IIUC eCryptfs needs the key only when calling Mount::RememberMount(), so clearing the user keyring shouldn't affect the already mounted eCryptfs user directories.

The kernel needs it for the life of the mount:
for instance, in ecryptfs_read_metadata(), we end up requesting the key via ecryptfs_keyring_auth_tok_for_sig(): by definition, ecryptfs can not cache the secret content of the key, defeating the purpose of the keyring.

Sorry for the confusion, eCryptfs needs the key, but the key doesn't need to be present under the session keyring after the mount is performed so clearing the keyring doesn't affect the behavior.
You can run "keyctl clear @u" as the root after logging in to an eCryptfs user, and you can still run "keyctl describe" to show the status of the eCryptfs keys.
I'm not familiar with eCryptfs implementation, but I guess it's doing something to prevent the key from being invalidated as long as the mount is alive?

BTW, I found that ClearUserKeyring call was added in https://codereview.chromium.org/2645008 (at this time, the function's name was ClearKeyset()).
The change is poorly documented so I cannot figure out the original intention, but I guess it's just to make sure that the keyring is clean.

Because many things have changed since then (e.g. introduction of multi-profile support), I guess it's safe to remove that ClearUserKeyring() call from MountCryptohomeInner().
WDYT?

Archiving P3s older than 1 year with no owner or component.