From 9ada0093e92388590c7368600ca4e9e3e376f0d0 Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Sun, 7 Apr 2024 16:22:51 +0200 Subject: Adding upstream version 1.5.2. Signed-off-by: Daniel Baumann --- modules/pam_keyinit/README | 67 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 67 insertions(+) create mode 100644 modules/pam_keyinit/README (limited to 'modules/pam_keyinit/README') diff --git a/modules/pam_keyinit/README b/modules/pam_keyinit/README new file mode 100644 index 0000000..fa50370 --- /dev/null +++ b/modules/pam_keyinit/README @@ -0,0 +1,67 @@ +pam_keyinit — Kernel session keyring initialiser module + +━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ + +DESCRIPTION + +The pam_keyinit PAM module ensures that the invoking process has a session +keyring other than the user default session keyring. + +The module checks to see if the process's session keyring is the +user-session-keyring(7), and, if it is, creates a new session-keyring(7) with +which to replace it. If a new session keyring is created, it will install a +link to the user-keyring(7) in the session keyring so that keys common to the +user will be automatically accessible through it. The session keyring of the +invoking process will thenceforth be inherited by all its children unless they +override it. + +In order to allow other PAM modules to attach tokens to the keyring, this +module provides both an auth (limited to pam_setcred(3) and a session +component. The session keyring is created in the module called. Moreover this +module should be included as early as possible in a PAM configuration. + +This module is intended primarily for use by login processes. Be aware that +after the session keyring has been replaced, the old session keyring and the +keys it contains will no longer be accessible. + +This module should not, generally, be invoked by programs like su, since it is +usually desirable for the key set to percolate through to the alternate +context. The keys have their own permissions system to manage this. + +The keyutils package is used to manipulate keys more directly. This can be +obtained from: + +Keyutils + +OPTIONS + +debug + + Log debug information with syslog(3). + +force + + Causes the session keyring of the invoking process to be replaced + unconditionally. + +revoke + + Causes the session keyring of the invoking process to be revoked when the + invoking process exits if the session keyring was created for this process + in the first place. + +EXAMPLES + +Add this line to your login entries to start each login session with its own +session keyring: + +session required pam_keyinit.so + + +This will prevent keys from one session leaking into another session for the +same user. + +AUTHOR + +pam_keyinit was written by David Howells, . + -- cgit v1.2.3