feat(crypto/keyring): add Linux's keyctl support (backport #21653) (#21839)

Co-authored-by: Alessio Treglia <al@essio.dev>
Co-authored-by: marbar3778 <marbar3778@yahoo.com>

crypto/keyring/doc.go

@@ -33,6 +33,8 @@
 //		https://github.com/KDE/kwallet
 //	pass	This backend uses the pass command line utility to store and retrieve keys:
 //		https://www.passwordstore.org/
+//	keyctl  This backend leverages the Linux's kernel security key management system
+//		to store cryptographic keys securely in memory. This is available on Linux only.
 //	test	This backend stores keys insecurely to disk. It does not prompt for a password to
 //		be unlocked and it should be used only for testing purposes.
 //	memory	Same instance as returned by NewInMemory. This backend uses a transient storage. Keys

crypto/keyring/keyring.go

@@ -147,23 +147,6 @@ type Exporter interface {
 // Option overrides keyring configuration options.
 type Option func(options *Options)
 
-// Options define the options of the Keyring.
-type Options struct {
-	// supported signing algorithms for keyring
-	SupportedAlgos SigningAlgoList
-	// supported signing algorithms for Ledger
-	SupportedAlgosLedger SigningAlgoList
-	// define Ledger Derivation function
-	LedgerDerivation func() (ledger.SECP256K1, error)
-	// define Ledger key generation function
-	LedgerCreateKey func([]byte) types.PubKey
-	// define Ledger app name
-	LedgerAppName string
-	// indicate whether Ledger should skip DER Conversion on signature,
-	// depending on which format (DER or BER) the Ledger app returns signatures
-	LedgerSigSkipDERConv bool
-}
-
 // NewInMemory creates a transient keyring useful for testing
 // purposes and on-the-fly key generation.
 // Keybase options can be applied when generating this new Keybase.
@@ -180,7 +163,7 @@ func NewInMemoryWithKeyring(kr keyring.Keyring, cdc codec.Codec, opts ...Option)
 // New creates a new instance of a keyring.
 // Keyring options can be applied when generating the new instance.
 // Available backends are "os", "file", "kwallet", "memory", "pass", "test".
-func New(
+func newKeyringGeneric(
 	appName, backend, rootDir string, userInput io.Reader, cdc codec.Codec, opts ...Option,
 ) (Keyring, error) {
 	var (

crypto/keyring/keyring_linux.go

@@ -0,0 +1,84 @@
+//go:build linux
+// +build linux
+
+package keyring
+
+import (
+	"fmt"
+	"io"
+
+	"github.com/99designs/keyring"
+
+	"github.com/cosmos/cosmos-sdk/codec"
+	"github.com/cosmos/cosmos-sdk/crypto/ledger"
+	"github.com/cosmos/cosmos-sdk/crypto/types"
+)
+
+// Linux-only backend options.
+const BackendKeyctl = "keyctl"
+
+func KeyctlScopeUser(options *Options)        { setKeyctlScope(options, "user") }
+func KeyctlScopeUserSession(options *Options) { setKeyctlScope(options, "usersession") }
+func KeyctlScopeSession(options *Options)     { setKeyctlScope(options, "session") }
+func KeyctlScopeProcess(options *Options)     { setKeyctlScope(options, "process") }
+func KeyctlScopeThread(options *Options)      { setKeyctlScope(options, "thread") }
+
+// Options define the options of the Keyring.
+type Options struct {
+	// supported signing algorithms for keyring
+	SupportedAlgos SigningAlgoList
+	// supported signing algorithms for Ledger
+	SupportedAlgosLedger SigningAlgoList
+	// define Ledger Derivation function
+	LedgerDerivation func() (ledger.SECP256K1, error)
+	// define Ledger key generation function
+	LedgerCreateKey func([]byte) types.PubKey
+	// define Ledger app name
+	LedgerAppName string
+	// indicate whether Ledger should skip DER Conversion on signature,
+	// depending on which format (DER or BER) the Ledger app returns signatures
+	LedgerSigSkipDERConv bool
+	// KeyctlScope defines the scope of the keyctl's keyring.
+	KeyctlScope string
+}
+
+func newKeyctlBackendConfig(appName, _ string, _ io.Reader, opts ...Option) keyring.Config {
+	options := Options{
+		KeyctlScope: keyctlDefaultScope, // currently "process"
+	}
+
+	for _, optionFn := range opts {
+		optionFn(&options)
+	}
+
+	return keyring.Config{
+		AllowedBackends: []keyring.BackendType{keyring.KeyCtlBackend},
+		ServiceName:     appName,
+		KeyCtlScope:     options.KeyctlScope,
+	}
+}
+
+// New creates a new instance of a keyring.
+// Keyring options can be applied when generating the new instance.
+// Available backends are "os", "file", "kwallet", "memory", "pass", "test", "keyctl".
+func New(
+	appName, backend, rootDir string, userInput io.Reader, cdc codec.Codec, opts ...Option,
+) (Keyring, error) {
+	if backend != BackendKeyctl {
+		return newKeyringGeneric(appName, backend, rootDir, userInput, cdc, opts...)
+	}
+
+	db, err := keyring.Open(newKeyctlBackendConfig(appName, "", userInput, opts...))
+	if err != nil {
+		return nil, fmt.Errorf("couldn't open keyring for %q: %w", appName, err)
+	}
+
+	return newKeystore(db, cdc, backend, opts...), nil
+}
+
+func setKeyctlScope(options *Options, scope string) { options.KeyctlScope = scope }
+
+// this is private as it is meant to be here for SDK devs convenience
+// as the user does not need to pick any default when he wants to
+// initialize keyctl with the default scope.
+const keyctlDefaultScope = "process"

crypto/keyring/keyring_linux_test.go

@@ -0,0 +1,51 @@
+//go:build linux
+// +build linux
+
+package keyring
+
+import (
+	"errors"
+	"io"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/cosmos/cosmos-sdk/codec"
+)
+
+func TestNewKeyctlKeyring(t *testing.T) {
+	cdc := getCodec()
+
+	tests := []struct {
+		name        string
+		appName     string
+		backend     string
+		dir         string
+		userInput   io.Reader
+		cdc         codec.Codec
+		expectedErr error
+	}{
+		{
+			name:        "keyctl backend",
+			appName:     "cosmos",
+			backend:     BackendKeyctl,
+			dir:         t.TempDir(),
+			userInput:   strings.NewReader(""),
+			cdc:         cdc,
+			expectedErr: nil,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			kr, err := New(tt.appName, tt.backend, tt.dir, tt.userInput, tt.cdc)
+			if tt.expectedErr == nil {
+				require.NoError(t, err)
+			} else {
+				require.Error(t, err)
+				require.Nil(t, kr)
+				require.True(t, errors.Is(err, tt.expectedErr))
+			}
+		})
+	}
+}

crypto/keyring/keyring_other.go

@@ -0,0 +1,35 @@
+//go:build !linux
+// +build !linux
+
+package keyring
+
+import (
+	"io"
+
+	"github.com/cosmos/cosmos-sdk/codec"
+	"github.com/cosmos/cosmos-sdk/crypto/ledger"
+	"github.com/cosmos/cosmos-sdk/crypto/types"
+)
+
+// Options define the options of the Keyring.
+type Options struct {
+	// supported signing algorithms for keyring
+	SupportedAlgos SigningAlgoList
+	// supported signing algorithms for Ledger
+	SupportedAlgosLedger SigningAlgoList
+	// define Ledger Derivation function
+	LedgerDerivation func() (ledger.SECP256K1, error)
+	// define Ledger key generation function
+	LedgerCreateKey func([]byte) types.PubKey
+	// define Ledger app name
+	LedgerAppName string
+	// indicate whether Ledger should skip DER Conversion on signature,
+	// depending on which format (DER or BER) the Ledger app returns signatures
+	LedgerSigSkipDERConv bool
+}
+
+func New(
+	appName, backend, rootDir string, userInput io.Reader, cdc codec.Codec, opts ...Option,
+) (Keyring, error) {
+	return newKeyringGeneric(appName, backend, rootDir, userInput, cdc, opts...)
+}