keyctl(2)

Synopsis

#include <linux/keyctl.h>  /* Definition of KEY* constants */
#include <sys/syscall.h>   /* Definition of SYS_* constants */
#include <unistd.h>

long syscall(SYS_keyctl, int op, ...);

Rod's take

Environment variables are where secrets go to die: /proc/PID/environ, core dumps, every child you ever fork. The kernel keyring has been doing this properly since 2.6.10: typed keys, per-key permissions, timeouts the kernel enforces itself, and revocation that doesn't mean killing the process. Process keyring if the secret should die with the process, session keyring if children need it. Set a timeout, read it with keyctl_read_alloc, revoke it when you're done. The API is ugly, the permission bitmask is hostile and the quotas are stingy. Still beats DB_PASSWORD in the environment by a mile.

Flags and arguments that matter

Errors you will actually hit

Example

#include <keyutils.h>   /* -lkeyutils */

key_serial_t key = add_key("user", "myapp:db:password",
                           pw, pwlen, KEY_SPEC_PROCESS_KEYRING);
if (key == -1) err(1, "add_key");
if (keyctl(KEYCTL_SET_TIMEOUT, key, 600) < 0)
    perror("KEYCTL_SET_TIMEOUT");

void *payload = NULL;
long len = keyctl_read_alloc(key, &payload);
if (len < 0) err(1, "keyctl_read_alloc");
connect_db(payload, (size_t)len);
explicit_bzero(payload, (size_t)len);
free(payload);
keyctl(KEYCTL_REVOKE, key);

Trimmed from the full walkthrough in The kernel keyring has been in Linux since 2.6.10 and you have never used it.

BSD equivalent

FreeBSD and OpenBSD: no kernel keyring equivalent.