Arch Linux

ltsdw

Member

Registered: 2020-04-20

Posts: 76

problem setting automatic unlocking using gnome-keyring and PAM

I'm trying following the example from arch wiki PAM Step but I want it to work when running the su command to switch users.

like for example, I have this on my /etc/pam.d/su-l

#%PAM-1.0
auth            sufficient      pam_rootok.so
auth            optional        pam_gnome_keyring.so
# Uncomment the following line to implicitly trust users in the "wheel" group.
#auth           sufficient      pam_wheel.so trust use_uid
# Uncomment the following line to require a user to be in the "wheel" group.
#auth           required        pam_wheel.so use_uid
auth            required        pam_unix.so
account         required        pam_unix.so
session	        required        pam_unix.so
session         optional        pam_gnome_keyring.so auto_start
password        include         system-auth

but I see this at the logs:

...
su[95125]: gkr-pam: no password is available for user
su[95156]: gkr-pam: couldn't setup credentials: Operation not permitted
su[95125]: pam_unix(su-l:session): session opened for user mg_user(uid=1002) by (uid=1000)
su[95125]: gkr-pam: gnome-keyring-daemon didn't start properly
....
gnome-keyring-daemon[10478]: The SSH agent was already initialized
gnome-keyring-daemon[10478]: The Secret Service was already initialized
gnome-keyring-daemon[10478]: The PKCS#11 component was already initialized
...

And I have a default keyring created with seahorse (at /home/mg_user/.local/share/keyrings/Default_keyring.keyring), and the password is the same that I use for my user.

Edit:

I moved the auth part to be the last as mentioned at the wiki.

#%PAM-1.0
auth            sufficient      pam_rootok.so
# Uncomment the following line to implicitly trust users in the "wheel" group.
#auth           sufficient      pam_wheel.so trust use_uid
# Uncomment the following line to require a user to be in the "wheel" group.
#auth           required        pam_wheel.so use_uid
auth            required        pam_unix.so
auth            optional        pam_gnome_keyring.so
account         required        pam_unix.so
session	        required        pam_unix.so
session         optional        pam_gnome_keyring.so auto_start
password        include         system-auth

now the "gkr-pam: no password is available for user" is not appearing in the log anymore, but the rest still.

...
su[101036]: pam_unix(su-l:session): session opened for user mg_user(uid=1002) by (uid=1000)
su[101059]: gkr-pam: couldn't setup credentials: Operation not permitted
su[101036]: gkr-pam: gnome-keyring-daemon didn't start properly
...

Last edited by ltsdw (2021-12-08 03:55:31)