Login keyring wird nicht mehr entsperrt

[hendrikL]

https://wiki.archlinux.org/title/GNOME/Keyring#Using_the_keyring

[harley-peter]

Yes they are installed.

@hendrikL:
Es ist jetzt kein Problem das Passwort nochmal einzugeben, mich interessiert halt warum das vorher ging und jetzt nicht mehr.

[Teriarch]

> Es ist jetzt kein Problem das Passwort nochmal einzugeben, mich interessiert halt warum das vorher ging und jetzt nicht mehr.

Is there still anyone dying to know what went wrong and how to fix it?

PS.: No one? Anyways: In post #8 hendrikL wrote:

> edit /etc/pam.d/login
> And add this at the bottom:
>
> auth optional pam_gnome_keyring.so
> session optional pam_gnome_keyring.so auto_start

And boy, was he close. The file to edit is actually /etc/pam.d/sddm from Debian package
sddm_0.21.0+git20260801.f62b7ba-3_amd64.deb. The vanilla /etc/pam.d/sddm is almost correct
except for line 31, where the following line must be added:

Code Select Expand

--- a/etc/pam.d/sddm      2026-08-23 15:05:53.000000000 +0200
+++ b/etc/pam.d/sddm      2026-09-04 22:06:54.131577353 +0200
@@ -30,6 +30,7 @@ session optional        pam_keyinit.so
session required        pam_limits.so
@include common-session
+session optional        pam_gnome_keyring.so auto_start

@include common-password
The sddm helper binary responsible for starting the PAM module (and
in turn the gnome-keyring-daemon) can only get a grip on the login
password after the common-auth section succeeds and it's only purpose
is to decrypt the gnome keyring masterkey before the login password
is wiped and overwritten. The sddm daemon must keep the gnome daemon
alive once the masterkey is transfered to the daemon, which in turn forks
and execs the session gnome daemon after the common_session script.
Creating a new process of the gnome daemon before or after this tiny
window results in an empty password, which fails to decrypt the masterkey.
BTW: Your keyring should look like

Code Select Expand

$ ls -la ~/.local/share/keyrings
insgesamt 20
-rw-------  1 wt wt  601  4. Sep 16:59 login.keyring
-rw-------  1 wt wt  207  4. Sep 16:54 user.keystore
And upon login you can check an open keyring with
 

Code Select Expand

$ chromium --password-store=gnome-libsecret

[hendrikL]

:
https://wiki.archlinux.org/title/GNOME/Keyring#Using_the_keyring

: [...]
 When using a display manager, the keyring works out of the box for most cases. GDM, LightDM, LXDM, and SDDM already have the necessary PAM configuration. For a display manager that does not automatically unlock the keyring edit the appropriate file instead of /etc/pam.d/login as mentioned below.
[...]

And I didn't read it carefully to the end....😎

[Teriarch]

The Debian bug tracker folks are still trapped in the process of deciding whom
to put the blame on:
<https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1142693>
And in the meantime we may leave the optional session line in its
interim position until it finds its final peace.

[harley-peter]

@Teriarch:
The lines in my sddm file looks as followed:

Code Select Expand

# Create a new session keyring.
session optional        pam_keyinit.so force revoke

session required        pam_limits.so

@include common-session

Do I have replace the line "session optional        pam_keyinit.so force revoke" with "session optional        pam_keyinit.so" or do I have add the line?

[Teriarch]

> Do I have replace the line "session optional        pam_keyinit.so force revoke" with "session optional        pam_keyinit.so" or do I have add the line?

You only have to add one single line to the already existing /etc/pam.d/sddm file (The unmodified file from the distributor).
The unmodified part reads:

Code Select Expand

# Create a new session keyring.
session optional        pam_keyinit.so force revoke

session required        pam_limits.so

@include common-session

@include common-password

# From the pam_env man pageand has to be replaced by

Code Select Expand

# Create a new session keyring.
session optional        pam_keyinit.so force revoke

session required        pam_limits.so

@include common-session
session optional        pam_gnome_keyring.so auto_start

@include common-password

# From the pam_env man pageAs you can see only the line "session optional        pam_gnome_keyring.so auto_start"
has been added at the right place. The other parts of this file stay the same.

[harley-peter]

Thank you very much Teriarch, it works. 🙂

[Teriarch]

> Thank you very much Teriarch, it works.

Well, it is never the last stone of a building, which deserves all the glory.

In the beginning I considered it a lost case thinking someone probably
messed up the code and is going to re-fix it with the next release. It was hendrikL
hinting at a possible configuration issue, that draw my attention back
to the problem. If anything it was my persistence to dig through all the different
authentication, display and wallet managers and their IPCs which placed
the final stone. There is one caveat though:

The sddm maintainer is not (yet) willing to accept the patch arguing that
it is  libpam-gnome-keyring's responsibility (the gnome keyring PAM module)
to include the line into the common-session script. And he has a valid point
since that is exactly what KDE's favorite wallet manager kwallet does (hence
it works out of the box).
Until the dispute is settled you have to reapply the patch to the next sddm
release (don't include it into common-session, since that script will be
overwritten with each call of pam-auth-update).