#1142693 greetd: Regression: keyring is not automatically opened at login

Package:
gnome-keyring
Source:
gnome-keyring
Description:
GNOME keyring services (daemon and tools)
Submitter:
Daniel Dehennin
Date:
2026-10-02 16:11:02 UTC
Severity:
normal
Tags:
#1142693#5
Date:
2026-07-24 07:08:28 UTC
From:
To:
Dear Maintainer,

After the update of PAM configuration to include common-* instead of login
(#1140127), I was surprised that my keyring ask for a password.

I found that pam_gnome_keyring and pam_kwallet5 were removed in the process.

The /etc/pam.d/common-password has the gnome-keyring line but not /etc/pam.d/common-session.

So, it seems that the “session optional pam_gnome_keyring.so auto_start” is missing.

Regards.
#1142693#10
Date:
2026-07-24 14:09:09 UTC
From:
To:
Control: reassign -1 gnome-keyring
Control: affects -1 greetd

It seems *to me* unlikely that each package should work around this,
so maybe the gnome-keyring maintainers can chime in here, and
ideally document the requirements for pam_gnome_keyring.so.

Best,
Chris
#1142693#21
Date:
2026-08-04 15:13:26 UTC
From:
To:
Hi,
please, do not treat this as a GNOME-specific bug: as the original
reporter pointed out, kwallet is affected as well.

FTR, greetd is the base of Mobian's login manager phrog, i.e. it can be
used to launch GNOME- and KDE-based shells.

On the topic of the PAM config lines, I remember both auth/session lines
always been required, see e.g. [1][2], so I don't get why now either
should be dropped and the other left.

On the kwallet/gnome-keyring requirements, likely kwallet's README [3]
shows why both auth/session lines are required.

Kind regards
Marco

[1]
https://wiki.archlinux.org/title/KDE_Wallet#Configure_PAM_on_Plasma_6_(KF6)
[2] https://wiki.archlinux.org/title/GNOME/Keyring#PAM_step
[3]
https://invent.kde.org/plasma/kwallet-pam/-/blob/master/README.txt?ref_type=heads
#1142693#31
Date:
2026-08-05 09:18:10 UTC
From:
To:
(CC'ing a few of the last uploaders specifically.)

libpam-gnome-keyring currently installs a pam-auth-update config,
but only does so for "password". [A]

People in this bug report suggest that also "auth" and "session" are
necessary.

Please see to this bug report, to avoid degrading user experience,
or settle this manner in some other way. As said above, having each
login manager do something special does not scale.

Best,
Chris


[A] https://sources.debian.org/src/gnome-keyring/50.0-1/debian/pam-configs/gnome-keyring
#1142693#40
Date:
2026-08-10 20:59:41 UTC
From:
To:
Hi,

does attached diff look sane? If so, I can upload this sometime this
week.

best,

werdahias
#1142693#45
Date:
2026-08-10 21:36:13 UTC
From:
To:
I think you need separate Auth-... and Session-... stanzas.
Possibly Session also wants Session-Interactive-Only?

Unfortunately I don't know where this format is documented. Maybe
https://sources.debian.org/src/pam/1.7.0-8/debian/pam-configs/unix
is a good reference.

Best,
Chris
#1142693#50
Date:
2026-08-11 11:08:27 UTC
From:
To:
Am 2026-08-10 23:36, schrieb Chris Hofstaedtler:
Hi,

thanks. Updated patch attached (though untested).

best,

werdahias
#1142693#55
Date:
2026-08-11 18:16:23 UTC
From:
To:
Hi,

a amd64 package with above patch can be found at

people.debian.org/~werdahias/libpam-gnome-keyring_50.0-1_amd64.deb

if anyone wants to test it. I likely won't have time until later.

best,
#1142693#60
Date:
2026-08-13 07:36:44 UTC
From:
To:
Quack,

Thanks Matthias for the fix.
The sessions is properly added to common-session and not to
common-session-noninteractive as expected but common-auth is not
updated. I guess you might need to add "Auth-Type: Additional" too.

Chris, thanks a lot for giving a hand here :-).

Regards.
\_o<
#1142693#65
Date:
2026-08-13 10:55:06 UTC
From:
To:
Aug 13, 2026 09:36:59 Marc Dequènes (duck) <duck@duckcorp.org>:
Hi,

thanks, I will add that too. Anything else that was overlooked? I have little experience with PAM.

best,

werdahias
#1142693#70
Date:
2026-08-14 15:54:23 UTC
From:
To:
Quack,

I have added the line manually, dpkg-reconfigure, and the auth line
appeared, rebooted (because sometimes some user processes seems to stay
around after logout, just in case), logged in and gnome-keyring-daemon
seemed happy, did not ask for password after login. So I think we're
good here.

Thanks a lot for the prompt reply.

Regards.
\_o<
#1142693#75
Date:
2026-08-15 11:17:56 UTC
From:
To:
Hi Marc,

I rebuilt it with said change, rebooted too, but after login gnome-k-d
still prompted me to enter my password. I am not sure why, but if it
works on your machine I am willing to upload this change.

best,
#1142693#86
Date:
2026-10-02 09:28:56 UTC
From:
To:
Quack,

Not sure why it's not working for you. An update overrode the changes so
I had to do it again and here is what I did.

I edit /usr/share/pam-configs/gnome-keyring to be like this:
===
Name: GNOME Keyring Daemon - Login keyring management
Default: yes
Priority: 0
Password-Type: Additional
Password-Final:
     optional    pam_gnome_keyring.so
Auth-Type: Additional
Auth:
     optional     pam_gnome_keyring.so
Session-Type: Additional
Session-Interactive-Only: yes
Session:
     optional     pam_gnome_keyring.so auto_start
===

Then I just run pam-auth-update and reboot or slay duck and log in again
and then it stops asking for keyring unlock.

Regards.
\_o<
#1142693#91
Date:
2026-10-02 15:07:57 UTC
From:
To:
Hi,

I did that, but it still does not work for me. But if you tested that, I
am willing to upload that fix.

best,
#1142693#94
Date:
2026-10-02 15:16:43 UTC
From:
To:
Hello,

Bug #1142693 in gnome-keyring reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/gnome-team/gnome-keyring/-/commit/fbb1a25406178ac74e62c4e43391e7923d039e76

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1142693
#1142693#101
Date:
2026-10-02 16:08:34 UTC
From:
To:
We believe that the bug you reported is fixed in the latest version of
gnome-keyring, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1142693@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Matthias Geiger <werdahias@debian.org> (supplier of updated gnome-keyring package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 02 Oct 2026 17:14:19 +0200
Source: gnome-keyring
Architecture: source
Version: 51.1-2
Distribution: unstable
Urgency: medium
Maintainer: Debian GNOME Maintainers <pkg-gnome-maintainers@lists.alioth.debian.org>
Changed-By: Matthias Geiger <werdahias@debian.org>
Closes: 1142693 1143492
Changes:
 gnome-keyring (51.1-2) unstable; urgency=medium
 .
   * Update pam config to ship Auth/Session lines too (Closes: #1142693, #1143492)
Checksums-Sha1:
 29f0a95320ba1dc2a59e35d796a53b384a6a2597 2889 gnome-keyring_51.1-2.dsc
 e92add856563f9dbc14f0ec8b6caf14a08e38a2c 20356 gnome-keyring_51.1-2.debian.tar.xz
 35fd5de28be4116410789e685b798e87100008db 1872444 gnome-keyring_51.1-2.git.tar.xz
 82ff689e3a6336c05c26865b99dedb8eaa3a8189 17744 gnome-keyring_51.1-2_source.buildinfo
Checksums-Sha256:
 949f53e2cab373c4986de3f2c9186a412ceb0fcb7c50a94d1375ca1b5f55fbf3 2889 gnome-keyring_51.1-2.dsc
 d4a00c01bc1e6de9fff73121810b74a97e52ed55895b40a5f2e9357db067bc7a 20356 gnome-keyring_51.1-2.debian.tar.xz
 d6d513ffc8563c24a897d6befbfdfa51e90a1664117f59d410ba00dcea68f0ae 1872444 gnome-keyring_51.1-2.git.tar.xz
 145789105418997ad0dc3d713950aa3da390cfdc47480697fdf151002c1cd712 17744 gnome-keyring_51.1-2_source.buildinfo
Files:
 e80ee6e21ac4551c21a233adb7221135 2889 gnome optional gnome-keyring_51.1-2.dsc
 90bcf30f875dd3e7731664527ae955f2 20356 gnome optional gnome-keyring_51.1-2.debian.tar.xz
 13503336271df2fbe791953384d87b5e 1872444 gnome None gnome-keyring_51.1-2.git.tar.xz
 e5309a69304245b986d06cd220d4552d 17744 gnome optional gnome-keyring_51.1-2_source.buildinfo
Git-Tag-Info: tag=d8de431650d5c58d521fea08f03fc421ed50616e fp=14593bff4a5ebf6fe0e9716eecbedbb607b9b2be
Git-Tag-Tagger: Matthias Geiger <werdahias@debian.org>
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmq/yycACgkQYG0ITkaD
wHnvFQ/6A6q+cFqnJPqr6E+6ko0deYgcx2Fsx3ZG+FIZDrDq7VKbUOlX+7RI9uX7
rViD6PZiH/jw9Y1ol46QcFC+BVPBPfujUs2IwXm1NVpsgqUVcLZHzc+rtqc6gw7d
86W9SRJ2vKSSuNsWhIUa9weC44am9rKA+mIE9YWySVMkKAi+x4THhFZ3vkyO17kS
g6CXsMJD05wO6Glb9VQULwOyfv7M8Z5Z+7jVUlUb/kfhTLepTyDDzAktwZvq5dUs
9iYZEVe0kJBzeg6/HNEACWIWNBEro8NSuG73mXPKEbNHmaYB2RGWBdKf9UTljzvj
6PnlRRwJkQeBDDmZTlP0FIXWLEqVS9jjLEXLkSyGZfGsoiEqoXEF176h542fMMH8
ck4X7oF/hh16f9w+NvIEAoHl1/r/Soj3T2MkbfQrKt8J2/L7q5fK7nV3juswKm48
1TVrg54g3Tmlf9+yT2Q+DN7zu9XD5wR+0ighPrvbZF2ef1Ro90XQO6HshUr9dL5O
HZuUZrqS3MyfbBymp57rxsM3nZDX1u6OyjD/1zj1XThU/Ylu7XNjj7heobX5UsMx
mQwwg2MBESPWR6Hnh+jwuuUDnYn9MmgTcyOmgFjrND8YFhoZ0OoGVjj4FRoGAhpa
jQXKmFar+7eCPKkn5mnOsQdiLibUfEmDw/GtvTqz7+AyyKVg4u0=
=G0/Z
-----END PGP SIGNATURE-----