1

I am trying to encrypt a file using GPG. I am new to GPG. It's installed at version 2.0.22 on RHEL 7.4.

Whenever I try to run it, I get an error that the operation was cancelled by user.

sh-4.2$ gpg --output ~/test.gpg --symmetric --cipher-algo AES256 test.html
gpg: cancelled by user
gpg: error creating passphrase: Operation cancelled
gpg: symmetric encryption of `test.html' failed: Operation cancelled
sh-4.2$

From this answer I came to know that this could be due to the TTY permissions.

GnuPG tries to make sure it's reading the passphrase directly from the terminal, not (e.g.) piped from stdin. To do so, it tries to open the tty directly. Unfortunately, file permissions get in the way — the tty device is owned by the user you log in as. So only that user and root can open it. GnuPG appears to report the error incorrectly, saying you canceled (when in fact it got a permission denied).

For my machine, the TTY is owned by the root group with g+rw, and while I am not root, I am in the root group:

sh-4.2$ stat /dev/tty
  File: '/dev/tty'
  Size: 0               Blocks: 0          IO Block: 4096   character special file
Device: 100076h/1048694d        Inode: 221356338   Links: 1     Device type: 5,0
Access: (0666/crw-rw-rw-)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2018-05-17 14:08:51.809798450 +0100
Modify: 2018-05-17 14:08:51.809798450 +0100
Change: 2018-05-17 14:08:51.809798450 +0100
 Birth: -
sh-4.2$ id -g
0
sh-4.2$

So this doesn't seem to be the issue. Unfortunately I can't test if it works as root, as I don't have root access on this machine (although I can request for commands to be run as root when the machine starts up, but not to run daemons etc).

As it says the operation was cancelled by user (which is simply untrue), I have no idea how to debug this.

If I don't have root access, can this issue be fixed? Is it simply not possible to use GPG without root access?

2
  • 1
    Please create a temporary directory, change to it, and run HOME=$PWD strace -o gpg.strace gpg --output test.gpg --symmetric --cipher-algo AES256 test.html. (Do this in a temporary directory that doesn't contain any private data and enter a throwaway passphrase like foo, because the trace will contain all the data that gpg processes.) Post the resulting trace gpg.strace. – Gilles 'SO- stop being evil' May 17 '18 at 16:14
  • Do you have use-agent in ~/.gnupg/gpg.conf? Is an agent running (is the environment variable $GPG_AGENT_INFO set)? This affects how gpg reads the passphrase. The command I wrote above may behave differently because it doesn't use ~/.gnupg/gpg.conf, if so then copy the relevant options (or the whole file, minus any private data such as key identifiers and email addresses) to the temporary directory. – Gilles 'SO- stop being evil' May 17 '18 at 16:16
1

For me this happens when I connect to my office computer from home and attach to a screen session opened from the office earlier.

My investigation shows that the error is due to pinentry's inabiblity to connect to a d-bus socket. The root cause of that is DBUS_SESSION_BUS_ADDRESS variable set in the environment and pointing to a non-existent socket. When I unset DBUS_SESSION_BUS_ADDRESS or dbus-launch gpg <arguments> it works just fine.

It may also help to completely disable GUI input for pinentry by forcing gpg-agent to use pinentry-tty. Edit your ~/.gnupg/gpg-agent.conf and add a line pinentry-program /usr/bin/pinentry-tty.

Hope this helps, or at least I'll find this answer myself next time this happens to me and I forget the solution. :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.