9

I would like to manage my ssh passwork with gnome-keyring. I am on Ubuntu 12.04.3 LTS, gnome3. I don't have root access to the system.

The question is in the title indeed:

gnome-keyring-daemon: insufficient process capabilities, unsecure memory might get used

This worries me. What does it mean?

Improve this question

1 Answer 1

Reset to default
10

Since you are not root on system, the process calling gnome-keyring-daemon does not have the privileges to prevent a possible write of the sensitive cryptographic key data to the system's hard disk.

What happens is that the gkd process does not have the ability to perform a CAP_IPC_LOCK to lock memory. If your filesystem supports capabilities, you can give the executable this capability with this terminal command:

sudo setcap cap_ipc_lock=+ep `which gnome-keyring-daemon`

Without this capability the key storage memory can not be locked, there is a chance the memory might swap out and be written to the hard disk, where it could be read by someone with either root access on the machine or physical access to the hard disk the memory swapped to.

Here is the source code of the file that generates that warning: https://github.com/GNOME/gnome-keyring/blob/master/daemon/gkd-capability.c

More information about memory locking: http://man7.org/linux/man-pages/man2/mlock.2.html

Improve this answer
3
  • I think I can trust my computer admistrator, so should it be OK?
    – simona
    Commented Feb 1, 2014 at 23:07
  • 1
    As long as the hard disk is never in the hands of someone bad and as long as no one breaks in as root on the machine, you should be OK.
    – samiam
    Commented Feb 1, 2014 at 23:20
  • @samiam is this a matter of kernel configuration? man pages and googling really aren't working out finding out how to deliver gkd's complete happiness.
    – lkraav
    Commented Dec 30, 2014 at 17:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .