Windows and Mac both have a handy way to secure data using the users' login credentials.
- The Data Protection API on Windows uses a symmetric key which is never stored in plain-text, and is encrypted using a key derived from the user's password. If the user logs in successfully, any program running as that user can encrypt or decrypt arbitrary data buffers; the functions to do this are part of the standard Windows API. If another user (even an admin) tries to decrypt that same data, or if the user's session was created without login credentials, DPAPI doesn't work. DPAPI keys are also permanently lost if the user's password is forcibly reset, either from within Windows, via Active Directory (LDAP), or by editing the disk.
- The Keychain feature on MacOS provides a structured data storage mechanism for passwords and other secrets (Windows has a similar credential store, built on top of DPAPI). The keychain application itself technically has its own authentication separate from the user login credentials, but by default, MacOS synchronizes the user's login and keychain passwords and automatically unlocks keychain access when the user logs in. If the user's password is forcibly reset, the old password will be needed to unlock the keychain.
This functionality is used by lots of software, both shipping with the OS (i.e. part of the distro) and in third-party packages large or small. It's very convenient, and I wish there was some equivalent on Linux.
Is there any equivalent functionality on Linux or non-Mac Unix(-like) systems? All the suggestions I've seen talk about things like GnomeKeychain or KWallet (which require manually unlocking after login, and are desktop-specific), third-party password managers with their own master passwords and generally not integrated with anything except browsers (like LastPass), or building something on top of GPG (which requires the user to enter a password, and has no simple way to protect or unprotect data programmatically). This question from Security.SE asks the same thing, but the answer ("No") is five years old now.