Arch Linux

tvidal

Member

Registered: 2020-06-18

Posts: 23

Unlocking kwallet before everything else

Edit:
Well, I think the kde wallet issue is unrelated, I am reading https://wiki.archlinux.org/title/KDE_Wa … y_on_login and I have configured all pam.d files as indicated:

$ grep -Hrni 'kwallet' /etc/pam.d
/etc/pam.d/sddm:5:-auth       optional    pam_kwallet5.so
/etc/pam.d/sddm:15:-session    optional    pam_kwallet5.so         auto_start
/etc/pam.d/sddm-autologin:8:-auth       optional    pam_kwallet5.so
/etc/pam.d/sddm-autologin:13:-session    optional    pam_kwallet5.so auto_start
/etc/pam.d/login:5:auth     optional  pam_kwallet5.so
/etc/pam.d/login:8:session  optional  pam_kwallet5.so auto_start force_run

These are the kwallet related packages I have installed:

$ pacman -Qsq kwallet
ksshaskpass
kwallet
kwallet-pam
kwallet5
kwalletmanager
signon-kwallet-extension

But I still get a prompt to unlock kwallet on startup which causes the other apps to fail.

Any suggestion about what I could be missing to have kwallet unlock automatically? I am using autologin but kwallet's password is the same as my login password.

Edit 2:
Since the post says auto unlock is only compatible with blowfish and I wasn't sure which encryption I used back when I first created the wallet, so I exported the data as xml, deleted the wallet, created a new one using blowfish, set it as default and re-imported the xml data. The issue still persists.

Original Post:
I am having this problem of a race condition where sometimes, maybe every 1 out of every 3 reboots, Slack / Steam start before the kwallet is unlocked and an error message shows up; and I would like to consistently unlock kwallet before all applications are started.

Steam starts with steam.desktop under ~/.config/autostart:

$ cat ~/.config/autostart/steam.desktop
[Desktop Entry]
Name=Steam (Runtime)
Comment=Application for managing and playing games on Steam
Exec=/usr/bin/steam-native -silent
Icon=steam
Terminal=false
Type=Application
Categories=Network;FileTransfer;Game;
MimeType=x-scheme-handler/steam;x-scheme-handler/steamlink;
PrefersNonDefaultGPU=true
X-KDE-RunOnDiscreteGpu=true

Slack starts with as a systemd user timer/service:

$ noglob systemctl --user cat slack.*
# /home/thiago/.config/systemd/user/slack.timer
[Unit]
Description=Slack as as Service Timer

[Timer]
Persistent=true
OnStartupSec=10
OnCalendar=Mon..Fri *-*-* 08..17:*:*

[Install]
WantedBy=timers.target

# /home/thiago/.config/systemd/user/slack.service
[Unit]
Description=Slack as as Service
Wants=network-online.target plasma-workspace.target
After=network-online.target plasma-workspace.target

[Service]
Type=oneshot
RemainAfterExit=true
ExecStart=%h/.scripts/bin/slack-open
ExecReload=kill -1 $MAINPID
ExecStop=kill $MAINPID

I think kwallet is being unlocked with /etc/xdg/autostart/pam_kwallet_init.desktop as per:

$ pacman -Ql kwallet-pam
kwallet-pam /etc/
kwallet-pam /etc/xdg/
kwallet-pam /etc/xdg/autostart/
kwallet-pam /etc/xdg/autostart/pam_kwallet_init.desktop
kwallet-pam /usr/
kwallet-pam /usr/lib/
kwallet-pam /usr/lib/pam_kwallet_init
kwallet-pam /usr/lib/security/
kwallet-pam /usr/lib/security/pam_kwallet5.so
kwallet-pam /usr/lib/systemd/
kwallet-pam /usr/lib/systemd/user/
kwallet-pam /usr/lib/systemd/user/plasma-kwallet-pam.service

since plasma-kwallet-pam.service is not running and cannot be enabled:

$ systemctl --user enable --now plasma-kwallet-pam.service
The unit files have no installation config (WantedBy=, RequiredBy=, UpheldBy=,
Also=, or Alias= settings in the [Install] section, and DefaultInstance= for
template units). This means they are not meant to be enabled or disabled using systemctl.

Possible reasons for having these kinds of units are:
• A unit may be statically enabled by being symlinked from another unit's
  .wants/, .requires/, or .upholds/ directory.
• A unit's purpose may be to act as a helper for some other unit which has
  a requirement dependency on it.
• A unit may be started when needed via activation (socket, path, timer,
  D-Bus, udev, scripted systemctl call, ...).
• In case of template units, the unit is meant to be enabled with some
  instance name specified.

$ systemctl --user cat plasma-kwallet-pam.service
# /usr/lib/systemd/user/plasma-kwallet-pam.service
[Unit]
Description=Unlock kwallet from pam credentials
PartOf=graphical-session.target
Before=plasma-plasmashell.service plasma-kded6.service
After=plasma-kwin_wayland.service plasma-kcminit.service

[Service]
ExecStart=/usr/lib/pam_kwallet_init
Type=simple
Slice=background.slice
Restart=no

Any suggestion to have plasma-kwallet-pam.service start before everything else?

Last edited by tvidal (2025-11-19 11:17:28)