1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
| #define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/syscall.h>
#include <keyutils.h>
#include <errno.h>
#include <string.h>
void demonstrate_keyring_operations() {
printf("=== 密钥环操作演示 ===\n");
// 获取各种密钥环 ID
key_serial_t session_ring = keyctl(KEYCTL_GET_KEYRING_ID,
KEY_SPEC_SESSION_KEYRING, 0);
key_serial_t process_ring = keyctl(KEYCTL_GET_KEYRING_ID,
KEY_SPEC_PROCESS_KEYRING, 0);
key_serial_t thread_ring = keyctl(KEYCTL_GET_KEYRING_ID,
KEY_SPEC_THREAD_KEYRING, 0);
printf("密钥环 ID:\n");
printf(" 会话密钥环: %d\n", session_ring);
printf(" 进程密钥环: %d\n", process_ring);
printf(" 线程密钥环: %d\n", thread_ring);
// 创建自定义密钥环
key_serial_t custom_ring = add_key("keyring", "my_custom_ring",
NULL, 0, KEY_SPEC_SESSION_KEYRING);
if (custom_ring != -1) {
printf("✓ 创建自定义密钥环: %d\n", custom_ring);
// 在自定义密钥环中创建密钥
key_serial_t ring_key = add_key("user", "ring_key",
"data in ring", 12, custom_ring);
if (ring_key != -1) {
printf("✓ 在自定义密钥环中创建密钥: %d\n", ring_key);
}
// 清空自定义密钥环
if (keyctl(KEYCTL_CLEAR, custom_ring, 0, 0, 0) == 0) {
printf("✓ 清空自定义密钥环\n");
}
// 撤销自定义密钥环
if (keyctl(KEYCTL_REVOKE, custom_ring, 0, 0, 0) == 0) {
printf("✓ 撤销自定义密钥环\n");
}
}
// 加入新的会话密钥环
key_serial_t new_session = keyctl(KEYCTL_JOIN_SESSION_KEYRING,
(long)"new_session", 0, 0, 0);
if (new_session != -1) {
printf("✓ 加入新的会话密钥环: %d\n", new_session);
}
}
void demonstrate_key_search() {
printf("\n=== 密钥搜索演示 ===\n");
// 创建测试密钥
key_serial_t test_key = add_key("user", "search_test",
"search data", 11,
KEY_SPEC_SESSION_KEYRING);
if (test_key == -1) {
printf("创建测试密钥失败: %s\n", strerror(errno));
return;
}
printf("创建测试密钥: %d\n", test_key);
// 搜索密钥
key_serial_t found_key = keyctl(KEYCTL_SEARCH,
KEY_SPEC_SESSION_KEYRING,
(long)"user", (long)"search_test", 0);
if (found_key != -1) {
printf("✓ 找到密钥: %d\n", found_key);
// 验证找到的密钥
if (found_key == test_key) {
printf("✓ 验证成功：找到的密钥 ID 匹配\n");
}
} else {
printf("搜索密钥失败: %s\n", strerror(errno));
}
// 撤销测试密钥
keyctl(KEYCTL_REVOKE, test_key, 0, 0, 0);
}
void demonstrate_key_permissions() {
printf("\n=== 密钥权限演示 ===\n");
// 创建测试密钥
key_serial_t perm_key = add_key("user", "perm_test",
"permission data", 15,
KEY_SPEC_SESSION_KEYRING);
if (perm_key == -1) {
printf("创建权限测试密钥失败: %s\n", strerror(errno));
return;
}
printf("创建权限测试密钥: %d\n", perm_key);
// 设置密钥权限
// 权限格式: possessor|user|group|other
// 每个字段: view|read|write|search|link|setattr|all
key_perm_t permissions = KEY_POS_ALL | KEY_USR_VIEW | KEY_USR_READ;
if (keyctl(KEYCTL_SETPERM, perm_key, permissions, 0, 0) == 0) {
printf("✓ 设置密钥权限成功\n");
// 描述密钥查看权限
char desc[256];
long desc_len = keyctl(KEYCTL_DESCRIBE, perm_key,
(long)desc, sizeof(desc), 0);
if (desc_len != -1) {
desc[desc_len] = '\0';
printf("更新后的密钥描述: %s", desc);
}
} else {
printf("设置密钥权限失败: %s\n", strerror(errno));
}
// 更改密钥所有者（需要特权）
if (keyctl(KEYCTL_CHOWN, perm_key, getuid(), 0, 0) == 0) {
printf("✓ 更改密钥所有者成功\n");
} else {
if (errno == EPERM) {
printf("ℹ 更改所有者需要特权权限\n");
} else {
printf("更改所有者失败: %s\n", strerror(errno));
}
}
// 撤销密钥
keyctl(KEYCTL_REVOKE, perm_key, 0, 0, 0);
}
int main() {
printf("=== keyctl 密钥环操作演示 ===\n");
// 检查密钥支持
if (keyctl(KEYCTL_GET_KEYRING_ID, KEY_SPEC_SESSION_KEYRING, 0) == -1) {
printf("错误: 系统不支持密钥保留服务\n");
return 1;
}
demonstrate_keyring_operations();
demonstrate_key_search();
demonstrate_key_permissions();
return 0;
}
|