I'm facing a ugly problem with my system. my login manager (LightDM) is starting gnome-keyring-daemon at login successfully and unlocking my keyring as it should (EDIT: Everything via PAM).

The thing is, I get gnome-keyring-daemon started with just one component: secrets, but I need all these: pkcs11, secrets, ssh, and gpg. I don't know why the latter is not the default, I neither know if I should report this to the package maintainer.

The file /usr/share/dbus-1/services/org.freedesktop.secrets.service defines how gnome-keyring-daemon should run:

[D-BUS Service]
Exec=/usr/bin/gnome-keyring-daemon --start --foreground --components=secrets

I could just edit it on Emacs and problem solved, but, that's dirty and my changes will be gone for the next upgrade of the gnome-keyring package.

So, the question is: How do I change the Exec line of that service while preventing this to be lost in the next system upgrade? Is there a way to enable custom services and disable those services that comes by default?

The relevant packages and their versions installed on my system.

$ LC_ALL=C pacman -Qi dbus gnome-keyring lightdm | egrep "(Name|Version)"
Name           : dbus
Version        : 1.8.8-1
Name           : gnome-keyring
Version        : 3.12.2-1
Name           : lightdm
Version        : 1:1.12.0-1

2 Answers 2


Ok, I found a way to solve this issue. This not address my question directly, but solves the issue that pushed me to ask here.

The problem

as it was, gnome-keyring wasn't unlocking my GPG keys, so I was asked for the password of my GPG key every time I login (because Emacs reads a .gpg file for configuration), all my passwords were available after login so offlineimap didn't complain about don't be able to get the passwords of my e-mail account at all when working.

I tried then to start gnome-keyring-daemon from the .xprofile (which is read by LightDM, other DM may read different files) in this way:


eval $(gnome-keyring-daemon --start --components=gpg,pkcs11,secrets,ssh)

After rebooting (I like this best than logout and login again) and login, I wasn't asked for my GPG key password, however offlineimap was complaining about not being able to get the passwords of my e-mail accounts. Running seahorse I notice that there is no Passwords section.

The solution

After fighting for few hours and trying many different combinations (one of them, showing the Passwords section but with the folder Login locked!) I found out what was the correct solution:


source /etc/X11/xinit/xinitrc.d/30-dbus  # You need a dbus session, duh
eval $(gnome-keyring-daemon --start --components=gpg,pkcs11,secrets,ssh)

Done. problem solved. el es fin, muchachos.

EDIT: Beware, your gnome-keyring-daemon may issue more environment variables for you to export. To be sure you don't need more than GPG_AGENT_INFO or SSH_AUTH_SOCK run gnome-keyring-daemon --start --components=gpg,pkcs11,secrets,ssh from your shell and add more variables to export sentence according.

Please note that LightDM is still starting gnome-keyring-daemon thanks to its PAM configuration and I wouldn't recommend you to change such configuration. However, if you find yourself inserting your password after login to unlock something on gnome-keyring, it might be because LightDM is not providing your password to it. I did this addition to LightDM PAM module /etc/pam.d/lightdm:

auth       optional    pam_gnome_keyring.so try_first_pass

The addition was the try_first_pass thing (reading The Linux-PAM System Administrators' Guide is not a bad idea), in my system LightDM don't have that parameter included.

This is how I solved my problem with Gnome Keyring!


(answering the question in the title as it is useful by itself)

According to the documentation of D-Bus,

If two .service files in different directories offer the same service name, the one in the higher-priority directory is used: for instance, on the system bus, .service files in /usr/local/share/dbus-1/system-services take precedence over those in /usr/share/dbus-1/system-services.

Also, according to the manpage of dbus-daemon,

On Unix, the standard session service directories are:

  • $XDG_RUNTIME_DIR/dbus-1/services, if XDG_RUNTIME_DIR is set
  • $XDG_DATA_HOME/dbus-1/services, where XDG_DATA_HOME defaults to ~/.local/share
  • directory/dbus-1/services for each directory in XDG_DATA_DIRS, where XDG_DATA_DIRS defaults to /usr/local/share:/usr/share
  • ${datadir}/dbus-1/services for the ${datadir} that was specified when dbus was compiled, typically /usr/share

So, in your case, you could copy the service file to ~/.local/share/dbus-1/services/org.freedesktop.secrets.service and modify it to your requirements. The original file will then be ignored completely.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .