GNOME Bugzilla – Bug 628290
On suspend, keyring should be locked *by default*
Last modified: 2010-10-11 13:53:47 UTC
Locking (=clearing) the keyring is enabled by a preferences flag, which is off by default. This is a security issue (laptop is suspended, then stolen, passwords can be read off the physical memory). For security-conscious users that password-protect their screensaver (typical in enterprise environments), the feature should be on. See http://mail.gnome.org/archives/gnome-power-manager-list/2010-July/msg00008.html and follow-up messages. Thanks!
Right, from a security point of view you're probably correct, and it's what we used to default to. From a usability point of view, you're totally wrong, and people screamed very loudly when having to unlock the keyring *every time* they resumed. The reason it's required every time, is that NetworkManager uses the keyring to reconnect to a wireless network. Having to authenticate twice on resume just sucked. Better solutions welcome.
(In reply to comment #1) I understand that the sequence of operations is: - User resumes the PC. - User authenticates to the screen saver (I am assuming that authentication is required). - The keyring is unlocked - NM can access the keyring to get the wireless keys. What am I missing? BTW, I changed the settings on my own laptop to lock-on-suspend, and things work just fine with NM. Maybe it's a rare race condition?
Unless thing have changed, unlocking the screen in gnome-screensaver does not unlock the default keyring.
For this to happen, you need to compile gnome-keyring with pam support, and to add the magic line "auth optional pam_gnome_keyring.so" to /etc/pam.d/gnome-screensaver. This is done by default on Ubuntu. Don't know about other distros.
(In reply to comment #4) > For this to happen, you need to compile gnome-keyring with pam support, and to > add the magic line "auth optional pam_gnome_keyring.so" to > /etc/pam.d/gnome-screensaver. This is done by default on Ubuntu. Don't know > about other distros. I have this in Fedora, so it looks like I was wrong. I'll try setting the GConf key to TRUE and do some testing (I'm really busy for the next few hours) but if other people could check this I would appreciate it.
commit acb0fc91016e5da7cc9a54e85a53230c1c4efcfb Author: Richard Hughes <richard@hughsie.com> Date: Mon Oct 11 14:53:29 2010 +0100 Lock the keyring before suspending as gnome-keyring with pam support will automatically unlock on resume. Fixes #628290