5

I use full disk encryption that takes a password on boot, and so I like to set Gnome Shell to log me in automatically and Seahorse to keep my login keyring unlocked*, so that I don't need to type my password in twice**. (This seems like the logical things to do -- but maybe there's a better approach?) This works fine, except that every few weeks or so the keyring seems to re-lock itself, so that it asks for my login password again when I start e.g. Chrome. This seems to happen whenever the seahorse package gets updated (on Arch Linux, in my case), and possibly other times as well, though I haven't noticed any other patterns.

* That is, I set the password on my login keyring to empty string, and then when it warns me "are you sure you want your keyring to be unencrypted?" I say yes.

** That is, the first time I type my password is very early in boot, before my root partition is even mounted. So as far as Gnome is concerned, I never input my password at all. I assume this setup must be common for folks who encrypt their disk, but maybe I'm doing it all wrong :p

Improve this question
9
  • I have the same infrequent issue; I have two "gnome-keyring-daemon --start" commands in ~/.config/autostart -- usually there's no problem, then out of the blue I get prompted to unlock the keyring -- both desktop files have "X-GNOME-Autostart-Phase=PreDisplayServer"
    – lofidevops
    Apr 12, 2018 at 21:14
  • @d3vid, do you happen to notice any correlation between doing system updates and getting this issue? I feel like they're correlated, but I can't prove it. (I should try downgrading and reupgrading to see if that affects anything.)
    – Jack O'Connor
    Apr 13, 2018 at 22:11
  • I am pretty sure it's related, but I don't know which package(s) trigger it
    – lofidevops
    Apr 13, 2018 at 22:40
  • 1
    This issue is still occurring for me on Manjaro. Have you had any luck?
    – Bagalaw
    May 8, 2020 at 21:56
  • @JackO'Connor I did encounter the issue today for the first time in a while, and it was always the first time in a while that I did a full system update. So maybe you're on to something.
    – Bagalaw
    May 8, 2020 at 21:57

2 Answers 2

Reset to default
1

Gnome Keyring stores its decrypted contents in memory. This means that whenever it gets updated and needs to restart, or whenever a related processes requires it to restart, you will have to put in your password again to decrypt the contents and move them into memory again. It does not need to re-encrypt without your permission because the original file was never overwritten with decrypted data in the first place.

Gnome's page on the keyring kind of dances around this fact, but it's evident this is the way it works from how they say "[Gnome Keyring protects against] Reading passwords from memory after the user had logged out, or from the swap area of the disk."

Improve this answer
4
  • Most of the time when I restart my machine, the login keyring unlocks without asking me for a password. That wouldn't be possible if there wasn't something on disk, right? The issue I'm talking about at the top only happens every few weeks, not all the time.
    – Jack O'Connor
    Sep 22, 2017 at 19:12
  • @JackO'Connor Gnome Keyring by default unlocks with login, but does not to the extent of my knowledge unlock when doing other user authentications like unlocking the screen. Are you having it require a password immediately after reboot / initial login?
    – Thegs
    Sep 22, 2017 at 19:20
  • that's right. When this bug occurs, usually what happens is that I boot my machine and start Chromium, and that blocks on a password prompt. But to be clear, this is after an automatic login, in which I didn't have to input my password to get to my desktop. (Though I did input it to mount the disks, long before gdm / Gnome Shell started running.)
    – Jack O'Connor
    Sep 22, 2017 at 21:23
  • 2
    The answer is NOT correct. I am meeting the same issue and so far no solution found. (only 1 workaround). When there is no password for gnome-keyring, the keyring store files (~/.local/share/keyrings/*) will be stored in plaintext. But somehow, it kept resetting back and encrypted after some reboots. I haven't figured out why.
    – sgon00
    Aug 17, 2020 at 9:22
0

I would suspect this to be a part of the PAM Gnome Keyring integration. On my Ubuntu, I can configure PAM via pam-auth-update and disable GNOME Keyring Daemon - Login keyring management.

I just did this, so I am not sure if this will actually solve the issue, but given the docs of https://wiki.gnome.org/Projects/GnomeKeyring/Pam/Manual and the fact that there was an entry in /etc/pam.d/common-password I am quite confident that this integration is what is resetting the password on the keyring.

Edit: Unfortunately that does not seem to be the solution, at least the password got reset again. I will keep looking.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .