Re: [GIT PULL for v7.4] vfs keyring

[Linus Torvalds]

On Sat, 24 Oct 2026 at 00:45, Christian Brauner <brauner@xxxxxxxxxx> wrote:
>
> Neither keyring is linked into any other keyring so request_key() and
> KEYCTL_SEARCH can't find them. Userspace has to scrape the serial out
> of /proc/keys before it can add a key to either of them. That's not
> great as any user can add a key with a newline in its description and
> make /proc/keys show a fake .dm-verity keyring line with whatever
> serial they like.

This explanation reads *very* oddly. It doesn't actually explain at
all what the patches do or why they do it.

Instead it states *another* problem entirely that it doesn't actually
fix, and almost entirely ignores what the patches actually do.

That's not at all helpful.

Yes, yes, that *other* problem is some of the *impetus* for doing
this, but at the same time it is absolutely *NOT* an explanation for
what this code actually does, and why I should pull it. It talks about
what the patches *don't* do, and rambles about the background, but
nary a word about what is actually happening.

The only explanations about what the patches actually do are complete
and utter nonsense. They claim it adds some kind of "well-known key
IDs". That's complete BS. There is absolutely nothing "well known"
about any of that: they are completely new random key IDs that nobody
has ever heard of before, but that are meant to be used as fixed known
key IDs.

To clarify: I'm not pulling this.  The code looks fine, but I had to
*look* at the code to try to even guess at what the hell you asked me
to pull, and that's not fine.

The pull request was an incomprehensible word salad that makes no
sense and doesn't describe anything. Please fix it.

                Linus