feat(crypto/keyring): add Linux's keyctl support

CHANGELOG.md

@@ -44,6 +44,7 @@ Every module contains its own CHANGELOG.md. Please refer to the module you are i
 
 * (baseapp) [#20291](https://github.com/cosmos/cosmos-sdk/pull/20291) Simulate nested messages.
 * (cli) [#21372](https://github.com/cosmos/cosmos-sdk/pull/21372) Add a `bulk-add-genesis-account` genesis command to add many genesis accounts at once.
+* (crypto/keyring) [#21653](https://github.com/cosmos/cosmos-sdk/pull/21653) New Linux-only backend that adds Linux kernel's `keyctl` support.
 
 ### Improvements
 

crypto/keyring/doc.go

@@ -33,6 +33,8 @@
 //		https://github.com/KDE/kwallet
 //	pass	This backend uses the pass command line utility to store and retrieve keys:
 //		https://www.passwordstore.org/
+//	keyctl  This backend leverages the Linux's kernel security key management system
+//		to store cryptographic keys securely in memory. This is available on Linux only.
 //	test	This backend stores keys insecurely to disk. It does not prompt for a password to
 //		be unlocked and it should be used only for testing purposes.
 //	memory	Same instance as returned by NewInMemory. This backend uses a transient storage. Keys

crypto/keyring/keyring.go

@@ -180,7 +180,7 @@ func NewInMemoryWithKeyring(kr keyring.Keyring, cdc codec.Codec, opts ...Option)
 // New creates a new instance of a keyring.
 // Keyring options can be applied when generating the new instance.
 // Available backends are "os", "file", "kwallet", "memory", "pass", "test".
-func New(
+func newKeyringGeneric(
 	appName, backend, rootDir string, userInput io.Reader, cdc codec.Codec, opts ...Option,
 ) (Keyring, error) {
 	var (

crypto/keyring/keyring_linux.go

@@ -0,0 +1,43 @@
+//go:build linux
+// +build linux
+
+package keyring
+
+import (
+	"fmt"
+	"io"
+
+	"github.com/99designs/keyring"
+	"github.com/cosmos/cosmos-sdk/codec"
+)
+
+// Linux-only backend options.
+const BackendKeyctl = "keyctl"
+
+func newKeyctlBackendConfig(appName, _ string, _ io.Reader) keyring.Config {
+	return keyring.Config{
+		AllowedBackends: []keyring.BackendType{keyring.KeyCtlBackend},
+		ServiceName:     appName,
+		KeyCtlScope:     "user",
+		KeyCtlPerm:      0x3f3f0000,
+	}
+}
+
+// New creates a new instance of a keyring.
+// Keyring options can be applied when generating the new instance.
+// Available backends are "os", "file", "kwallet", "memory", "pass", "test", "keyctl".
+func New(
+	appName, backend, rootDir string, userInput io.Reader, cdc codec.Codec, opts ...Option,
+) (Keyring, error) {
+
+	if backend != BackendKeyctl {
+		return newKeyringGeneric(appName, backend, rootDir, userInput, cdc, opts...)
+	}
+
+	db, err := keyring.Open(newKeyctlBackendConfig(appName, "", userInput))
+	if err != nil {
+		return nil, fmt.Errorf("couldn't open keyring for %q: %w", appName, err)
+	}
+
+	return newKeystore(db, cdc, backend, opts...), nil
+}

crypto/keyring/keyring_other.go

@@ -0,0 +1,16 @@
+//go:build !linux
+// +build !linux
+
+package keyring
+
+import (
+	"io"
+
+	"github.com/cosmos/cosmos-sdk/codec"
+)
+
+func New(
+	appName, backend, rootDir string, userInput io.Reader, cdc codec.Codec, opts ...Option,
+) (Keyring, error) {
+	return newKeyringGeneric(appName, backend, rootDir, userInput, cdc, opts...)
+}