Give the server its own session keyring on Linux

The server otherwise keeps the session keyring of the login session that
started it, which pam_keyinit(8) may revoke when that session ends,
leaving the server and its panes unable to use the kernel keyring. Join
a new session keyring with the user keyring linked in once the
configuration file has been loaded, and revoke it when the server exits.

This is controlled by a new session-keyring server option, on by
default.
This commit is contained in:
Ilya Priven
2026-10-12 11:26:28 +00:00
parent 82abcd175c
commit bba451c959
8 changed files with 83 additions and 0 deletions

8
tmux.1
View File

@@ -5096,6 +5096,14 @@ each client.
.It Ic prompt\-history\-limit Ar number
Set the number of history items to save in the history file for each type of
command prompt.
.It Xo Ic session\-keyring
.Op Cm on | off
.Xc
On Linux, if enabled (the default), the server joins a new session keyring with
the user keyring linked into it, rather than keeping the session keyring of the
login session it was started from, which may be revoked when that session ends.
The new keyring is revoked when the server exits.
This option is checked once the configuration file has been loaded.
.It Xo Ic set\-clipboard
.Op Cm on | external | off
.Xc