)]}'
{
  "commit": "3a50597de8635cd05133bd12c95681c82fe7b878",
  "tree": "d81c3e46dcef80fbaf84fdf1e8f43676625bab8e",
  "parents": [
    "a84a921978b7d56e0e4b87ffaca6367429b4d8ff"
  ],
  "author": {
    "name": "David Howells",
    "email": "dhowells@redhat.com",
    "time": "Tue Oct 02 19:24:29 2012 +0100"
  },
  "committer": {
    "name": "David Howells",
    "email": "dhowells@redhat.com",
    "time": "Tue Oct 02 19:24:29 2012 +0100"
  },
  "message": "KEYS: Make the session and process keyrings per-thread\n\nMake the session keyring per-thread rather than per-process, but still\ninherited from the parent thread to solve a problem with PAM and gdm.\n\nThe problem is that join_session_keyring() will reject attempts to change the\nsession keyring of a multithreaded program but gdm is now multithreaded before\nit gets to the point of starting PAM and running pam_keyinit to create the\nsession keyring.  See:\n\n\thttps://bugs.freedesktop.org/show_bug.cgi?id\u003d49211\n\nThe reason that join_session_keyring() will only change the session keyring\nunder a single-threaded environment is that it\u0027s hard to alter the other\nthread\u0027s credentials to effect the change in a multi-threaded program.  The\nproblems are such as:\n\n (1) How to prevent two threads both running join_session_keyring() from\n     racing.\n\n (2) Another thread\u0027s credentials may not be modified directly by this process.\n\n (3) The number of threads is uncertain whilst we\u0027re not holding the\n     appropriate spinlock, making preallocation slightly tricky.\n\n (4) We could use TIF_NOTIFY_RESUME and key_replace_session_keyring() to get\n     another thread to replace its keyring, but that means preallocating for\n     each thread.\n\nA reasonable way around this is to make the session keyring per-thread rather\nthan per-process and just document that if you want a common session keyring,\nyou must get it before you spawn any threads - which is the current situation\nanyway.\n\nWhilst we\u0027re at it, we can the process keyring behave in the same way.  This\nmeans we can clean up some of the ickyness in the creds code.\n\nBasically, after this patch, the session, process and thread keyrings are about\ninheritance rules only and not about sharing changes of keyring.\n\nReported-by: Mantas M. \u003cgrawity@gmail.com\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nTested-by: Ray Strode \u003crstrode@redhat.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "ebbed2ce66379bd986fbf83f11e7ae8c32bf6070",
      "old_mode": 33188,
      "old_path": "include/linux/cred.h",
      "new_id": "0142aacb70b7049583a1618c735c7410a6827d65",
      "new_mode": 33188,
      "new_path": "include/linux/cred.h"
    },
    {
      "type": "modify",
      "old_id": "de728ac50d821b9f38340534a4ba6202137d55a2",
      "old_mode": 33188,
      "old_path": "kernel/cred.c",
      "new_id": "3f7ad1ec2ae43b20c8e952feab4003d9b7b50535",
      "new_mode": 33188,
      "new_path": "kernel/cred.c"
    },
    {
      "type": "modify",
      "old_id": "a0d373f76815c2eafb172666e05e6d9b81220584",
      "old_mode": 33188,
      "old_path": "security/keys/keyctl.c",
      "new_id": "65b38417c21132e812c193ce320ac39454e5038f",
      "new_mode": 33188,
      "new_path": "security/keys/keyctl.c"
    },
    {
      "type": "modify",
      "old_id": "178b8c3b130a4fe374bea90e2e36ab0c8655c4f8",
      "old_mode": 33188,
      "old_path": "security/keys/process_keys.c",
      "new_id": "9de5dc59827645577eaa9bab06cd1fbeb7bc8bde",
      "new_mode": 33188,
      "new_path": "security/keys/process_keys.c"
    },
    {
      "type": "modify",
      "old_id": "000e7501752022089b82efeb153115498e55da60",
      "old_mode": 33188,
      "old_path": "security/keys/request_key.c",
      "new_id": "275c4f9e4b8c03cc426d03c481f2dbb0b20956fc",
      "new_mode": 33188,
      "new_path": "security/keys/request_key.c"
    }
  ]
}