I'm trying to learn a bit about the linux kernel keyring (as background for using ecryptfs). Does the kernel keyring store keys somewhere on disk, or does it get reinitiailized programmatically everytime the sytem is booted?
I've looked at the man pages and archlinux documentation on encryption but haven't found the answer. If there's other documentation on the kernel keyring, I'd like to know.
If the kernel keyring does store keys on the disk, where does it put the files?
The Linux kernel never stores anything on a disk of its own behalf. It stores the files that applications tell it to store through the filesystem interface, or data on block devices accessed directly, or metadata of mounted filesystems and disk volumes.
Besides it wouldn't make any sense to store the encryption key on the same media.
The encryption key is only stored in RAM. It is entered before mounting the encrypted filesystem. The key is typically derived from a passphrase typed by the user, but it can also be loaded from e.g. a smartcard. The kernel documentation has the details.
It is possible to store the encryption key for a volume in a file outside that volume, and load that. It can make sense to have a key on a removable drive that's inserted physically at boot time, for example. But the kernel won't do this on its own, it's up to the system's startup scripts to do that.
The documentation on the kernel keyring can be find in the kernel source tree:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/Documentation/security
The keys used for eCryptfs are not stored on disk in plaintext. The utilities in the ecryptfs-utils project default to wrapping keys with a user supplied passphrase before saving any key material to disk. The user supplied passphrase is required to be entered by the user after each boot.
In short no it stores it in ram, not disk. Also there is usually a timeout so that it automatically deletes from ram after so long, unless told specifically otherwise.
My own notes on using the kernel keyring and using it via "keyctl"
https://antofthy.gitlab.io/info/crypto/keyring_linux_kernal.txt
This includes Multiple links to various documentation I have found for various aspects of the kernel keyring.
ASIDE: I did this study so as to store passwords when editing encrypted files! That way the editor can re-encrypt the file again when user saves it, without needing them to type the password twice (and perhaps changing the password by accident, Which I did a couple of times!).
