PAM_KEYINIT(8)

💅 pam_keyinit — the kernel session keyring initialiser module (yes bestie, PAM_KEYINIT(8))

okay so picture this: you log in, and the kernel is like "here's a keyring" and you're like "whose keyring is this" and it's the user default one and that's lowkey a mess. this module fixes that. let's go ✨

---

🎀 SYNOPSIS 🎀

pam_keyinit.so [debug] [force] [revoke]

---

🦋 DESCRIPTION 🦋

okay so pam_keyinit is that friend who shows up and makes sure your setup is actually yours. it makes sure the invoking process has a session keyring that is not the user default session keyring. like, you deserve your own.

here's the tea: the module checks whether the process's session keyring is the user-session-keyring(7). if it is, it creates a brand new session-keyring(7) and replaces it with that. glow up. 🔥

and if a new session keyring gets created, it installs a link to the user-keyring(7) inside that session keyring, so that keys common to the user are automatically accessible through it. it's giving interconnected. the session keyring of the invoking process will thenceforth be inherited by all its children, unless those children override it. generational wealth but for keyrings 💖

now — so that other PAM modules can attach tokens to the keyring, this module provides both an auth component (limited to pam_setcred(3)) and a session component. the session keyring is created in the module called. and honestly? this module should be included as early as possible in a PAM configuration. first in line, main character energy 👑

this module is intended primarily for use by login processes. and bestie, real talk:

be aware that after the session keyring has been replaced, the old session keyring and the keys it contains will no longer be accessible. gone. poof. 🫠

this module should not, generally, be invoked by programs like su, since it is usually desirable for the key set to percolate through to the alternate context. the keys have their own permissions system to manage this. they handle their own business, okay? let them. 🧚

the keyutils package is used to manipulate keys more directly. it can be obtained from:

Keyutils[1]

---

✨ OPTIONS ✨

• debug — logs debug information with syslog(3). so you can see what's happening. nosy but make it useful 🙈
• force — causes the session keyring of the invoking process to be replaced unconditionally. no questions asked. no vibe check. just replacement 💅
• revoke — causes the session keyring of the invoking process to be revoked when the invoking process exits, if the session keyring was created for this process in the first place. it leaves when you leave. iconic behavior 🎀

---

🌈 MODULE TYPES PROVIDED 🌈

only the session module type is provided. that's it, that's the whole list. one (1) vibe 💜

---

⭐ RETURN VALUES ⭐

• PAM_SUCCESS — this module will usually return this value. the default. the standard. the everyday slay ✨
• PAM_AUTH_ERR — authentication failure. 😭
• PAM_BUF_ERR — memory buffer error. 🫠
• PAM_IGNORE — the return value should be ignored by PAM dispatch. don't perceive it 💀
• PAM_SERVICE_ERR — cannot determine the user name. who even are you 😭
• PAM_SESSION_ERR — this module will return this value if its arguments are invalid or if a system error such as ENOMEM occurs. arguments? invalid? in this economy? 💀
• PAM_USER_UNKNOWN — user not known. never heard of her 💅

---

🌸 EXAMPLES 🌸

add this line to your login entries to start each login session with its own session keyring:

session  required  pam_keyinit.so

this will prevent keys from one session leaking into another session for the same user. no cross-contamination, no drama, no leaks. periodt 🫶

---

👑 SEE ALSO 👑

pam.conf(5), pam.d(5), pam(8), keyctl(1)

---

💖 AUTHOR 💖

pam_keyinit was written by David Howells, <dhowells@redhat.com>. thank you king 🫡

---

📝 NOTES 📝

1. Keyutils — http://people.redhat.com/~dhowells/keyutils/

---

okay that's the whole page bestie, you're officially keyring-pilled 🦋 this was Linux-PAM, dated 09/27/2026, and it lives in section PAM_KEYINIT(8). mwah, go forth and have your own session keyring 💜✨🎀