Give the server its own session keyring on Linux

The server otherwise keeps the session keyring of the login session that
started it, which pam_keyinit(8) may revoke when that session ends,
leaving the server and its panes unable to use the kernel keyring. Join
a new session keyring with the user keyring linked in once the
configuration file has been loaded, and revoke it when the server exits.

This is controlled by a new session-keyring server option, on by
default.
This commit is contained in:
Ilya Priven
2026-10-12 11:26:28 +00:00
parent 82abcd175c
commit bba451c959
8 changed files with 83 additions and 0 deletions

View File

@@ -532,6 +532,14 @@ const struct options_table_entry options_table[] = {
.text = "Maximum number of commands to keep in history."
},
{ .name = "session-keyring",
.type = OPTIONS_TABLE_FLAG,
.scope = OPTIONS_TABLE_SERVER,
.default_num = 1,
.text = "Whether the server should join a new session keyring "
"(Linux only)."
},
{ .name = "set-clipboard",
.type = OPTIONS_TABLE_CHOICE,
.scope = OPTIONS_TABLE_SERVER,