google / fscrypt / 449

34%

push

travis-ci

keyring: fix permission denied accessing user keyring (#177)

When userKeyringIDLookup() looks up a user keyring, it links it into the
process keyring to ensure that the process retains the "possessor
privileges" over the user keyring, then caches the user keyring's ID.

Unfortunately, this use of the process keyring randomly fails because Go
creates threads before even init() and main() are run, and then can run
code on them later.  Since the kernel doesn't create the process keyring
until userspace requests it and the process keyring is actually a
per-thread property that's only inherited by new threads, different
threads in a Go process may see different process keyrings.

Fix this by removing the user keyring cache, switching from the process
keyring to the thread keyring, and using LockOSThread() to pin the
goroutine to an OS thread while needed to perform a keyring operation.

Resolves https://github.com/google/fscrypt/issues/176

14 of 14 new or added lines in 1 file covered. (100.0%)

1367 of 4129 relevant lines covered (33.11%)

1235.45 hits per line