/*
 * Copyright (c) 2026 Ilya Priven <ikon@google.com>
 *
 * Permission to use, copy, modify, and distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 * WHATSOEVER RESULTING FROM LOSS OF MIND, USE, DATA OR PROFITS, WHETHER
 * IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING
 * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */

#include <sys/types.h>
#include <sys/syscall.h>

#include <linux/keyctl.h>
#include <errno.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

#include "tmux.h"

/*
 * Create a new session keyring since the current one belongs to the login
 * session which we're meant to outlive (and pam_keyinit(8) is likely to revoke
 * the login session's keyring when it ends). Link the keys from the current
 * session keyring into it so they remain available after that.
 */
void
fork_session_keyring(void)
{
	int32_t	*keys = NULL;
	long	 size = 0, n, i;

	/* KEYCTL_READ returns the full size; retry if keys were added. */
	for (;;) {
		n = syscall(SYS_keyctl, KEYCTL_READ, KEY_SPEC_SESSION_KEYRING,
		    keys, size);
		if (n <= size)
			break;
		size = n;
		keys = xrealloc(keys, size);
	}
	n = n > 0 ? n / sizeof *keys : 0;

	/*
	 * Link the current session keyring into the thread keyring so we still
	 * possess its keys (and so are allowed to link them) after leaving it.
	 */
	if (syscall(SYS_keyctl, KEYCTL_LINK, KEY_SPEC_SESSION_KEYRING,
	    KEY_SPEC_THREAD_KEYRING) == -1)
		log_debug("%s: link failed: %s", __func__, strerror(errno));

	if (syscall(SYS_keyctl, KEYCTL_JOIN_SESSION_KEYRING, NULL) == -1) {
		log_debug("%s: join failed: %s", __func__, strerror(errno));
		goto out;
	}
	for (i = 0; i < n; i++) {
		if (syscall(SYS_keyctl, KEYCTL_LINK, keys[i],
		    KEY_SPEC_SESSION_KEYRING) == -1) {
			log_debug("%s: link %d failed: %s", __func__, keys[i],
			    strerror(errno));
		}
	}
	if (syscall(SYS_keyctl, KEYCTL_LINK, KEY_SPEC_USER_KEYRING,
	    KEY_SPEC_SESSION_KEYRING) == -1)
		log_debug("%s: link failed: %s", __func__, strerror(errno));

out:
	syscall(SYS_keyctl, KEYCTL_CLEAR, KEY_SPEC_THREAD_KEYRING);
	free(keys);
}