circlecloud/tmux
1
0
Fork 0
mirror of https://github.com/tmux/tmux.git synced 2026-10-16 08:24:23 +00:00
Code Issues Projects Releases Wiki Activity

Replace the session-keyring option with a configure option

Browse Source 
Join the new session keyring when the server starts rather than once the
configuration file has been loaded, and control it at build time with
--enable-keyring, on by default if linux/keyctl.h is found.

Rename keyring_join and keyring_revoke to new_session_keyring and
revoke_session_keyring.
This commit is contained in:
Ilya Priven
2026-10-12 11:26:28 +00:00
parent 3d0839b7a3
commit 90cc41de32
8 changed files with 34 additions and 60 deletions
Download Patch File Download Diff File Expand all files Collapse all files

44
regress/session-keyring.sh
View File

@@ -1,8 +1,8 @@
#!/bin/sh
# On Linux the server should join a session keyring of its own unless the
# session-keyring option is off, so it keeps working after the login session's
# keyring is revoked, and revoke it when it exits.
# On Linux the server should join a session keyring of its own, so it keeps
# working after the login session's keyring is revoked, and revoke it when it
# exits.
PATH=/bin:/usr/bin
TERM=screen
@@ -12,10 +12,8 @@ keyctl session - true >/dev/null 2>&1 || exit 0
[ -z "$TEST_TMUX" ] && TEST_TMUX=$(readlink -f ../tmux)
OUT=$(mktemp -d)
TMUX="$TEST_TMUX -LtestA$$ -f/dev/null"
TMUX2="$TEST_TMUX -LtestB$$ -f$OUT/conf"
TMUX="$TEST_TMUX -Ltest$$ -f/dev/null"
$TMUX kill-server 2>/dev/null
$TMUX2 kill-server 2>/dev/null
fail()
{
@@ -26,35 +24,11 @@ fail()
cleanup()
{
$TMUX kill-server 2>/dev/null
$TMUX2 kill-server 2>/dev/null
[ -s $OUT/holder ] && kill $(cat $OUT/holder) 2>/dev/null
rm -rf "$OUT"
}
trap cleanup 0 1 15
# Set KEYRING to the session keyring of a new pane on server $1.
pane_keyring()
{
$1 new-window -d "keyctl id @s >$OUT/pane 2>&1; $1 wait-for -S pane" ||
fail "could not create pane"
$1 wait-for pane
KEYRING=$(cat $OUT/pane)
case "$KEYRING" in
''|*[!0-9]*)
fail "pane keyring not usable: $KEYRING"
;;
esac
}
# With the option off, the server should keep the keyring it was started with.
echo 'set -g session-keyring off' >$OUT/conf
OFF=$(keyctl session - sh -c "
$TMUX2 new -d 'sleep 1000' && keyctl id @s
" 2>/dev/null) || fail "could not start server"
pane_keyring "$TMUX2"
[ "$KEYRING" = "$OFF" ] || fail "pane has a new keyring with option off"
$TMUX2 kill-server
# Start the server from a login session with its own keyring, then revoke that
# keyring as pam_keyinit(8) does when the login session ends.
LOGIN=$(keyctl session - sh -c "
@@ -62,7 +36,15 @@ LOGIN=$(keyctl session - sh -c "
" 2>/dev/null) || fail "could not start server"
# A new pane should still have a usable keyring, with the user keyring linked.
pane_keyring "$TMUX"
$TMUX new-window -d "keyctl id @s >$OUT/pane 2>&1; $TMUX wait-for -S pane" ||
fail "could not create pane"
$TMUX wait-for pane
KEYRING=$(cat $OUT/pane)
case "$KEYRING" in
''|*[!0-9]*)
fail "pane keyring not usable: $KEYRING"
;;
esac
[ "$KEYRING" != "$LOGIN" ] || fail "pane has the login keyring"
keyctl rlist $KEYRING | grep -qw "$(keyctl id @u)" ||
fail "user keyring not linked"