62b1b19ca5
Add support for invalidating a key - which renders it immediately invisible to further searches and causes the garbage collector to immediately wake up, remove it from keyrings and then destroy it when it's no longer referenced. It's better not to do this with keyctl_revoke() as that marks the key to start returning -EKEYREVOKED to searches when what is actually desired is to have the key refetched. To invalidate a key the caller must be granted SEARCH permission by the key. This may be too strict. It may be better to also permit invalidation if the caller has any of READ, WRITE or SETATTR permission. The primary use for this is to evict keys that are cached in special keyrings, such as the DNS resolver or an ID mapper. Change-Id: I923ea0f0b8f9d6b3ff8ec8beca77b1774984f1c3 Signed-off-by: David Howells <dhowells@redhat.com> |
||
|---|---|---|
| .. | ||
| 00-INDEX | ||
| LSM.txt | ||
| SELinux.txt | ||
| Smack.txt | ||
| Yama.txt | ||
| apparmor.txt | ||
| credentials.txt | ||
| keys-ecryptfs.txt | ||
| keys-request-key.txt | ||
| keys-trusted-encrypted.txt | ||
| keys.txt | ||
| tomoyo.txt | ||