CHROMIUM: Lock session keyring to root only.
session keyring is set by default to permission 3f3b0000
which means the possessor (every processes) can alter it,
can eventually delete dircrypt keyring.
Instead, change permission to 1b3f0000: only root have full
access, everyone else can just read, view and search the ring.
BUG=chromium:347322
TEST=Check the permission of the session keyring:
keyctl describe @s
-3: -ls-rvalswrv------------ 0 0 keyring: _ses
Check root as full access:
keyctl show @s
Keyring
285078499 --alswrv 0 0 keyring: _ses
...
But others can just list, serach, read and view.
sudo -u chronos keyctl show @s
Keyring
285078499 ---ls-rv 0 0 keyring: _ses
...
Reviewed-on: https://chromium-review.googlesource.com/437658
Change-Id: I03aad1c057b20f5344e74bcbe2388c7626bff471
1 file changed