x/sys/unix: KeyctlString() panics for key types that can legally contain "no payload at all

What version of Go are you using (go version)?

Does this issue reproduce with the latest release?

yes

What operating system and processor architecture are you using (go env)?

What did you do?

https://go.dev/play/p/60ZtM3V4_Io

This program needs to run on Linux - and not in a dev/play container (where the keyctl syscall is masked). On a VM, it panics thus:

This is because unix.KeyctlString() assumes key lengths are always > 0 (and it can "strip the trailing null byte") at the very least. But It is possible for certain key types (keyrings, notably) to be "legally empty", and a unix.KeyctlBuffer() on these will correctly return zero for the length..

What did you expect to see?

Not panic. Return"", nil (zero-length content, no error). This would be trivially achievable by changing https://github.com/golang/sys/blob/master/unix/syscall_linux.go#L1392,

if err != nil {
        return "", err
}

into:

if err != nil || length == 0 {
...

What did you see instead?

Panic in go standard lib. Completely unnecessary.