Linux: gnome-keyring setup as Freedesktop SecretService
Tags: linux, security
Published: 2020-02-27 08:15:41

---
title: Linux: gnome-keyring setup as Freedesktop SecretService
published: true
date: 2020-02-26 13:49:24 UTC
tags: Linux,security
canonical_url: https://rtfm.co.ua/en/linux-gnome-keyring-setup-as-freedesktop-secretservice/
---


![](https://rtfm.co.ua/wp-content/uploads/2014/12/Linux-Secure-e1417804218533.png)Currently, I’m using KeePass as passwords, RSA-keys, and as the Freedesktop SecretService, see the [KeePass: an MFA TOTP codes, a browser’s passwords, SSH keys passwords storage configuration and Secret Service integration](https://rtfm.co.ua/en/keepass-an-mfa-totp-codes-a-browsers-passwords-ssh-keys-passwords-storage-configuration-and-secret-service-integration/) post.

The first issue I faced with during such a setup is the fact that KeePass’ database is synced between my computers (it’s database just stored in a Dropbox folder), and KeePass rewrites some passwords, for example – Chromium creates its own key named “_Chromium Safe Storage_” for its local SQLite database encryption, and it must be different on each PC, but as the database is synced – I got an issue here.

The second inconvenience is that KeePass is started with a locked database, and applications can not start using it until I’ll not unlock it.

This can be automated for example by using the `-pw` option (see [KeePass options](https://keepass.info/help/base/cmdline.html)), or by using a GPG key, but in this way I’m losing the whole data encryption idea as all access credentials will be stored on the same filesystem in a plaintext.

Thus – let try to use `gnome-keyring` for local applications as a SecretService, and leave everything other for the KeePass.

### GNOME Keyring install

Check the D-Bus `org.freedesktop.secrets` service now:

```
$ ps aux  |grep  $(qdbus --session org.freedesktop.DBus / org.freedesktop.DBus.GetConnectionUnixProcessID org.freedesktop.secrets)
setevoy     1534  0.0  0.6 705436 102524 tty1    SLl  Jan09   0:03 keepassxc
```

Disable SecretService support in the KeePass, install `gnome-keyring`:

```
$ sudo pacman -S gnome-keyring
```

Check the SecretService again:

```
$ ps aux  |grep  $(qdbus --session org.freedesktop.DBus / org.freedesktop.DBus.GetConnectionUnixProcessID org.freedesktop.secrets)
setevoy   829496  0.0  0.0 236292  8528 ?        SLl  13:19   0:00 /usr/bin/gnome-keyring-daemon --start --foreground --components=secrets
```

Started, working, options –_` --start --foreground --components=secrets`_ – correct, all good here.

### GNOME Keyring unlock on Log In

Now, need to add storage decryption during login to the Operating system, see the [Arch Wiki](https://wiki.archlinux.org/index.php/GNOME/Keyring#PAM_method) and [GNOME Manual](https://wiki.gnome.org/Projects/GnomeKeyring/Pam/Manual) documentation.

Check libs:

```
$ ll /usr/lib/security/ | grep gnome
-rwxr-xr-x 1 root root  46768 Oct 29 11:38 pam\_gnome\_keyring.so
```

Edit  `/etc/pam.d/login`, add to the _auth_ and _session_ the following strings:

```
auth optional pam_gnome_keyring.so
session optional pam_gnome_keyring.so auto_start
```

To update keyring’s password during changing a user’s password in the system – add the following line to the `/etc/pam.d/passwd`:

```
password optional pam_gnome_keyring.so
```

The documentation says it’s necessary to add the `eval $(/usr/bin/gnome-keyring-daemon --start --components=secrets)` execution to the `~/.xinitrc` (or, for example,  `~/.config/openbox/environment`), but in my case, everything is already working (Arch Linux + Openbox DE with manual X-server start via `startx`).

Reboot the PC and check D-Bus again:

```
$ ps aux  |grep  $(qdbus --session org.freedesktop.DBus / org.freedesktop.DBus.GetConnectionUnixProcessID org.freedesktop.secrets)
setevoy     1338  0.0  0.0 236376  6932 ?        Sl   14:35   0:00 /usr/bin/gnome-keyring-daemon --daemonize --login
```

`gnome-keyring` processes:

```
$ ps aux | grep gnome                             
setevoy     1351  0.1  0.0 236288  6776 ?        Sl   16:32   0:00 /usr/bin/gnome-keyring-daemon --daemonize --login
setevoy     1874  0.0  0.0 235988  7244 ?        Sl   16:33   0:00 /usr/bin/gnome-keyring-daemon --start --foreground --components=secrets
```

#### The Login and Default keyrings

After installation, we just checked the service and it looked like:

```
$ ps aux  |grep  $(qdbus --session org.freedesktop.DBus / org.freedesktop.DBus.GetConnectionUnixProcessID org.freedesktop.secrets)
setevoy   829496  0.0  0.0 236292  8528 ?        SLl  13:19   0:00 /usr/bin/gnome-keyring-daemon --start --foreground --components=secrets
```

But on my home laptop “something went wrong” and the `gnome-keyring-daemon` service was started with the _`--daemonize --login` _only, without _`--components=secrets`_:

```
$ ps aux  |grep  $(qdbus --session org.freedesktop.DBus / org.freedesktop.DBus.GetConnectionUnixProcessID org.freedesktop.secrets)
setevoy      666  0.0  0.0 380756  7280 ?        Sl   21:19   0:00 /usr/bin/gnome-keyring-daemon --daemonize --login
```

And in the Seahorse (see the [Seahorse — GUI for gnome-keyring](https://rtfm.co.ua/?p=23147#Seahorse_GUI_gnome-keyring "Seahorse — GUI для gnome-keyring") part below) I had an empty _Login_ keyring, and _Default_ – wich was even impossible to unlock:

![](https://rtfm.co.ua/wp-content/uploads/2020/02/Screenshot_20200225_213741.png)

Check keyrings files:

```
$ ll .local/share/keyrings/.
total 16
-rw------- 1 setevoy setevoy 2689 Dec  8 09:38 Default\_keyring.keyring
-rw-r--r-- 1 setevoy setevoy   15 Dec  6 08:51 default
```

Remove (moved to a Backups dir actually) the _Default_keyring.keyring_ and _default_ files, re-login – and it’s working now.

### Seahorse – GUI for the `gnome-keyring`

Install the Seahorse:

```
$ sudo pacman -S seahorse
```

Run a browser, for example, Brave, and check the _Login_ keyring (must be created by the `gnome-keyring` after the first login to the system):

[![](https://rtfm.co.ua/wp-content/uploads/2020/01/Screenshot_20200110_143744.png "Linux: настройка gnome-keyring SecretService")](https://rtfm.co.ua/wp-content/uploads/2020/01/Screenshot_20200110_143744.png)The _Brave Safe Storage_ record appeared, thus – Brave is using `gnome-keyring`, SecretService works, all good.

Database files:

```
$ ll .local/share/keyrings/
total 8
-rw------- 1 setevoy setevoy 2480 Jan 10 14:38 login.keyring
-rw------- 1 setevoy setevoy  207 Jan 10 13:41 user.keystore
```

### No such secret collection at path: /

Sometimes during creating a new keyring Seahorse may return an error with the “ **_No such secret collection at path: /_** ” message:

[![](https://rtfm.co.ua/wp-content/uploads/2020/01/Screenshot_20200110_132438.png "Linux: настройка gnome-keyring SecretService")](https://rtfm.co.ua/wp-content/uploads/2020/01/Screenshot_20200110_132438.png)

[![](https://rtfm.co.ua/wp-content/uploads/2020/01/Screenshot_20200110_132845.png "Linux: настройка gnome-keyring SecretService")](https://rtfm.co.ua/wp-content/uploads/2020/01/Screenshot_20200110_132845.png)

The solution is to update environment variables for the D-Bus:

```
$ source /etc/X11/xinit/xinitrc.d/50-systemd-user.sh
```

Done.

### Similar posts

- <small>12/12/2019</small> [KeePass: an MFA TOTP codes, a browser’s passwords, SSH keys passwords storage configuration and Secret Service integration](https://rtfm.co.ua/en/keepass-an-mfa-totp-codes-a-browsers-passwords-ssh-keys-passwords-storage-configuration-and-secret-service-integration/) 
- <small>12/07/2019</small> [What is: Linux keyring, gnome-keyring, Secret Service, and D-Bus](https://rtfm.co.ua/en/what-is-linux-keyring-gnome-keyring-secret-service-and-d-bus/)ll>  
- <small>12/10/2019</small> [Chromium: Linux, keyrings && Secret Service, passwords encryption and store](https://rtfm.co.ua/en/chromium-linux-keyrings-secret-service-passwords-encryption-and-store/)