Keyring
 952124334 --alswrv      0     0  keyring: _ses
  77968717 --alswrv      0     0   \_ keyring: ring_a
  32558793 --alswrv      0     0   |   \_ user: A
 781765689 --alswrv      0     0   \_ keyring: R
 178740336 --alswrv      0     0   \_ keyring: ring_b
 907061159 --alswrv      0     0       \_ user: A
Session Keyring
 952124334 --alswrv      0     0  keyring: _ses
  77968717 --alswrv      0     0   \_ keyring: ring_a
  32558793 --alswrv      0     0   |   \_ user: A
 781765689 --alswrv      0     0   \_ keyring: R
 178740336 --alswrv      0     0   \_ keyring: ring_b
 907061159 --alswrv      0     0       \_ user: A

What I would expect is -ENOENT.

Br, Jarkko