GNOME Bugzilla – Bug 625053
pam_gnome_keyring only uses keyrings with 'login' name
Last modified: 2012-03-19 14:08:51 UTC
Hello folks, pam_gnome_keyring.so only unlock the keyring using the password provided if the keyring has 'login' name /var/log/auth.log: Jul 21 19:13:14 folha gnome-keyring-daemon[1077]: Failed to unlock login on startup How to reproduce: 1) create a new keyring using seahorse, set it as default, move some passwords to it (wifi password per example); 2) optionally remove the old keyring; [ or you can rename old keyring via 'mv $HOME/.gnome2/keyrings/login.keyring $HOME/.gnome2/keyrings/default.keyring' and alter $HOME/.gnome2/keyrings/default] Possible solutions: 1) pam-gnome-keyring may honour $HOME/.gnome2/keyrings/default; or 2) pam-gnome-keyring must unlock each keyrings with the provided password OS: Ubuntu Lucid 10.04 with the latest updates, Version: Version: 2.92.92.is.2.30.3-0ubuntu1
If this feature is not done in trunk I like to do it if someone could help me
This could be done as an argument to the pam module. So that in the pam configuration you would specify a different keyring to unlock. By default (when that config argument was not present) it would default to using the 'login' keyring. Are you still interested in working on this?
Well, I think that is very simple to do, So I will try to work on it next weekend and submit a patch to this bug
That would be great, thanks.
Seems more complicated :-( and I need help. pam_gnome_keyring (pam/gkr-pam-client.c:keyring_daemon_op) sends a GKD_CONTROL_OP_UNLOCK( to daemon in order to unlock. I think that daemon/control/gkd-control-server.c:control_unlock_login handles this op. How can I pass which keyring it will unlock (if possible).
Yeah, you're right it is more complex. In addition there's a lot of logic that treats the 'login' keyring as special. For example passwords you request to "Automatically unlock" are stored there. What was the use case for not wanting to use the login keyring?
I've found that if there is no 'login' keyring, it creates a 'login' keyring and it shows a dialog box in order to unlock any other keyrings and store their password on 'login' keyring to auto unlock it next login. So, it will use other keyrings in cascade and I think there isn't any useful case for not using the 'login' keyring. closing this ticket
Thanks.