2

I use Gnome Keyring as the password storage backend for various applications. Many of the entries are for different ways to log into the same account, accessed through different means. I've changed my password on this account, now I want to update all the entries in my keyring.

I usually use Seahorse to edit the keyring, but it only lets me edit individual entries with a slightly awkward sequence of key presses or mouse clicks. With many passwords to change, that's tedious.

How can I update my password for many entries in Gnome Keyring efficiently, i.e. without having to type it again and again?

2

Following meuh's advice I wrote a Python script to change the passwords for all the entries matching certain conditions (e.g. a certain username and server name). The script requests the old password as a sanity check and only changes entries with the specified old password. Sample usage:

gnome-keyring-change-passwords 'user|username_value=^gilles$' 'action_url|server=acme\.example\.com'

Warning: the code has satisfactorily run once. That's the extent of my testing.

#!/usr/bin/env python
import getpass, re, sys
import gnomekeyring

def getpass2(prompt):
    input1 = getpass.getpass(prompt)
    input2 = getpass.getpass('Repeat ' + prompt)
    if input1 != input2:
        raise ValueError, 'password mismatch'
    return input1

def check_conditions(conditions, attributes):
    for (names, regexp) in conditions:
        value = ''
        for name in names:
            if attributes.has_key(name):
                value = attributes[name]
                break
        if not re.search(regexp, value): return False
    return True

def parse_condition_string(arg):
    eq = arg.index('=')
    return arg[:eq].split('|'), re.compile(arg[eq+1:])

def change_passwords(keyring_name, conditions, old_password, new_password):
    '''Change the password in many Gnome Keyring entries to new_password.

Iterate over the keyring keyring_name. Only items matching conditions and where
the current password is old_password are considered. The argument conditions
is a list of elements of the form (names, regexp) where names is a list of
attribute names. An item matches the condition if the value of the first
attribute in names that is present on the item contains a match for regexp.
'''
    all_items = gnomekeyring.list_item_ids_sync(keyring_name)
    for item in all_items:
        attributes = gnomekeyring.item_get_attributes_sync(keyring_name, item)
        if not check_conditions(conditions, attributes): continue
        info = gnomekeyring.item_get_info_sync(keyring_name, item)
        display_name = info.get_display_name()
        if info.get_secret() == old_password:
            print 'changing:', display_name
            info.set_secret(new_password)
            gnomekeyring.item_set_info_sync(keyring_name, item, info)
        else:
            print 'has different password, skipping:', display_name

def change_password_ui(condition_strings):
    conditions = map(parse_condition_string, condition_strings)
    old_password = getpass.getpass('Old password:')
    new_password = getpass2('New password:')
    change_passwords('login', conditions, old_password, new_password)

if __name__ == '__main__':
    if '--help' in sys.argv:
        sys.stdout.write('''Usage: ' + sys.argv[0] + ' [CONDITION...]
Change multiple entries in the Gnome Keyring login keyring.
Prompt for the old and new password. Only entries for which the old password
matches are modified.

''')
    else:
        change_password_ui(sys.argv[1:])
1

There's a python package for the gnome keyring API. You can follow a sort of tutorial: bending-gnome-keyring-with-python which has some examples of searching for and setting passwords.

There's also a command secret-tool in package libsecret which can get/set passwords in a gnome-keyring.

  • Thanks. I don't think secret-tool can help me because it can't enumerate all the passwords (can it?). I knew about the Python interface, but it's completely undocumented, the bending articles were helpful in cobbling together something that works. – Gilles Jul 6 '15 at 17:17
  • @Gilles Congratulations! I had the vague impression secret-tool could find all the entries, but it can only store in the default keyring, so you needed to use seahorse to change the default temporarily. – meuh Jul 6 '15 at 17:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.