Question on nfs-utils patch for 'keyctl_invalidate'.

Question on nfs-utils patch for 'keyctl_invalidate'.

[Ben Greear]

It seems that key_invalidate is only available in quite recent
keyutils packages.

Anyone know if there is a relatively simple way to implement
the same behaviour using older keyutils packages?

The reason I ask is that I recently updated to latest nfs-utils
package and how build fails on many of my older systems...

Thanks,
Ben

-- 
Ben Greear <greearb@candelatech.com>
Candela Technologies Inc  http://www.candelatech.com

Re: Question on nfs-utils patch for 'keyctl_invalidate'.

[Steve Dickson]

On 04/14/2014 08:21 PM, Ben Greear wrote:
> It seems that key_invalidate is only available in quite recent
> keyutils packages.
> 
> Anyone know if there is a relatively simple way to implement
> the same behaviour using older keyutils packages?
CC-ing the keyutils maintainer... David, when did that kernel 
change go in that cause keyctl_revoke() to no longer work?

The nfs-utils commit is:

commit 2ae0763a618d30037ebb2520f6292f80d838a440
Author: Steve Dickson <steved@redhat.com>
Date:   Tue Mar 25 10:56:58 2014 -0400

    nfsidmap: Keys need to be invalidated instead of revoked

It sound like we need to do some type of #ifdef kernel version.... 

steved.

> 
> The reason I ask is that I recently updated to latest nfs-utils
> package and how build fails on many of my older systems...
> 
> Thanks,
> Ben
> 

Re: Question on nfs-utils patch for 'keyctl_invalidate'.

[Ben Greear]

On 04/15/2014 05:22 PM, Steve Dickson wrote:
>
>
> On 04/14/2014 08:21 PM, Ben Greear wrote:
>> It seems that key_invalidate is only available in quite recent
>> keyutils packages.
>>
>> Anyone know if there is a relatively simple way to implement
>> the same behaviour using older keyutils packages?
> CC-ing the keyutils maintainer... David, when did that kernel
> change go in that cause keyctl_revoke() to no longer work?
>
> The nfs-utils commit is:
>
> commit 2ae0763a618d30037ebb2520f6292f80d838a440
> Author: Steve Dickson <steved@redhat.com>
> Date:   Tue Mar 25 10:56:58 2014 -0400
>
>      nfsidmap: Keys need to be invalidated instead of revoked
>
> It sound like we need to do some type of #ifdef kernel version....

We might need an #ifdef based on keyutils version (which is what I implemented
to at least get it compiling), but if you need to key on kernel version then
you need run-time probing of the kernel as build system may run different
kernel than installed system.

Thanks,
Ben

>
> steved.
>
>>
>> The reason I ask is that I recently updated to latest nfs-utils
>> package and how build fails on many of my older systems...
>>
>> Thanks,
>> Ben
>>


-- 
Ben Greear <greearb@candelatech.com>
Candela Technologies Inc  http://www.candelatech.com

Re: Question on nfs-utils patch for 'keyctl_invalidate'.

[David Howells]

Steve Dickson <SteveD@redhat.com> wrote:

> CC-ing the keyutils maintainer... David, when did that kernel 
> change go in that cause keyctl_revoke() to no longer work?

I think this is what you are referring to:

Committer: David Howells <dhowells@redhat.com>  2012-10-02 19:24:56
Parent: 3a50597de8635cd05133bd12c95681c82fe7b878 (KEYS: Make the session and process keyrings per-thread)
Child:  f8aa23a55f813c9bddec2a6176e0e67274e6e7c1 (KEYS: Use keyring_alloc() to create special keyrings)
Branches: cred-fixes, master and many more (159)
Follows: v3.6-rc7
Precedes: fscache-fixes-20121220

> It sound like we need to do some type of #ifdef kernel version.... 

You could try keyctl_invalidate(), then if that doesn't work, call
keyctl_revoke().

David