Agent socket security model documentation

Penn Mackintosh via Gnupg-devel <[email protected]> Tue, 19 Aug 2025 12:42:37 +0100

Newsgroups	gmane.comp.encryption.gpg.devel
Message-ID	<[email protected]>

Hi,

Is there any documentation on the correct agent sockets to expose for 
different levels of trust?

All I could find are these two:

  * https://wiki.gnupg.org/AgentForwarding
     > The extra socket is more restricted then the normal socket and
    Pinentry messages will differ when gpg-agent is accessed over this
    socket
  * https://www.gnupg.org/documentation/manuals/gnupg/Agent-Options.html
     > The intended use for this extra socket is to setup a Unix domain
    socket forwarding from a remote machine to this socket on the local
    machine. A gpg running on the remote machine may then connect to the
    local gpg-agent and use its private keys. This enables decrypting or
    signing data on a remote machine without exposing the private keys
    to the remote machine.

It might be good to have some documentation on this front, so that 
people who want to share their GPG agent sockets in new ways can do this 
safely. For example it is non-obvious that code execution can be 
triggered on some systems via S.gpg-agent but not via S.gpg-agent.extra.

Unfortunately I'm not well enough acquainted with GPG to write 
comprehensive documentation myself, but I'd probably start with a 
description of how much trust and power is assigned to each socket, 
perhaps with some examples.

Cheers,
Penn

-- 
Penn Mackintosh (he/him)

_______________________________________________
Gnupg-devel mailing list
[email protected]
https://lists.gnupg.org/mailman/listinfo/gnupg-devel

OpenPGP_0x7319A9305193F906.asc (application/pgp-keys, 5.6 KB)

-----BEGIN PGP PUBLIC KEY BLOCK-----

xjMEaIO9mhYJKwYBBAHaRw8BAQdAeBbJj/ohvphyjL4t4T0B+ILQhSEd0XrXBKbN
2i0bHKXNN0hhY2tpbnRvc2ggRml2ZSAoQ2F0Y2gtYWxsIGFkZHJlc3MpIDxjb250
YWN0QGhhY2s1LmRldj7CkwQTFgoAOxYhBAXXwB13pCQinEJALrsTnjBwM4TVBQJo
g75AAhsDBQsJCAcCAiICBhUKCQgLAgQWAgMBAh4HAheAAAoJELsTnjBwM4TVCC8A
/jTbAJ+O08XD4ZaU2LGBDBtAhIvwvUezI91gS5Vp78b1AQDKXb42fdfl2kH2uCtZ
8qnbvWccrEYQ8DVbaLjShPtjBc1ASGFja2ludG9zaCBGaXZlIChEZXByZWNhdGVk
IGlkZW50aXR5KSA8aGFja2ludG9zaGZpdmVAZ21haWwuY29tPsKTBBMWCgA7FiEE
BdfAHXekJCKcQkAuuxOeMHAzhNUFAmiDvhUCGwMFCwkIBwICIgIGFQoJCAsCBBYC
AwECHgcCF4AACgkQuxOeMHAzhNXoFQEA4u11shFqBAyEalVlMgwkZioC0agfCuHY
bQyrlq5F7EoA/j+TH4uufvBqaNVEWLHa9AlHN1pJVDqsEzJTgsvMlY8AzTlQZW5u
IE1hY2tpbnRvc2ggKENhdGNoLWFsbCBhZGRyZXNzKSA8cGVubkBwZW5ubWFjay5j
by51az7ClgQTFgoAPgIbAwULCQgHAgIiAgYVCgkICwIEFgIDAQIeBwIXgBYhBAXX
wB13pCQinEJALrsTnjBwM4TVBQJog757AhkBAAoJELsTnjBwM4TVz2MBAMS6eFRX
Kr672JlQdwM5ilUTlLzN8w8UFViU6GsiB1PeAP9A/0ciaYvEe9wgwPnYArfoY5Dg
Vbpz+pGCRJX6zHExAc0jUGVubiBNYWNraW50b3NoIDxwZW5uQG5ldGNyYWZ0LmNv
bT7CkwQTFgoAOxYhBAXXwB13pCQinEJALrsTnjBwM4TVBQJog7/IAhsDBQsJCAcC
AiICBhUKCQgLAgQWAgMBAh4HAheAAAoJELsTnjBwM4TVXW0A/i2c5m/9ElRkoyAV
YK4qCtiovUY4re20zJQiej4RMYZLAQCZ6ZiFpcdYsUK+3XWJ8H1ERfx0gVsjZZlX
Jku+mcSXC87ATQRomNllAQgAmnsFVWxL+aGi/GiqPMKt7CKOe2FGKQHpFFNn6Pu1
wNvuA2aG80Asmx8dYjB52WlJfEUydzM7Hb3vXjc8+Hu2sfs3VKwhAWuYfjDstmia
WwCBN/qsoe1qWI/YSd8hKVkNhPQbEzl+E446Fm4a1rp3jtA+jNVrUrsjZS4DsUS+
5P45lZRh8sKPy2vptPhsFBbFYoG4EzhM3/ampXfifngYIuKSA2q5ucHos3zRYQro
KOQceghlF9DLu27gOe8v5bN0HrySKsh1BC56WDVS1vyOmKiO97fXfOPJZPnWE4UN
TTq06fYq5TMU06foMDWO785JfmnHK2Q3cUAaxFbLzMVypQARAQABwsD0BBgWCgAm
FiEEBdfAHXekJCKcQkAuuxOeMHAzhNUFAmiY2WUCGwIFCQHhM4ABQAkQuxOeMHAz
hNXAdCAEGQEKAB0WIQQcLgudZs2RFZWHn37cPp135YS3vQUCaJjZZQAKCRDcPp13
5YS3vafwCACZqcXRdPZkX20y9ClUBkKN+jreZsk6xsEP56PrhA7H603nhNG1ivSc
4GM611hHHyTWu4S/foUl2sCt/IoUgR7wxQ5YAkFKGTtnc1Ms5INX0rHH7q1YSvSa
0626flbKXPl6TVw79A0zD7gRRlV9LkjLdoOYjCq3eg0VFhI0uzyWp++cIc0DnMeZ
aM/cSg9VH9aLoDUNfIa4DBS/0sy9covcYoA6Kxl7pSTmXMzJgHaBERjSFm4xHW+o
Hj2fC8b7fIX5cVYf5gDTgV4iMW/Opf2aLM+onSok0zAPvBxYhvPN3iy0ZMnWqbEv
9zHssa93dH0ZRzMyrd3DJvqZeKFkub06/eoA/i9onL3tjs5EtOB8org6atClT30a
8Y/Zv3KiZLg/lFfBAP9O+hLS+h7kEHytXOBC16hE1yLl+bX+m1vvgJ096G+uBc7A
TQRomNluAQgApIbn/+EzF1OX9buchW/W1gzfrl1TB+E+EImLXLLDajSldqeJMRd7
IulzQzjc0jI9fyJFkYu37hOgay78vK/06Rgq6TDZUdszXSqxkWJkEINmV4XgsABQ
xnaDz3cgjJg2ZMnE9H5z75+K6PtgMX2ChQZg2ix1wnOlUGbWhm7NBPbw6rjmEEqF
aMMxwY5CyI0UqdfYYAZX7KXyb5ck3A3zYb6+WMK+7q4AVx1swnDJ5IvMCLtQfZeY
z8w5jbQSkzTKJSQS9Oy0VoCahCshVTASjfa2GUa3AX3ug9dp6Dh/YONCpAxRjz5B
YaaNC8tBNDhV0N/l2BxXmQZtffd5njnKywARAQABwn4EGBYKACYWIQQF18Add6Qk
IpxCQC67E54wcDOE1QUCaJjZbgIbIAUJAeEzgAAKCRC7E54wcDOE1aAYAPsFt2yQ
MmQJi2ADbTd3RABlrLzjDPggRsYtAfnNNm7QtwEAmIvGy52QgdzNq84GLkLwn51e
oHwwADtx5/Pp/+L07AzOwE0EaJjYvgEIALhyI3QEckXOeuAqc8nt+40DrCDKrJIh
gALz05R3gPsB0aBOE8QoBBo0mSj+auk6TBmtoHwvVWwNbPwF3qE7ru2GCZWhY0qs
uz/ud3TUPrasAfiqbOuroqJKt8FJKRwmw9F7kUeYhg3FiUTTEa9yKImTU0BoMVxp
MNC+0v+jGHzQpPLfEwgeE8Nu1H14axZihOrBIsMsFQgBf9S5U8hTZZGE/e4dvc1q
0lDVturo9wWT9Jbe5NdHNMblurc+AFGUTNuXKUkGgJd5n1c7nBn8MxldxSoKFAh6
JbuhLhImKaWLhDPlwurgWvhinsMR2N71TkcBoRbxLXRAIstTQEkDKkEAEQEAAcJ+
BBgWCgAmFiEEBdfAHXekJCKcQkAuuxOeMHAzhNUFAmiY2L4CGyAFCQHhM4AACgkQ
uxOeMHAzhNUOcwD/Q7NLicXvmiU9Tsgak+rLjsDAjmIoGaWbpMuls1ecnRMBAMc4
dg3yWoi4GGHJ7Hu5bFq4KEOvrrf+FPSEjFqNz74AzsBNBGiY2VEBCADJot1FlGRF
l0xqXNM65aj4ltJSJt8Agv7+hn7eiuIEvJwF3HSYJ95bzLYufdq3Q2lYZcBHw0O6
wI2Zb4PDUQeAW3MMJhIjiKABjScyLFUcXv1lynoXJ3XlvRZ9rjxL/albNHY+4sKe
zsDiEFUvzpmCZkUcVx4YXyhIqwNcoYPLHiqqFpd2d9273ne2RidRgqjYN9tGTxiu
RxkCY4Sr5JhXrdIRRKth0fwqQzxwf7AN7ltQ969Qb9bQNhZ2r/tw5RMRKYvd+JiW
jDWX9dsho2BMZ4L2nMpIPkorPLcvKOATWZj4RYXPunXTsyo+cTjYzPBsYE3o1jqH
NF9Zr+mAHIBTABEBAAHCfgQYFgoAJhYhBAXXwB13pCQinEJALrsTnjBwM4TVBQJo
mNlRAhsMBQkB4TOAAAoJELsTnjBwM4TVnl4BAK0bhgT3802X7c5+7o97oVaG6K53
4hxpW4Nk1kghmk4oAP9VnT9EoXg9aFKAqBsXzIatBdtfgyd6UeJ2cKxS+MXMCM7A
TQRomNiuAQgAytIIB+vd7q4+gMi7Y35yvCM74pKCLgw69qGzL9E5WZDM3Y2m8Jp8
5D1Gv1g1ZDOkxFHQ8ZmRVGe9n+86SRf5/xgIULEyv1wG0zMMXF37iSKsCQmj2Lox
WMYW5Jwpg9TJxtX5JFfVAigyN0yB4Z9oG44Bgr32lDCpqIF0PK8sLW7ee6gHZRHQ
y0OfRt/pN4pLe3bEQhqYQGkvKYc8rKhWN45xzeG1ng1bVQHc6mg7qSQONGByLxFA
SGZQdeqjVNaHPXpVqcBS0XhnjIhUlcCtM1UN9tETmIEIHEDg9C2LWChEneVXdfta
F5y+rSNxZmhvj7pNulYoWtuYjqyp7lcZPQARAQABwsD0BBgWCgAmFiEEBdfAHXek
JCKcQkAuuxOeMHAzhNUFAmiY2K4CGwIFCQHhM4ABQAkQuxOeMHAzhNXAdCAEGQEK
AB0WIQQIJk0rPnibpat00NOEAWUw3vpYzwUCaJjYrgAKCRCEAWUw3vpYz5NEB/0c
yjjMtVuUY8FSzrW/pTSTgLs1iUNK5mWdZwRHKo2bh94pySCiykIcVofL/IObLm9i
oWqMRgdgk3U75xQd3nDgIC0n/qOVeH0DmIAo9XAy0GN5et6BYSJxdxkkGO3jxjCz
zazgTHeEJZzdiADUDEeJKIqXMlI6hhzqrKjHauJoF9ud0QVTTkExVDIyUdBVrv5s
Jo8JN5UtXnheKVQUdDU5yBqP6V8z6ZtouEq+mDplaqSZL6LdJpTTboGxd5iqbA2D
oYViZFTYlUbRh7qjLL31xs3FpMl6QmHigBbTIg6qm1FQL6zqCAyKgEBXqtDT1eL8
4CPzZcqlFgWl0Jlyp4bpsR0A/j5/QqOJdLnpYo6tWFJbOmGoS+V2sMiiQYY0F9OT
wdSuAP49HLkClt/q4dETE5CEY8dECQg5+HARilc9oWCwm5+KAM4zBGiDvysWCSsG
AQQB2kcPAQEHQCH9SgEwkfCY8yx+S5q0pVaG1DGJ8nSWLZL75h4Hc1TewsA1BBgW
CgAmFiEEBdfAHXekJCKcQkAuuxOeMHAzhNUFAmiDvysCGwIFCQWjmoAAgQkQuxOe
MHAzhNV2IAQZFgoAHRYhBCXCnjkDiQrl2jEQcU1PJQORU06CBQJog78rAAoJEE1P
JQORU06C3dsA/iTDauwpVj7QiwQT3RgaSJSB+t7ifeiogcmrwH7gC7EEAQDPd+6Y
JiMNsRDvPLybCIcQM+ex9Qd3Wqqx6YVEzj5WBxLbAP0aAwXQsbfU7NmR23kTas0H
meK2bqTthmnwm9ILMdWNCQD9E8JGATH5rSlFSfU/Ol8FCez2EDGFYxOgBHNWqdH5
pA3OOARog72aEgorBgEEAZdVAQUBAQdAP5woMi4sJ6Crl5QOP1mePdaHZwHljgKd
aw/CVkU4WxoDAQgHwn4EGBYKACYCGwwWIQQF18Add6QkIpxCQC67E54wcDOE1QUC
aIPANQUJBaOdGwAKCRC7E54wcDOE1exaAP9aTzDtfid9fmGFst1WqrYaN3iya6gF
zIlgoYcc7gxtIwD+NJfZyhaPlDLzjJ/KiFtkM5XKQcmr2Kulm2B37QAZMAvOOARo
mNg+EgorBgEEAZdVAQUBAQdAYqwsVAgWHQy8mnsQTmLRATl0VMQBCrJmoskuSSl8
NFMDAQgHwn4EGBYKACYWIQQF18Add6QkIpxCQC67E54wcDOE1QUCaJjYPgIbDAUJ
AeEzgAAKCRC7E54wcDOE1WXJAP900iVQVIJJoD0GUr1CPJp8FzroIiEGqTeq0Jjd
8BPZzwEA16t4jgImKc9+PQEyqWruF+SKuY7ykv1/eTK3B99jGg4=
=jz8a
-----END PGP PUBLIC KEY BLOCK-----

OpenPGP_signature.asc (application/pgp-signature, 488 B)

-----BEGIN PGP SIGNATURE-----

iQEzBAEBCgAdFiEEHC4LnWbNkRWVh59+3D6dd+WEt70FAmikYy0ACgkQ3D6dd+WE
t73dJAgAkkyt0SJk3Uxlwj0GFLxaKjUoECcEpsIdvJXSjhNkqq8xPDi8dVTnzknG
S9ncuTz+u+l3eRN7Y1+tHkNG9ZI7dCdfu0G+9UzlqL57wVpU+vIxSqVD6x/Y9eE0
h+HM5WJ8A/fGUa5VUtQTaa33WblORINIQcimoE+b3o4zhwqn5kb/JSK7ktxtfhcq
gsnwt9yGPaLmq0RxfmcyiciCcRdgoTU7kI208hl8ZMLL2sdnfoE22Rk9KDZ0uG92
UdbA796yNf+l9pjL+4kt6sJdLriVI8N9Rxfe3xCFDPMD8+/pvFU+OI1T+yU0aObK
qIhIJVqTo9IWVyVOJgkzCmbJMEPT+Q==
=++0D
-----END PGP SIGNATURE-----