session-keyring(7)

💖 session-keyring(7) — the session shared process keyring 💖

okay so bestie, welcome to the manual page for session-keyring — literally the group chat of keyrings. it lives in the Miscellaneous Information Manual section, and it is so good. let's get into it 🫶

---

✨ NAME ✨

session-keyring — the session shared process keyring 🎀

---

🌸 DESCRIPTION 🌸

The session keyring is a keyring that anchors keys on behalf of a process. think of it as the process's emotional support keyring. it's typically created by pam_keyinit(8) right when a user logs in, and a link gets added that refers to the user-keyring(7) — so everything is connected, iykyk 💅

Optionally, PAM(7) may revoke the session keyring on logout. and ngl, in typical configurations, PAM does do this revocation. so it's not hypothetical, bestie, it really happens. ⚠️

the session keyring has the name (description) _ses. that's its whole government name, adorable.

A special serial number value, KEY_SPEC_SESSION_KEYRING, is defined, and you can use it in lieu of the actual serial number of the calling process's session keyring. iconic shortcut behavior, honestly.

From the keyctl(1) utility, '@s' can be used instead of a numeric key ID, in much the same way. same vibe, different spelling ✨

A process's session keyring is inherited across clone(2), fork(2), and vfork(2). so it's giving family heirloom 🧬

The session keyring is preserved across execve(2) — even when the executable is set-user-ID or set-group-ID or has capabilities. wow. she persists. 💅

The session keyring is destroyed when the last process that refers to it exits. rip bestie, you will be missed 😭

If a process doesn't have a session keyring when it is accessed, then, under certain circumstances, the user-session-keyring(7) will be attached as the session keyring, and under others a new session keyring will be created. (see user-session-keyring(7) for further details — that's where the lore lives, fr fr.)

---

🦋 Special operations 🦋

The keyutils library provides the following special operations for manipulating session keyrings:

• keyctl_join_session_keyring(3) — This operation lets the caller change the session keyring that it subscribes to. The caller can join an existing keyring with a specified name (description), create a new keyring with a given name, or ask the kernel to create a new "anonymous" session keyring with the name "_ses". (This function is an interface to the keyctl(2) KEYCTL_JOIN_SESSION_KEYRING operation.) no cap, you get to pick your own keyring destiny ✨
• keyctl_session_to_parent(3) — This operation lets the caller make the parent process's session keyring the same as its own. For this to succeed 💀 the parent process must have identical security attributes and must be single threaded. (This function is an interface to the keyctl(2) KEYCTL_SESSION_TO_PARENT operation.) so like, both conditions or it's not happening, periodt.

🔥 these two? absolutely main character energy. but respect the constraints, bestie.

These operations are also exposed through the keyctl(1) utility as:

keyctl session
keyctl session - [<prog> <arg1> <arg2> ...]
keyctl session <name> [<prog> <arg1> <arg2> ...]

and:

keyctl new_session

---

💜 SEE ALSO 💜

• keyctl(1)
• keyctl(3)
• keyctl_join_session_keyring(3)
• keyctl_session_to_parent(3)
• keyrings(7)
• PAM(7)
• persistent-keyring(7)
• process-keyring(7)
• thread-keyring(7)
• user-keyring(7)
• user-session-keyring(7)
• pam_keyinit(8)

---

🌈 that's the whole page bestie, you ate it. go forth and keyring responsibly ✨

this lil love letter to session keyrings came from Linux man-pages 6.20, dated 2026-02-08 🎀 bye pookie 💖