Give the server its own session keyring on Linux

The server otherwise keeps the session keyring of the login session that
started it, which pam_keyinit(8) may revoke when that session ends,
leaving the server and its panes unable to use the kernel keyring. Join
a new session keyring with the user keyring linked in once the
configuration file has been loaded, and revoke it when the server exits.

This is controlled by a new session-keyring server option, on by
default.
This commit is contained in:
Ilya Priven
2026-10-12 11:26:28 +00:00
parent 82abcd175c
commit bba451c959
8 changed files with 83 additions and 0 deletions

View File

@@ -795,6 +795,13 @@ else
AC_LIBOBJ(daemon)
fi
# Look for linux/keyctl.h, compat/keyring-linux.c used if found.
AC_CHECK_HEADER(linux/keyctl.h, found_keyctl=yes, found_keyctl=no)
if test "x$found_keyctl" = xyes; then
AC_DEFINE(HAVE_KEYCTL)
fi
AM_CONDITIONAL(HAVE_KEYCTL, [test "x$found_keyctl" = xyes])
# Look for stravis, compat/{vis,unvis}.c used if missing.
AC_CHECK_FUNC(stravis, found_stravis=yes, found_stravis=no)
if test "x$found_stravis" = xyes; then