Use of `runcon`/`runuser` added to fleetd 1.46.0 seems to cause excessive use of `/proc/keys`

[lucasmrod]

fleetd version: 1.46.0. Seems to happen on Fedora 42, but we haven't checked if it also happens on previous versions of Fedora.

---

💥  Actual behavior

Community thread: https://osquery.slack.com/archives/C01DXJL16D8/p1755685975925359

From community user:
Orbit seems to be causing problems with reaching default limit for /proc/sys/kernel/keys/maxkeys

$ wc -l /proc/keys
200 /proc/keys
$ sudo systemctl stop orbit.service
$ wc -l /proc/keys
8 /proc/keys

Seems to correlate to this change that was released in fleetd 1.46.0.

🧑‍💻  Steps to reproduce

1. Install fleetd 1.46.0 on Fedora 42 with Fleet Desktop enabled.
2. Check keys usage under /proc/keys (or use SELECT * FROM kernel_keys;).

🕯️ More info (optional)

More logs from the user:

while : ; do printf '%s: wc -l /proc/keys: %s\n' "$(date -u -Is)" "$(wc -l /proc/keys)"; sleep 1 ; done

2025-08-20T13:37:01+00:00: wc -l /proc/keys: 95 /proc/keys
2025-08-20T13:37:02+00:00: wc -l /proc/keys: 96 /proc/keys
...
2025-08-20T13:37:17+00:00: wc -l /proc/keys: 96 /proc/keys
2025-08-20T13:37:18+00:00: wc -l /proc/keys: 97 /proc/keys
...
2025-08-20T13:37:34+00:00: wc -l /proc/keys: 97 /proc/keys
2025-08-20T13:37:35+00:00: wc -l /proc/keys: 98 /proc/keys
...
2025-08-20T13:37:50+00:00: wc -l /proc/keys: 98 /proc/keys
2025-08-20T13:37:51+00:00: wc -l /proc/keys: 99 /proc/keys
...
2025-08-20T13:38:06+00:00: wc -l /proc/keys: 99 /proc/keys
2025-08-20T13:38:07+00:00: wc -l /proc/keys: 100 /proc/keys
...

each increment perfectly aligns with the following logs (example)

Aug 20 13:38:06 hostname orbit[3767336]: 2025-08-20T09:38:06-04:00 INF killing any pre-existing fleet-desktop instances
Aug 20 13:38:07 hostname orbit[3767336]: 2025-08-20T09:38:07-04:00 INF attempting to get user session type and display id=1000 user=xxxx
Aug 20 13:38:07 hostname orbit[3767336]: 2025-08-20T09:38:07-04:00 INF running runuser display=wayland-0 id=1000 path=/opt/orbit/bin/desktop/linux/stable/fleet-desktop/fleet-desktop session_type=wayland user=xx>
Aug 20 13:38:07 hostname orbit[3767336]: 2025-08-20T09:38:07-04:00 INF running command cmd="/usr/sbin/runuser -l xxxx -c runcon \"unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023\" env WAYLAND_DISPLAY=wa>
Aug 20 13:38:07 hostname orbit[3777934]: runcon: 'env': Permission denied