Unlock Gnome Keyring Daemon from command line

Question

I am trying to unlock the Gnome Keyring Daemon from the command line, by directly passing it a password. I tried a few variations of --daemonize, --login, --start, but I can't get it to work.

echo $password | gnome-keyring-daemon --unlock returns SSH_AUTH_SOCK=/run/user/1000/keyring/ssh but doesn't unlock anything.

Basically I want something along the lines of:

gnome-keyring-daemon unlock --pw $password

Not sure if it makes any difference, but I'm on Manjaro i3wm version, so not using a desktop environment.

Background:

I'm using KeePassXC to manage my keyring. The one downside to this is, that I can't automatically unlock the keyring on login. Since I don't want to enter two long passwords I came up with the following script as a workaround:

• Logging in automatically unlocks Gnome Keyring Daemon
• Gnome Keyring Daemon contains (a part of) the PW to KeePassXC as the only entry
• enter the last characters of the pw in a prompt
• kill Gnome Keyring Daemon
• use the combined pw to unlock KeePassXC

Now I want to do the opposite to lock KeePassXC again:

• Get PW to Gnome Keyring Daemon from KeePassXC
• Kill KeePassXC
• Unlock GnomeKeyringDaemon <- this is the part I can't get to work

Answer 1

There is (now) an --unlock argument to gnome-keyring-daemon which does exactly what you want. Normally, when it's invoked, it will unlock then demonize and echo the SSH_AUTH_SOCK. If you think there might already be an existing daemon running, then you can add the --replace argument to ensure a seamless transition to the new daemon.

I log in to a headless Ubuntu 20.0.4LTS system via ssh with a public key (no password) on a regular basis, but sometimes for development purposes I need the keyring to be available. So I have the following function defined in my bash profile, and it works great to do the unlock (whether there is an existing daemon running or not):

# Linux unlock gnome keyring
function unlock-keyring ()
{
    read -rsp "Password: " pass
    export $(echo -n "$pass" | gnome-keyring-daemon --replace --unlock)
    unset pass
}

Answer 2

This is a very brutal, dirty, and probably very wrong way to do this, but after struggling with unlocking my keyring over SSH for a while, I came up with this little script:

echo 'NOTE: This script will only work if launched via source or .' >&2
echo -n 'Login password: ' >&2
read -s _UNLOCK_PASSWORD || return
killall -q -u "$(whoami)" gnome-keyring-daemon
eval $(echo -n "${_UNLOCK_PASSWORD}" \
           | gnome-keyring-daemon --daemonize --login \
           | sed -e 's/^/export /')
unset _UNLOCK_PASSWORD
echo '' >&2

And yes, when I call . ~/bin/unlock-gnome-keyring and enter my login password, it unlocks my login keyring, I can view it in seahorse running through remote X and use it via libsecret applications.

Please be warned though, I'm not a security expert and there might be serious security implications to doing it this way. I did not check whether the password is properly cleaned in memory etc., which might render you more exposed to attacks.

Answer 3

I couldn't get any combination of the echo -n "pass" | gnome-keyring-daemon commands to work. I also tried the secret-tool command and several Python libraries, but most were outdated and none of them unlocked my keyring in Seahorse - or just triggered the GUI password prompt.

The only thing that worked for me was a Python script I found, available on Github and Codeberg, that does the job for me as long as I have Python installed. Downloading the script is as simple as running:

wget https://codeberg.org/umglurf/gnome-keyring-unlock/raw/branch/main/unlock.py
chmod +x unlock.py

After that, the following command unlocks the default keyring named 'Login' (usually present, the gnome-keyring-daemon command also creates it if it doesn't exist):

./unlock.py <<<PASSWORDHERE

If you also want to unlock a non-default keyring, just create an item in the 'Login' keyring with the name and password of that keyring. That gives you the option to automatically unlock that keyring whenever the 'Login' keyring is unlocked.

Answer 4

Based on [unlock.py][1], here is a bash version that uses nc (netcat) for the socket work:

#! /bin/bash

# password is on stdin

unlock-keyring() ( # note, runs in a subshell
  # helper functions for binary reads & writes on socket
  plain() {
    LANG=C LC_ALL= "$@"
  }

  readx1() {
    IFS="" plain read -d "" -rn 1
    plain printf -v "$1" '%02x' "'$REPLY"
  }

  readi4() {
    test "$1" != "_answer" && declare -n _answer="$1"
    _answer=""
    readx1 REPLY && _answer+=$REPLY &&
    readx1 REPLY && _answer+=$REPLY &&
    readx1 REPLY && _answer+=$REPLY &&
    readx1 REPLY && _answer+=$REPLY &&
    printf -v _answer $(( 0x$_answer ))
  }
  
  writei4() {
    local hex
    printf -v hex "%08x" $1
    printf '%b' "\x${hex:0:2}" "\x${hex:2:2}" "\x${hex:4:2}" "\x${hex:6:2}"
  }

  local REPLY
  read -rs || { test $? = 1 && test "${#REPLY}" != 0 ; } || return $?

  if test -S "$KEYRING_SOCKET"
  then :
  elif test -S "$GNOME_KEYRING_CONTROL/control"
  then KEYRING_SOCKET="$GNOME_KEYRING_CONTROL/control"
  elif test -S "$XDG_RUNTIME_DIR/keyring/control"
  then KEYRING_SOCKET="$XDG_RUNTIME_DIR/keyring/control"
  else return 1
  fi

  # could use socat instead
  coproc nc { nc -U "$KEYRING_SOCKET" ; } || return $?

  printf '\0' >&${nc[1]} || return $?

  # packet length
  writei4 $(( 12 + ${#REPLY} )) >&${nc[1]} || return $?
  
  # unlock code = 1
  writei4 1 >&${nc[1]} || return $?

  # password length  
  writei4 ${#REPLY} >&${nc[1]} || return $?

  # password not including trailing newline, curse you bash for <<<
  tr -d '\n' <<<"$REPLY"  >&${nc[1]} || return $?

  # read responses
  readi4 len <&${nc[0]} || return $?
  test "$len" = 8 || return $?
  readi4 len <&${nc[0]} || return $?
  test $len -lt 127 && return $len || return 127
)

unlock-keyring

Answer 5

For some use cases it can be handy to just remove the password on the keyring. Therefore there's no need to unlock it:

On Ubuntu 22.04: search for 'seahorse' and open. Right click on 'Login' under ' Passwords' (might need to do a few times, didn't work at first). In the context menu pick 'Change Password'. Enter the current password and leave the new password fields blank. Accept 'Store passwords unencrypted?'.

Answer 6

This works for me, changed form brotskydotcom's answer.

# Add to ~/.bashrc

function unlock()
{
    read -rsp "keyring password:" keyringPass
    echo -n "$keyringPass" | gnome-keyring-daemon -dr --unlock
    unset keyringPass
}

function lock()
{
    pkill -u "$(whoami)" -f gnome-keyring-daemon
}

explanation

gnome-keyring-daemon:
-r(replace): replace a running keyring daemon
-d(daemon): keyring daemon will exit when current process ends without this option
--unlock unlock 'Login' keyring, it will not unlock any other keyrings, eg: 'Default keyring'.

lock:
Kill the keyring daemon processes would lock the keyring.