When run with sudo gpg can't use my secret key even though it shows up with --list-secret-keys

Question

I'm working on a shell script that needs to run as root (with sudo) and uses gpg. Encryption works fine, but decryption refuses to use my secret key for some reason.

Specifically the command:

sudo gpg --homedir '/home/username/.gnupg' -d file.gpg

Fails with:

gpg: WARNING: unsafe ownership on homedir '/home/username/.gnupg'
gpg: encrypted with 2048-bit RSA key, ID XXX, created YYYY-MM-DD
      "John Doe <john@doe.com>"
gpg: public key decryption failed: Permission denied
gpg: decryption failed: No secret key

However sudo gpg --homedir '/home/username/.gnupg' --list-secret-keys correctly lists the secret key, and I am able to decrypt the file with gpg as my normal user (just not with sudo), so there is nothing wrong with the key or the file.

I'm running gpg 2.2.19 on Manjaro.

Answer 1

Turns out this is a problem with permissions regarding pinentry i.e. entering the secret key's password. There's two solutions/workarounds:

1. --pinentry-mode loopback: This causes pinentry to happen in the terminal, thus bypassing the permission issue.

2. chmod o+rw $(tty): This changes the tty permissions so pinentry can happen normally. The first solution is probably preferrable as it doesn't require messing with any permissions (which could at least in theory create security issues).