Secret Service - Revision history

Souheab: /* Troubleshooting */ Add a solution to fix an error where GNOME keyring daemon fails to spawn the SystemPrompter process

2026-03-09T18:15:39Z

Troubleshooting: Add a solution to fix an error where GNOME keyring daemon fails to spawn the SystemPrompter process

← Older revision		Revision as of 18:15, 9 March 2026
Line 111:		Line 111:

	This error happens when the PAM module can't find the daemon's control socket. Very likely it will start a daemon and retry the action which requires a daemon, and stop the daemon when the PAM session closes.		This error happens when the PAM module can't find the daemon's control socket. Very likely it will start a daemon and retry the action which requires a daemon, and stop the daemon when the PAM session closes.

			=== <code>gnome-keyring-daemon: couldn't create system prompt: GDBus.Error:org.freedesktop.DBus.Error.Spawn.ChildExited: Process org.gnome.keyring.SystemPrompter exited with status 1</code> ===
			This error occurs when the GNOME Keyring daemon fails to spawn the SystemPrompter process (provided by the gcr package). This usually occurs due to D-Bus not having knowledge of the user's display environment. To fix this we must update the D-Bus environment once display is available.

			On X11 this can be fixed by setting the following option:

			{{File\|3=services.xserver.updateDbusEnvironment = true;\|name=/etc/nixos/configuration.nix\|lang=nix}}

			OR

			Alternatively the following command can be run on display startup:

			{{Commands\|$ dbus-update-activation-environment --systemd --all}}

	=== <code>discover_other_daemon: 0</code> with <code>--start</code> ===		=== <code>discover_other_daemon: 0</code> with <code>--start</code> ===

Pamplemousse at 13:24, 4 January 2026

2026-01-04T13:24:25Z

← Older revision		Revision as of 13:24, 4 January 2026
Line 58:		Line 58:
	</nowiki>\|name=home.nix\|lang=nix}}		</nowiki>\|name=home.nix\|lang=nix}}

	If not using the `settings.FdoSecrets.Enabled = true;` one needs to configure for Secret Service integration by opening their settings '''Database > Database Settings...''', opening the ''Secret Service Integration'' tab and selecting a group for Secret Service entries.		If not using the {{Nixos:option\|2=settings.FdoSecrets.Enabled = true}} one needs to configure for Secret Service integration by opening their settings '''Database > Database Settings...''', opening the ''Secret Service Integration'' tab and selecting a group for Secret Service entries.

	{{Warning\|"Another secret service is running (...). Please stop/remove it before re-enabling the Secret Service Integration."}}		{{Warning\|"Another secret service is running (...). Please stop/remove it before re-enabling the Secret Service Integration."}}

Pamplemousse at 13:23, 4 January 2026

2026-01-04T13:23:03Z

← Older revision		Revision as of 13:23, 4 January 2026
Line 58:		Line 58:
	</nowiki>\|name=home.nix\|lang=nix}}		</nowiki>\|name=home.nix\|lang=nix}}

	~~Databases~~ needs to ~~be configured~~ for Secret Service integration by opening their settings '''Database > Database Settings...''', opening the ''Secret Service Integration'' tab and selecting a group for Secret Service entries.		If not using the `settings.FdoSecrets.Enabled = true;` one needs to configure for Secret Service integration by opening their settings '''Database > Database Settings...''', opening the ''Secret Service Integration'' tab and selecting a group for Secret Service entries.

	{{Warning\|"Another secret service is running (...). Please stop/remove it before re-enabling the Secret Service Integration."}}		{{Warning\|"Another secret service is running (...). Please stop/remove it before re-enabling the Secret Service Integration."}}

Elvetemedve: Describe how to setup KeepassXC as Secret Service declaratively. Also added note about how to disable conflicting Gnome Keyring Daemon.

2025-11-01T12:50:28Z

Describe how to setup KeepassXC as Secret Service declaratively. Also added note about how to disable conflicting Gnome Keyring Daemon.

@@ Line 40: / Line 40: @@
 === KeePassXC ===
-KeePassXC's Secret Service integration can be enabled by going into the settings, opening the ''Secret Service Integration'' tab and enabling it.
+KeePassXC's Secret Service integration can be enabled by going into the '''Tools > Settings''', opening the ''Secret Service Integration'' tab and enabling it.
-Databases needs to be configured for Secret Service integration by opening their settings, opening the ''Secret Service Integration'' tab and selecting a group for Secret Service entries.
+This can be configured automatically by [[Home Manager]] configuration:{{file|||<nowiki>
-{{Expansion|Missing socket activation instructions.}}
+  xdg.autostart.enable = true; # Enable creation of XDG autostart entries.
 === pass-secret-service ===

Axka at 21:41, 5 April 2025

2025-04-05T21:41:01Z

← Older revision		Revision as of 21:41, 5 April 2025
Line 62:		Line 62:

	== Secret portal ==		== Secret portal ==
	'''[https://flatpak.github.io/xdg-desktop-portal/docs/doc-org.freedesktop.portal.Secret.html Secret portals]''' are portals in the XDG Desktop Portal specification, which allows applications to get a per-application master secret. I ([[User:Axka\|axka]]) don't know of any applications requiring this, and to my knowledge the only provider is GNOME Keyring, which can be added to <code>xdg.portal.extraPortals</code> in Home Manager or NixOS. Adding <code>gnome-keyring</code> will also add XDG autostart definitions, but unless you have <code>gnome-keyring</code> installed on NixOS, they won't be enabled (i.e. <code>/run/wrappers/bin/gnome-keyring-daemon</code> won't work).		'''[https://flatpak.github.io/xdg-desktop-portal/docs/doc-org.freedesktop.portal.Secret.html Secret portals]''' are portals in the XDG Desktop Portal specification, which allows applications to get a per-application master secret. I ([[User:Axka\|axka]]) don't know of any applications requiring this, and to my knowledge the only provider is GNOME Keyring, which can be added to <code>xdg.portal.extraPortals</code> in Home Manager. NixOS enables this automatically when GNOME Keyring is enabled. Adding <code>gnome-keyring</code> will also add XDG autostart definitions, but unless you have <code>gnome-keyring</code> installed on NixOS, they won't be enabled (i.e. <code>/run/wrappers/bin/gnome-keyring-daemon</code> won't work).

	== Auto-decrypt on login ==		== Auto-decrypt on login ==

	The NixOS module for GNOME Keyring enables its PAM module automatically via {{nixos:option\|security.pam.services..enableGnomeKeyring}}. The equivalent for KDE Wallet is {{nixos:option\|security.pam.services..kwallet.enable}}.		The NixOS module for GNOME Keyring enables its PAM module automatically via {{nixos:option\|security.pam.services.*.enableGnomeKeyring}}, however the Home Manager module does not and as such you should add the following code to your NixOS configuration:
			{{file\|/etc/nixos/configuration.nix\|nix\|<nowiki>
			security.pam.services.login.enableGnomeKeyring = true;
			</nowiki>}}

			The equivalent for KDE Wallet is {{nixos:option\|security.pam.services.*.kwallet.enable}}.

	Usually you want to configure the <code>login</code> service, but <code>greetd</code>, <code>su</code> and <code>sshd</code> are also available. GDM and LightDM can be configured with <code>login</code>, while greetd cannot ({{issue\|357201}}).		Usually you want to configure the <code>login</code> service, but <code>greetd</code>, <code>su</code> and <code>sshd</code> are also available. GDM and LightDM can be configured with <code>login</code>, while greetd cannot ({{issue\|357201}}).

Axka at 21:24, 5 April 2025

2025-04-05T21:24:09Z

← Older revision		Revision as of 21:24, 5 April 2025
Line 88:		Line 88:
	=== <code>discover_other_daemon: 1</code> with <code>--start</code> ===		=== <code>discover_other_daemon: 1</code> with <code>--start</code> ===

	This log message gets printed when a <code>gnome-keyring-daemon</code> process with the <code>--start</code> flag ~~either~~ successfully sent <code>GKD_CONTROL_OP_INITIALIZE</code> to a control socket.		This log message gets printed when a <code>gnome-keyring-daemon</code> process with the <code>--start</code> flag successfully sent <code>GKD_CONTROL_OP_INITIALIZE</code> to a control socket.

	[[Category:Desktop]]		[[Category:Desktop]]

Axka: formatting

2025-04-05T21:23:35Z

formatting

← Older revision		Revision as of 21:23, 5 April 2025
Line 84:		Line 84:
	=== <code>discover_other_daemon: 0</code> with <code>--start</code> ===		=== <code>discover_other_daemon: 0</code> with <code>--start</code> ===

	This error happens when a `gnome-keyring-daemon` process with the `--start` flag either could not send `GKD_CONTROL_OP_INITIALIZE` to a control socket or got a failing result.		This error happens when a <code>gnome-keyring-daemon</code> process with the <code>--start</code> flag either could not send <code>GKD_CONTROL_OP_INITIALIZE</code> to a control socket or got a failing result.

	=== <code>discover_other_daemon: 1</code> with <code>--start</code> ===		=== <code>discover_other_daemon: 1</code> with <code>--start</code> ===

	This log message gets printed when a `gnome-keyring-daemon` process with the `--start` flag either successfully sent `GKD_CONTROL_OP_INITIALIZE` to a control socket.		This log message gets printed when a <code>gnome-keyring-daemon</code> process with the <code>--start</code> flag either successfully sent <code>GKD_CONTROL_OP_INITIALIZE</code> to a control socket.

	[[Category:Desktop]]		[[Category:Desktop]]

Axka: add discover_other_daemon log messages

2025-04-05T21:22:34Z

add discover_other_daemon log messages

← Older revision		Revision as of 21:22, 5 April 2025
Line 81:		Line 81:

	This error happens when the PAM module can't find the daemon's control socket. Very likely it will start a daemon and retry the action which requires a daemon, and stop the daemon when the PAM session closes.		This error happens when the PAM module can't find the daemon's control socket. Very likely it will start a daemon and retry the action which requires a daemon, and stop the daemon when the PAM session closes.

			=== <code>discover_other_daemon: 0</code> with <code>--start</code> ===

			This error happens when a `gnome-keyring-daemon` process with the `--start` flag either could not send `GKD_CONTROL_OP_INITIALIZE` to a control socket or got a failing result.

			=== <code>discover_other_daemon: 1</code> with <code>--start</code> ===

			This log message gets printed when a `gnome-keyring-daemon` process with the `--start` flag either successfully sent `GKD_CONTROL_OP_INITIALIZE` to a control socket.

	[[Category:Desktop]]		[[Category:Desktop]]

Axka: Add Secret portal section

2025-04-05T21:06:05Z

Add Secret portal section

← Older revision		Revision as of 21:06, 5 April 2025
Line 1:		Line 1:
	[https://specifications.freedesktop.org/secret-service-spec/latest/ Secret Service] is an API on D-Bus to allow applications to store secrets securely.		'''[https://specifications.freedesktop.org/secret-service-spec/latest/ Secret Service]''' is an API on D-Bus to allow applications to store secrets securely.

	== Providers ==		== Providers ==
Line 60:		Line 60:
	services.passSecretService.enable = true;		services.passSecretService.enable = true;
	</nowiki>}}		</nowiki>}}

			== Secret portal ==
			'''[https://flatpak.github.io/xdg-desktop-portal/docs/doc-org.freedesktop.portal.Secret.html Secret portals]''' are portals in the XDG Desktop Portal specification, which allows applications to get a per-application master secret. I ([[User:Axka\|axka]]) don't know of any applications requiring this, and to my knowledge the only provider is GNOME Keyring, which can be added to <code>xdg.portal.extraPortals</code> in Home Manager or NixOS. Adding <code>gnome-keyring</code> will also add XDG autostart definitions, but unless you have <code>gnome-keyring</code> installed on NixOS, they won't be enabled (i.e. <code>/run/wrappers/bin/gnome-keyring-daemon</code> won't work).

	== Auto-decrypt on login ==		== Auto-decrypt on login ==
Line 73:		Line 76:
	=== <code>gkr-pam: couldn't unlock the login keyring.</code> ===		=== <code>gkr-pam: couldn't unlock the login keyring.</code> ===

	This error happens when the PAM module, for some reason, can't unlock the login keyring. This may be for example because it can't connect to the daemon, which should have been started by the PAM module with the message <code>gkr-pam: gnome-keyring-daemon started properly</code>.		This error happens when the PAM module, for some reason, can't unlock the login keyring. This may be for example because it can't connect to the daemon, which should have been started by the PAM module with the message <code>gkr-pam: gnome-keyring-daemon started properly</code>. Try logging out and back in or restarting.

	=== <code>gkr-pam: unable to locate daemon control file</code> ===		=== <code>gkr-pam: unable to locate daemon control file</code> ===

	This error happens when the PAM module can't find the daemon's control socket. Very likely it will start a daemon and retry the action which requires a daemon.		This error happens when the PAM module can't find the daemon's control socket. Very likely it will start a daemon and retry the action which requires a daemon, and stop the daemon when the PAM session closes.

	[[Category:Desktop]]		[[Category:Desktop]]

Axka at 20:08, 5 April 2025

2025-04-05T20:08:49Z

← Older revision		Revision as of 20:08, 5 April 2025
Line 72:		Line 72:

	=== <code>gkr-pam: couldn't unlock the login keyring.</code> ===		=== <code>gkr-pam: couldn't unlock the login keyring.</code> ===

	This error happens when the PAM module, for some reason, can't unlock the login keyring. This may be for example because it can't connect to the daemon, which should have been started by the PAM module with the message <code>gkr-pam: gnome-keyring-daemon started properly</code>.		This error happens when the PAM module, for some reason, can't unlock the login keyring. This may be for example because it can't connect to the daemon, which should have been started by the PAM module with the message <code>gkr-pam: gnome-keyring-daemon started properly</code>.

			=== <code>gkr-pam: unable to locate daemon control file</code> ===

			This error happens when the PAM module can't find the daemon's control socket. Very likely it will start a daemon and retry the action which requires a daemon.

	[[Category:Desktop]]		[[Category:Desktop]]