pam_keyinit(8) — Справочная страница Linux

PAM_KEYINIT(8)              Linux-PAM Manual              PAM_KEYINIT(8)

НАЗВАНИЕ

       pam_keyinit - Kernel session keyring initialiser module

СИНТАКСИС

       pam_keyinit.so [debug] [force] [revoke]

ОПИСАНИЕ

       The pam_keyinit PAM module ensures that the invoking process has
       a session keyring other than the user default session keyring.

       The module checks to see if the process's session keyring is the
       user-session-keyring(7), and, if it is, creates a new
       session-keyring(7) with which to replace it. If a new session
       keyring is created, it will install a link to the user-keyring(7)
       in the session keyring so that keys common to the user will be
       automatically accessible through it. The session keyring of the
       invoking process will thenceforth be inherited by all its
       children unless they override it.

       In order to allow other PAM modules to attach tokens to the
       keyring, this module provides both an auth (limited to
       pam_setcred(3) and a session component. The session keyring is
       created in the module called. Moreover this module should be
       included as early as possible in a PAM configuration.

       This module is intended primarily for use by login processes. Be
       aware that after the session keyring has been replaced, the old
       session keyring and the keys it contains will no longer be
       accessible.

       This module should not, generally, be invoked by programs like
       su, since it is usually desirable for the key set to percolate
       through to the alternate context. The keys have their own
       permissions system to manage this.

       The keyutils package is used to manipulate keys more directly.
       This can be obtained from:

       Keyutils[1]

ПАРАМЕТРЫ

       debug
           Log debug information with syslog(3).

       force
           Causes the session keyring of the invoking process to be
           replaced unconditionally.

       revoke
           Causes the session keyring of the invoking process to be
           revoked when the invoking process exits if the session
           keyring was created for this process in the first place.

ТИПЫ МОДУЛЕЙ

       Only the session module type is provided.

ЗНАЧЕНИЯ, ВОЗВРАЩАЕМЫЕ ФУНКЦИЕЙ

       PAM_SUCCESS
           This module will usually return this value

       PAM_AUTH_ERR
           Authentication failure.

       PAM_BUF_ERR
           Memory buffer error.

       PAM_IGNORE
           The return value should be ignored by PAM dispatch.

       PAM_SERVICE_ERR
           Cannot determine the user name.

       PAM_SESSION_ERR
           This module will return this value if its arguments are
           invalid or if a system error such as ENOMEM occurs.

       PAM_USER_UNKNOWN
           User not known.

ПРИМЕРЫ

       Add this line to your login entries to start each login session
       with its own session keyring:

           session  required  pam_keyinit.so

       This will prevent keys from one session leaking into another
       session for the same user.

СМОТРИТЕ ТАКЖЕ

       pam.conf(5), pam.d(5), pam(8), keyctl(1)

АВТОР

       pam_keyinit was written by David Howells, <dhowells@redhat.com>.

ПРИМЕЧАНИЯ

        1. Keyutils
           http://people.redhat.com/~dhowells/keyutils/

КОЛОФОН

       This page is part of the linux-pam (Pluggable Authentication
       Modules for Linux) project.  Information about the project can be
       found at ⟨http://www.linux-pam.org/⟩.  If you have a bug report
       for this manual page, see ⟨//www.linux-pam.org/⟩.  This page was
       obtained from the project's upstream Git repository
       ⟨https://github.com/linux-pam/linux-pam.git⟩ on 2023-12-22.  (At
       that time, the date of the most recent commit that was found in
       the repository was 2023-12-18.)  If you discover any rendering
       problems in this HTML version of the page, or you believe there
       is a better or more up-to-date source for the page, or you have
       corrections or improvements to the information in this COLOPHON
       (which is not part of the original manual page), send a mail to
       man-pages@man7.org

Linux-PAM Manual               12/22/2023                 PAM_KEYINIT(8)

Страницы, ссылающиеся на эту страницу: keyrings(7), keyutils(7), session-keyring(7), user-keyring(7), user-session-keyring(7)