4

I would like to manage my ssh passwork with gnome-keyring. I am on Ubuntu 12.04.3 LTS, gnome3. I don't have root access to the system.

The question is in the title indeed:

gnome-keyring-daemon: insufficient process capabilities, unsecure memory might get used

This worries me. What does it mean?

5

Since you are not root on system, the process calling gnome-keyring-daemon does not have the privileges to prevent a possible write of the sensitive cryptographic key data to the system's hard disk.

What happens is that the gkd process does not have the ability to perform a CAP_IPC_LOCK to lock memory. If your filesystem supports capabilities, you can give the executable this capability with this terminal command:

sudo setcap cap_ipc_lock=+ep `which gnome-keyring-daemon`

Without this capability the key storage memory can not be locked, there is a chance the memory might swap out and be written to the hard disk, where it could be read by someone with either root access on the machine or physical access to the hard disk the memory swapped to.

Here is the source code of the file that generates that warning: https://github.com/GNOME/gnome-keyring/blob/master/daemon/gkd-capability.c

More information about memory locking: http://man7.org/linux/man-pages/man2/mlock.2.html

  • I think I can trust my computer admistrator, so should it be OK? – simona Feb 1 '14 at 23:07
  • 1
    As long as the hard disk is never in the hands of someone bad and as long as no one breaks in as root on the machine, you should be OK. – samiam Feb 1 '14 at 23:20
  • @samiam is this a matter of kernel configuration? man pages and googling really aren't working out finding out how to deliver gkd's complete happiness. – lkraav Dec 30 '14 at 17:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.