1

Recent versions of gpg launch a persistent user process (gpg-agent) when generating keys. This process remains running even after the command terminates. I want to change this behavior.

Currently, I'm using unshare and PID namespaces to isolate and kill off anything that gpg leaves running. Unfortunately, this approach requires elevated privileges that may not always be available (root and access to pid/mount namespace).

Is there a way for a script to "cleanly" generate gpg keys using gpg without

  1. leaving processes running, or
  2. requiring elevated privileges?

For the sake of completion, the following roughly illustrates my current setup:

sudo unshare -fp --mount-proc sh -c 'gpg --homedir /tmp/TEMP_DIR --generate-key --batch; kill -9 -1' <<EOF
Key-Type: DSA
Key-Length: 768
Name-Real: TEMPKEY
Name-Comment: TEMPKEY
Name-Email: noreply@localhost
Expire-Date: 0
%no-protection
EOF
  • gpg2 has a new option --no-autostart to not start an agent. – meuh Jun 30 at 7:17
  • gpg (GnuPG 2.2.4) refuses to start for me when --no-autostart is given. – Tenders McChiken Jun 30 at 8:59
1

One possibility is to stop the agent once you no longer need it:

gpgconf --kill gpg-agent

Since you’re using a custom home directory, you need to set GNUPGHOME or specify --homedir:

GNUPGHOME=/tmp/TEMP_DIR gpgconf --kill gpg-agent

If you want to stop all GnuPG-related processes, specify all instead of gpg-agent.

| improve this answer | |
  • For cases like mine that involve a custom home directory, you need to also set the GNUPGHOME environment variable. Also, for my purpose, specifying all instead of gpg-agent appears to be more appropriate: GNUPGHOME=/tmp/TEMP_DIR gpgconf --kill all – Tenders McChiken Jun 30 at 8:57
  • 1
    Thanks, I’ve added all that to the answer. – Stephen Kitt Jun 30 at 9:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.