2

I use full disk encryption that takes a password on boot, and so I like to set Gnome Shell to log me in automatically and Seahorse to keep my login keyring unlocked*, so that I don't need to type my password in twice**. (This seems like the logical things to do -- but maybe there's a better approach?) This works fine, except that every few weeks or so the keyring seems to re-lock itself, so that it asks for my login password again when I start e.g. Chrome. This seems to happen whenever the seahorse package gets updated (on Arch Linux, in my case), and possibly other times as well, though I haven't noticed any other patterns.

* That is, I set the password on my login keyring to empty string, and then when it warns me "are you sure you want your keyring to be unencrypted?" I say yes.

** That is, the first time I type my password is very early in boot, before my root partition is even mounted. So as far as Gnome is concerned, I never input my password at all. I assume this setup must be common for folks who encrypt their disk, but maybe I'm doing it all wrong :p

  • I have the same infrequent issue; I have two "gnome-keyring-daemon --start" commands in ~/.config/autostart -- usually there's no problem, then out of the blue I get prompted to unlock the keyring -- both desktop files have "X-GNOME-Autostart-Phase=PreDisplayServer" – david.libremone Apr 12 '18 at 21:14
  • @d3vid, do you happen to notice any correlation between doing system updates and getting this issue? I feel like they're correlated, but I can't prove it. (I should try downgrading and reupgrading to see if that affects anything.) – Jack O'Connor Apr 13 '18 at 22:11
  • I am pretty sure it's related, but I don't know which package(s) trigger it – david.libremone Apr 13 '18 at 22:40
2

Gnome Keyring stores its decrypted contents in memory. This means that whenever it gets updated and needs to restart, or whenever a related processes requires it to restart, you will have to put in your password again to decrypt the contents and move them into memory again. It does not need to re-encrypt without your permission because the original file was never overwritten with decrypted data in the first place.

Gnome's page on the keyring kind of dances around this fact, but it's evident this is the way it works from how they say "[Gnome Keyring protects against] Reading passwords from memory after the user had logged out, or from the swap area of the disk."

  • Most of the time when I restart my machine, the login keyring unlocks without asking me for a password. That wouldn't be possible if there wasn't something on disk, right? The issue I'm talking about at the top only happens every few weeks, not all the time. – Jack O'Connor Sep 22 '17 at 19:12
  • @JackO'Connor Gnome Keyring by default unlocks with login, but does not to the extent of my knowledge unlock when doing other user authentications like unlocking the screen. Are you having it require a password immediately after reboot / initial login? – Thegs Sep 22 '17 at 19:20
  • that's right. When this bug occurs, usually what happens is that I boot my machine and start Chromium, and that blocks on a password prompt. But to be clear, this is after an automatic login, in which I didn't have to input my password to get to my desktop. (Though I did input it to mount the disks, long before gdm / Gnome Shell started running.) – Jack O'Connor Sep 22 '17 at 21:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.