Add debian/agent-launch: Helper script for conditionally starting the SSH agent in the user session

Use it in ssh-agent.user-session.upstart. This will also be used in a
corresponding systemd user unit.

This replaces the backgrounded "ssh-agent -s" with a foreground task which
works more nicely with modern init systems for logging/debugging and
starting/stopping.

Also use a fixed socket file name in $XDG_RUNTIME_DIR -- under both upstart and
systemd we can assume this, and it allows restarting the service in a running
session.

4 files changed, 38 insertions, 18 deletions

diff --git a/debian/agent-launch b/debian/agent-launch
new file mode 100755
index 000000000..40479b868
--- /dev/null
+++ b/debian/agent-launch
@@ -0,0 +1,29 @@
+#!/bin/sh
+# helper script for launching ssh-agent, used by systemd unit and upstart job
+set -e
+
+if [ ! -d "$XDG_RUNTIME_DIR" ]; then
+    echo 'This needs $XDG_RUNTIME_DIR to be set' >&2
+    exit 1
+fi
+
+if [ "$1" = start ]; then
+    if [ -z "$SSH_AUTH_SOCK" ] && grep -s -q '^use-ssh-agent$' /etc/X11/Xsession.options; then
+        S="$XDG_RUNTIME_DIR/openssh_agent"
+        dbus-update-activation-environment --verbose --systemd SSH_AUTH_SOCK=$S SSH_AGENT_LAUNCHER=openssh
+        if type initctl >/dev/null 2>&1; then
+            initctl set-env --global SSH_AUTH_SOCK=$S
+        fi
+        exec ssh-agent -D -a $S
+    fi
+elif [ "$1" = stop ]; then
+    if [ "$SSH_AGENT_LAUNCHER" = openssh ]; then
+        dbus-update-activation-environment --systemd  SSH_AUTH_SOCK=
+        if type initctl >/dev/null 2>&1; then
+            initctl unset-env --global SSH_AUTH_SOCK
+        fi
+    fi
+else
+    echo "Unknown command $1" >&2
+    exit 1
+fi
diff --git a/debian/changelog b/debian/changelog
index 0977bc8c9..79d973bb8 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,10 +1,15 @@
 openssh (1:7.2p2-8) UNRELEASED; urgency=medium
 
+  [ Colin Watson ]
   * Stop enabling ssh-session-cleanup.service by default; instead, ship it
     as an example and add a section to README.Debian.  libpam-systemd >= 230
     and "UsePAM yes" should take care of the original problem for most
     systemd users (thanks, Michael Biebl; closes: #832155).
 
+  [ Martin Pitt ]
+  * Add debian/agent-launch: Helper script for conditionally starting the SSH
+    agent in the user session. Use it in ssh-agent.user-session.upstart.
+
  -- Colin Watson <cjwatson@debian.org>  Thu, 28 Jul 2016 22:04:37 +0100
 
 openssh (1:7.2p2-7) unstable; urgency=medium
diff --git a/debian/openssh-client.install b/debian/openssh-client.install
index fd6819a7c..fd9c02d1b 100755
--- a/debian/openssh-client.install
+++ b/debian/openssh-client.install
@@ -26,6 +26,8 @@ usr/share/man/man8/ssh-pkcs11-helper.8
 contrib/ssh-copy-id usr/bin
 debian/ssh-argv0 usr/bin
 
+debian/agent-launch usr/lib/openssh
+
 # dh_apport would be neater, but at the time of writing it isn't in unstable
 # yet.
 debian/openssh-client.apport => usr/share/apport/package-hooks/openssh-client.py
diff --git a/debian/ssh-agent.user-session.upstart b/debian/ssh-agent.user-session.upstart
index 385a9ecc6..672d2a0de 100644
--- a/debian/ssh-agent.user-session.upstart
+++ b/debian/ssh-agent.user-session.upstart
@@ -3,21 +3,5 @@ author "Stéphane Graber <stgraber@ubuntu.com>"
 
 start on starting xsession-init
 
-pre-start script
-    [ -e /etc/X11/Xsession.options ] || { stop; exit 0; }
-    grep -q "^use-ssh-agent$" /etc/X11/Xsession.options || { stop; exit 0; }
-    [ -z "$SSH_AUTH_SOCK" ] || { stop; exit 0; }
-
-    eval "$(ssh-agent -s)" >/dev/null
-    initctl set-env --global SSH_AUTH_SOCK=$SSH_AUTH_SOCK
-    initctl set-env --global SSH_AGENT_PID=$SSH_AGENT_PID
-    initctl set-env --global SSH_AGENT_LAUNCHER=upstart
-end script
-
-post-stop script
-    [ "$SSH_AGENT_LAUNCHER" = upstart ] || exit 0
-    kill $SSH_AGENT_PID 2>/dev/null || true
-    initctl unset-env --global SSH_AUTH_SOCK
-    initctl unset-env --global SSH_AGENT_PID
-    initctl unset-env --global SSH_AGENT_LAUNCHER
-end script
+exec /usr/lib/openssh/agent-launch start
+post-stop exec /usr/lib/openssh/agent-launch stop