[ISSUE] glibc-2.39_4: gnome-keyring no longer unlocked at login

[ISSUE] glibc-2.39_4: gnome-keyring no longer unlocked at login

[gc-user]

[-- Attachment #1: Type: text/plain, Size: 1374 bytes --]

New issue by gc-user on void-packages repository

https://github.com/void-linux/void-packages/issues/51399

Description:
### Is this a new report?

Yes

### System Info

oid 6.6.41_1 x86_64 GenuineIntel uptodate hold rrmDDDDDDFFFFFFFFFF

### Package(s) Affected

glibc-2.39_4.x86_64

### Does a report exist for this bug with the project's home (upstream) and/or another distro?

Not that I could find (for void).

### Expected behaviour

Usually gnome-keying gets unlocked at login so that seahorse or chrome don't need to ask for password to access the keyring or what's inside it.

### Actual behaviour

After updating from glibc-2.39_**3**.x86_64 to glibc-2.39_**4**.x86_64, chrome based browsers ask for password at start and seahorse also needs the password to open the keyring.

Downgrading to glibc-2.39_**3.**x86_64 "fixes" this issue.

Maybe some other packages needs an update to go along with glibc-2.39_4.x86_64 to not have this issue come up. E.g. some pam or libcrypt package.

### Steps to reproduce

1. Update to glibc-2.39_4.x86_64
2. Use chrome-based browser, seahorse or any other program that needs / wants access to gnome-keyring (provided that one is used to manage passwords)
3. See that those programs no longer have access to the keyring without having to put in the password. I.e. notice the keyring no longer gets unlocked at / with login.

Re: glibc-2.39_4: gnome-keyring no longer getting unlocked at login

[gc-user]

[-- Attachment #1: Type: text/plain, Size: 520 bytes --]

New comment by gc-user on void-packages repository

https://github.com/void-linux/void-packages/issues/51399#issuecomment-2244821196

Comment:
The issue seems to be able to be avoided it libgnome-keyring is installed.

Thus the title could also be "Update to glibc-2.39_4 makes libgnome-keyring to be installed necessary in order for gnome-keyring getting unlocked at login, when before that update libgnome-keyring was not needed".

So, not sure if that was an intended "improvement" in glibc or just accidentally.

Re: glibc-2.39_4: gnome-keyring no longer getting unlocked at login

[gc-user]

[-- Attachment #1: Type: text/plain, Size: 520 bytes --]

New comment by gc-user on void-packages repository

https://github.com/void-linux/void-packages/issues/51399#issuecomment-2244821196

Comment:
The issue seems to be able to be avoided if libgnome-keyring is installed.

Thus the title could also be "Update to glibc-2.39_4 makes libgnome-keyring to be installed necessary in order for gnome-keyring getting unlocked at login, when before that update libgnome-keyring was not needed".

So, not sure if that was an intended "improvement" in glibc or just accidentally.

Re: glibc-2.39_4: gnome-keyring no longer getting unlocked at login

[xHyroM]

[-- Attachment #1: Type: text/plain, Size: 435 bytes --]

New comment by xHyroM on void-packages repository

https://github.com/void-linux/void-packages/issues/51399#issuecomment-2244967859

Comment:
I've came across this issue and fixed it thanks to https://wiki.gentoo.org/wiki/LightDM#Unlock_GNOME_Keyring 

adding
```
auth     optional        pam_gnome_keyring.so #keyring
session  optional        pam_gnome_keyring.so auto_start #keyring
```
into /etc/pam.d/lightdm seems to work.

Re: glibc-2.39_4: gnome-keyring no longer getting unlocked at login

[xHyroM]

[-- Attachment #1: Type: text/plain, Size: 1139 bytes --]

New comment by xHyroM on void-packages repository

https://github.com/void-linux/void-packages/issues/51399#issuecomment-2244967859

Comment:
I've came across this issue and fixed it thanks to https://wiki.gentoo.org/wiki/LightDM#Unlock_GNOME_Keyring 

adding
```diff
#%PAM-1.0

# Block login if they are globally disabled
auth      required pam_nologin.so

# Load environment from /etc/environment and ~/.pam_environment
auth      required pam_env.so

# Use /etc/passwd and /etc/shadow for passwords
auth      required pam_unix.so

+ # keyring
+ auth     optional        pam_gnome_keyring.so

# Check account is active, change password if required
account   required pam_unix.so

# Allow password to be changed
password  required pam_unix.so

# Setup session
session   required pam_unix.so
-session   optional pam_elogind.so                   # ignore this diff, keep it
-session optional pam_ck_connector.so nox11 # ignore this diff, keep it

+ # keyring
+ session  optional        pam_gnome_keyring.so auto_start

session required /lib/security/pam_limits.so
```
into /etc/pam.d/lightdm seems to work.

Re: glibc-2.39_4: gnome-keyring no longer getting unlocked at login

[xHyroM]

[-- Attachment #1: Type: text/plain, Size: 1137 bytes --]

New comment by xHyroM on void-packages repository

https://github.com/void-linux/void-packages/issues/51399#issuecomment-2244967859

Comment:
I've came across this issue and fixed it thanks to https://wiki.gentoo.org/wiki/LightDM#Unlock_GNOME_Keyring 

modifying /etc/pam.d/lighteco seems to work.
```diff
#%PAM-1.0

# Block login if they are globally disabled
auth      required pam_nologin.so

# Load environment from /etc/environment and ~/.pam_environment
auth      required pam_env.so

# Use /etc/passwd and /etc/shadow for passwords
auth      required pam_unix.so

+ # keyring
+ auth     optional        pam_gnome_keyring.so

# Check account is active, change password if required
account   required pam_unix.so

# Allow password to be changed
password  required pam_unix.so

# Setup session
session   required pam_unix.so
-session   optional pam_elogind.so                   # ignore this diff, keep it
-session optional pam_ck_connector.so nox11 # ignore this diff, keep it

+ # keyring
+ session  optional        pam_gnome_keyring.so auto_start

session required /lib/security/pam_limits.so
```

Re: glibc-2.39_4: gnome-keyring no longer getting unlocked at login

[xHyroM]

[-- Attachment #1: Type: text/plain, Size: 1181 bytes --]

New comment by xHyroM on void-packages repository

https://github.com/void-linux/void-packages/issues/51399#issuecomment-2244967859

Comment:
I've came across this issue and fixed it thanks to https://wiki.gentoo.org/wiki/LightDM#Unlock_GNOME_Keyring 

modifying /etc/pam.d/lighteco seems to work.
```diff
#%PAM-1.0

# Block login if they are globally disabled
auth      required pam_nologin.so

# Load environment from /etc/environment and ~/.pam_environment
auth      required pam_env.so

# Use /etc/passwd and /etc/shadow for passwords
auth      required pam_unix.so

+ # keyring
+ auth     optional        pam_gnome_keyring.so

# Check account is active, change password if required
account   required pam_unix.so

# Allow password to be changed
password  required pam_unix.so

# Setup session
session   required pam_unix.so
-session   optional pam_elogind.so                   # ignore this diff, keep it
-session optional pam_ck_connector.so nox11 # ignore this diff, keep it

+ # keyring
+ session  optional        pam_gnome_keyring.so auto_start

session required /lib/security/pam_limits.so
```

but @gc-user approach is probably better

Re: glibc-2.39_4: gnome-keyring no longer getting unlocked at login

[xHyroM]

[-- Attachment #1: Type: text/plain, Size: 1216 bytes --]

New comment by xHyroM on void-packages repository

https://github.com/void-linux/void-packages/issues/51399#issuecomment-2244967859

Comment:
I've came across this issue and fixed it thanks to https://wiki.gentoo.org/wiki/LightDM#Unlock_GNOME_Keyring 

modifying /etc/pam.d/lighteco seems to work.
```diff
#%PAM-1.0

# Block login if they are globally disabled
auth      required pam_nologin.so

# Load environment from /etc/environment and ~/.pam_environment
auth      required pam_env.so

# Use /etc/passwd and /etc/shadow for passwords
auth      required pam_unix.so

+ # keyring
+ auth     optional        pam_gnome_keyring.so

# Check account is active, change password if required
account   required pam_unix.so

# Allow password to be changed
password  required pam_unix.so

# Setup session
session   required pam_unix.so
-session   optional pam_elogind.so                   # ignore this diff, keep it
-session optional pam_ck_connector.so nox11 # ignore this diff, keep it

+ # keyring
+ session  optional        pam_gnome_keyring.so auto_start

session required /lib/security/pam_limits.so
```

but @gc-user's approach by installing `libgnome-keyring` is probably better

Re: glibc-2.39_4: gnome-keyring no longer getting unlocked at login

[ahesford]

[-- Attachment #1: Type: text/plain, Size: 385 bytes --]

New comment by ahesford on void-packages repository

https://github.com/void-linux/void-packages/issues/51399#issuecomment-2246171796

Comment:
Installing `libgnome-keyring` is not the rigth fix, because that package has been removed. This should also have nothing to do with glibc.

The right fix is modifying the appropriate PAM configuration for whatever you are using to log in.

Re: glibc-2.39_4: gnome-keyring no longer getting unlocked at login

[gc-user]

[-- Attachment #1: Type: text/plain, Size: 271 bytes --]

New comment by gc-user on void-packages repository

https://github.com/void-linux/void-packages/issues/51399#issuecomment-2246189699

Comment:
On my system, those setting were always necessary, i.e. not a new requirement for glibc-2.39_4.x86_64 (on my system, at least).

Re: glibc-2.39_4: gnome-keyring no longer getting unlocked at login

[classabbyamp]

[-- Attachment #1: Type: text/plain, Size: 286 bytes --]

New comment by classabbyamp on void-packages repository

https://github.com/void-linux/void-packages/issues/51399#issuecomment-2246196991

Comment:
the only thing different between _3 and _4 is https://github.com/void-linux/void-packages/commit/4c973e67f4ae521b6e8a5d2cc7c15df71e95bf22

Re: glibc-2.39_4: gnome-keyring no longer getting unlocked at login

[xHyroM]

[-- Attachment #1: Type: text/plain, Size: 1220 bytes --]

New comment by xHyroM on void-packages repository

https://github.com/void-linux/void-packages/issues/51399#issuecomment-2244967859

Comment:
I've came across this issue and fixed it thanks to https://wiki.gentoo.org/wiki/LightDM#Unlock_GNOME_Keyring 

modifying /etc/pam.d/lighteco seems to work.
```diff
#%PAM-1.0

# Block login if they are globally disabled
auth      required pam_nologin.so

# Load environment from /etc/environment and ~/.pam_environment
auth      required pam_env.so

# Use /etc/passwd and /etc/shadow for passwords
auth      required pam_unix.so

+ # keyring
+ auth     optional        pam_gnome_keyring.so

# Check account is active, change password if required
account   required pam_unix.so

# Allow password to be changed
password  required pam_unix.so

# Setup session
session   required pam_unix.so
-session   optional pam_elogind.so                   # ignore this diff, keep it
-session optional pam_ck_connector.so nox11 # ignore this diff, keep it

+ # keyring
+ session  optional        pam_gnome_keyring.so auto_start

session required /lib/security/pam_limits.so
```

but @gc-user's approach by installing `libgnome-keyring` is probably also a way

Re: glibc-2.39_4: gnome-keyring no longer getting unlocked at login

[gc-user]

[-- Attachment #1: Type: text/plain, Size: 632 bytes --]

New comment by gc-user on void-packages repository

https://github.com/void-linux/void-packages/issues/51399#issuecomment-2246224176

Comment:
Well "should" and reality sometimes don't align.
If I downgrade to "_3" and it works, when with "_4" it doesn't, something's wrong. I checked the diff file and also saw that there shouldn't be any reason for it not to work, but it is like it is.

I only tested libgnome-keyring (which still is available from the void repos) because I came across it being a solution in some other (maybe Mint Linux?) forum. I wasn't happy it worked... :-) because I didn't want this to be "the fix"...

Re: glibc-2.39_4: gnome-keyring no longer getting unlocked at login

[xHyroM]

[-- Attachment #1: Type: text/plain, Size: 757 bytes --]

New comment by xHyroM on void-packages repository

https://github.com/void-linux/void-packages/issues/51399#issuecomment-2246292182

Comment:
> Well "should" and reality sometimes don't align. If I downgrade to "_3" and it works, when with "_4" it doesn't, something's wrong. I checked the diff file and also saw that there shouldn't be any reason for it not to work, but it is like it is.
> 
> I only tested libgnome-keyring (which still is available from the void repos) because I came across it being a solution in some other (maybe Mint Linux?) forum. I wasn't happy it worked... :-) because I didn't want this to be "the fix"...

I looked into many forums including arch, gentoo and also reddit and the gentoo wiki worked for me as I said earlier.

Re: glibc-2.39_4: gnome-keyring no longer getting unlocked at login

[gc-user]

[-- Attachment #1: Type: text/plain, Size: 275 bytes --]

New comment by gc-user on void-packages repository

https://github.com/void-linux/void-packages/issues/51399#issuecomment-2247248474

Comment:
To phrase my first reply differently to express the same:

The /etc/pam.d/lightdm file on my system has those entries since 2020.

Re: glibc-2.39_4: gnome-keyring no longer getting unlocked at login

[xHyroM]

[-- Attachment #1: Type: text/plain, Size: 436 bytes --]

New comment by xHyroM on void-packages repository

https://github.com/void-linux/void-packages/issues/51399#issuecomment-2247260047

Comment:
> To phrase my first reply differently to express the same:
> 
> The /etc/pam.d/lightdm file on my system has those entries since 2020.

Sorry, I didn't see it before. Do you also have those entries in /etc/pam.d/login? Well it's probably not required but I have these in those two places.

Re: glibc-2.39_4: gnome-keyring no longer getting unlocked at login

[xHyroM]

[-- Attachment #1: Type: text/plain, Size: 429 bytes --]

New comment by xHyroM on void-packages repository

https://github.com/void-linux/void-packages/issues/51399#issuecomment-2247260047

Comment:
> To phrase my first reply differently to express the same:
> 
> The /etc/pam.d/lightdm file on my system has those entries since 2020.

Sorry, I overlooked it. Do you also have those entries in /etc/pam.d/login? Well it's probably not required but I have these in those two places.

Re: glibc-2.39_4: gnome-keyring no longer getting unlocked at login

[xHyroM]

[-- Attachment #1: Type: text/plain, Size: 425 bytes --]

New comment by xHyroM on void-packages repository

https://github.com/void-linux/void-packages/issues/51399#issuecomment-2247260047

Comment:
> To phrase my first reply differently to express the same:
> 
> The /etc/pam.d/lightdm file on my system has those entries since 2020.

Sorry, I missed it. Do you also have those entries in /etc/pam.d/login? Well it's probably not required but I have these in those two places.

Re: glibc-2.39_4: gnome-keyring no longer getting unlocked at login

[gc-user]

[-- Attachment #1: Type: text/plain, Size: 988 bytes --]

New comment by gc-user on void-packages repository

https://github.com/void-linux/void-packages/issues/51399#issuecomment-2247268211

Comment:
I did some more testing.
I removed libgnome-keyring. Surprisingly (or not), the keyring still gets unlocked at login now. Even with the "_4" glibc. As one would expect.
But it's still mystery to my, why from around the 19th of July until yesterday that wasn't the case and a chrome-based browser asked for the password at start after a new boot.

I'll keep watching this and digging should this re-appear.

There were some updates for other packages yesterday and today, but none that I would suspect to be involved in this issue from their names (and description in octo-xbps). I tested pkc11-helper (because it's descriptions it's apparently involved in cryptographic stuff, but I didn't expect it to be involved here - just grasping for something... :-)) by downgrading to the version before yesterday, but it didn't make a difference.

Re: [ISSUE] [CLOSED] glibc-2.39_4: gnome-keyring no longer getting unlocked at login

[gc-user]

[-- Attachment #1: Type: text/plain, Size: 1406 bytes --]

Closed issue by gc-user on void-packages repository

https://github.com/void-linux/void-packages/issues/51399

Description:
### Is this a new report?

Yes

### System Info

oid 6.6.41_1 x86_64 GenuineIntel uptodate hold rrmDDDDDDFFFFFFFFFF

### Package(s) Affected

glibc-2.39_4.x86_64

### Does a report exist for this bug with the project's home (upstream) and/or another distro?

Not that I could find (for void).

### Expected behaviour

Usually gnome-keying gets unlocked at login so that seahorse or chrome don't need to ask for password to access the keyring or what's inside it.

### Actual behaviour

After updating from glibc-2.39_**3**.x86_64 to glibc-2.39_**4**.x86_64, chrome based browsers ask for password at start and seahorse also needs the password to open the keyring.

Downgrading to glibc-2.39_**3**.x86_64 "fixes" this issue.

Maybe some other package needs an update to go along with glibc-2.39_4.x86_64 to not have this issue come up. E.g. some pam or libcrypt package.

### Steps to reproduce

1. Update to glibc-2.39_4.x86_64.
2. Use chrome-based browser, seahorse or any other program that needs / wants access to gnome-keyring (provided that one is used to manage passwords).
3. See that those programs no longer have access to the keyring without having to put in the password. I.e. notice the keyring no longer geting unlocked at / with login.

Re: glibc-2.39_4: gnome-keyring no longer getting unlocked at login

[gc-user]

[-- Attachment #1: Type: text/plain, Size: 641 bytes --]

New comment by gc-user on void-packages repository

https://github.com/void-linux/void-packages/issues/51399#issuecomment-2247271938

Comment:
> > To phrase my first reply differently to express the same:
> > The /etc/pam.d/lightdm file on my system has those entries since 2020.
> 
> Sorry, I missed it. Do you also have those entries in /etc/pam.d/login? Well it's probably not required but I have these in those two places.

Nope. But as it works as of today with going back to the previous state, I'll just keep watching the issue and test adding it to that file, too, should it re-appear to see what happens.
Thanks for the hint!

Re: glibc-2.39_4: gnome-keyring no longer getting unlocked at login

[gc-user]

[-- Attachment #1: Type: text/plain, Size: 793 bytes --]

New comment by gc-user on void-packages repository

https://github.com/void-linux/void-packages/issues/51399#issuecomment-2254474116

Comment:
So the issue still occurs.
It's not happening necessarily at every login. If it occurs, logging out and logging in again can make the issue not occur for that boot session.

But in both cases "everything.log" shows
`[lightdm] gkr-pam: gnome-keyring-daemon started properly and unlocked keyring`

So, in both cases allegedly the keyring is unlocked, but when checked (eg. by starting a chrome-based browser or checking using seahorse) in one case the keyring really is unlocked, in the other it isn't.

So, maybe there's some issue by a step is skipped / forgotten or the order of necessary steps is invalid in one case vs the other at login.

Re: glibc-2.39_4: gnome-keyring no longer getting unlocked at login

[gc-user]

[-- Attachment #1: Type: text/plain, Size: 414 bytes --]

New comment by gc-user on void-packages repository

https://github.com/void-linux/void-packages/issues/51399#issuecomment-2254479413

Comment:
For now, I added the respective entries in `/etc/pam.d/lightdm` also to `/etc/pam.d/login` as https://wiki.archlinux.org/title/GNOME/Keyring suggests this. Maybe that is more reliable than (just) having them in `/etc/pam.d/lightdm`.

I'll see and report if that helps.

Re: glibc-2.39_4: gnome-keyring no longer getting unlocked at login

[gc-user]

[-- Attachment #1: Type: text/plain, Size: 617 bytes --]

New comment by gc-user on void-packages repository

https://github.com/void-linux/void-packages/issues/51399#issuecomment-2261220511

Comment:
Well, adding the respective entries in /etc/pam.d/lightdm also to /etc/pam.d/login didn't change anything, i.e. didn't help.
Downgrading glibc again worked for one day. Then the same thing happend, when no such problem occurred with that version until this issue report for the successor version.
So, I updated to the latest glibc version again and will check what other package was updated around the 19th/20th of July on my system to see if one of these is responsible.

Re: glibc-2.39_4: gnome-keyring no longer getting unlocked at login

[gc-user]

[-- Attachment #1: Type: text/plain, Size: 304 bytes --]

New comment by gc-user on void-packages repository

https://github.com/void-linux/void-packages/issues/51399#issuecomment-2707231516

Comment:
Just to follow up on this issue:

The issue-causing packages turned out to be [xfce4-session v4.18.4](https://github.com/void-linux/void-packages/issues/53073).