#1142693 greetd: Regression: keyring is not automatically opened at login

Package:
gnome-keyring
Source:
gnome-keyring
Description:
GNOME keyring services (daemon and tools)
Submitter:
Daniel Dehennin
Date:
2026-08-15 11:23:01 UTC
Severity:
normal
#1142693#5
Date:
2026-07-24 07:08:28 UTC
From:
To:
Dear Maintainer,

After the update of PAM configuration to include common-* instead of login
(#1140127), I was surprised that my keyring ask for a password.

I found that pam_gnome_keyring and pam_kwallet5 were removed in the process.

The /etc/pam.d/common-password has the gnome-keyring line but not /etc/pam.d/common-session.

So, it seems that the “session optional pam_gnome_keyring.so auto_start” is missing.

Regards.
#1142693#10
Date:
2026-07-24 14:09:09 UTC
From:
To:
Control: reassign -1 gnome-keyring
Control: affects -1 greetd

It seems *to me* unlikely that each package should work around this,
so maybe the gnome-keyring maintainers can chime in here, and
ideally document the requirements for pam_gnome_keyring.so.

Best,
Chris
#1142693#21
Date:
2026-08-04 15:13:26 UTC
From:
To:
Hi,
please, do not treat this as a GNOME-specific bug: as the original
reporter pointed out, kwallet is affected as well.

FTR, greetd is the base of Mobian's login manager phrog, i.e. it can be
used to launch GNOME- and KDE-based shells.

On the topic of the PAM config lines, I remember both auth/session lines
always been required, see e.g. [1][2], so I don't get why now either
should be dropped and the other left.

On the kwallet/gnome-keyring requirements, likely kwallet's README [3]
shows why both auth/session lines are required.

Kind regards
Marco

[1]
https://wiki.archlinux.org/title/KDE_Wallet#Configure_PAM_on_Plasma_6_(KF6)
[2] https://wiki.archlinux.org/title/GNOME/Keyring#PAM_step
[3]
https://invent.kde.org/plasma/kwallet-pam/-/blob/master/README.txt?ref_type=heads
#1142693#31
Date:
2026-08-05 09:18:10 UTC
From:
To:
(CC'ing a few of the last uploaders specifically.)

libpam-gnome-keyring currently installs a pam-auth-update config,
but only does so for "password". [A]

People in this bug report suggest that also "auth" and "session" are
necessary.

Please see to this bug report, to avoid degrading user experience,
or settle this manner in some other way. As said above, having each
login manager do something special does not scale.

Best,
Chris


[A] https://sources.debian.org/src/gnome-keyring/50.0-1/debian/pam-configs/gnome-keyring
#1142693#40
Date:
2026-08-10 20:59:41 UTC
From:
To:
Hi,

does attached diff look sane? If so, I can upload this sometime this
week.

best,

werdahias
#1142693#45
Date:
2026-08-10 21:36:13 UTC
From:
To:
I think you need separate Auth-... and Session-... stanzas.
Possibly Session also wants Session-Interactive-Only?

Unfortunately I don't know where this format is documented. Maybe
https://sources.debian.org/src/pam/1.7.0-8/debian/pam-configs/unix
is a good reference.

Best,
Chris
#1142693#50
Date:
2026-08-11 11:08:27 UTC
From:
To:
Am 2026-08-10 23:36, schrieb Chris Hofstaedtler:
Hi,

thanks. Updated patch attached (though untested).

best,

werdahias
#1142693#55
Date:
2026-08-11 18:16:23 UTC
From:
To:
Hi,

a amd64 package with above patch can be found at

people.debian.org/~werdahias/libpam-gnome-keyring_50.0-1_amd64.deb

if anyone wants to test it. I likely won't have time until later.

best,
#1142693#60
Date:
2026-08-13 07:36:44 UTC
From:
To:
Quack,

Thanks Matthias for the fix.
The sessions is properly added to common-session and not to
common-session-noninteractive as expected but common-auth is not
updated. I guess you might need to add "Auth-Type: Additional" too.

Chris, thanks a lot for giving a hand here :-).

Regards.
\_o<
#1142693#65
Date:
2026-08-13 10:55:06 UTC
From:
To:
Aug 13, 2026 09:36:59 Marc Dequènes (duck) <duck@duckcorp.org>:
Hi,

thanks, I will add that too. Anything else that was overlooked? I have little experience with PAM.

best,

werdahias
#1142693#70
Date:
2026-08-14 15:54:23 UTC
From:
To:
Quack,

I have added the line manually, dpkg-reconfigure, and the auth line
appeared, rebooted (because sometimes some user processes seems to stay
around after logout, just in case), logged in and gnome-keyring-daemon
seemed happy, did not ask for password after login. So I think we're
good here.

Thanks a lot for the prompt reply.

Regards.
\_o<
#1142693#75
Date:
2026-08-15 11:17:56 UTC
From:
To:
Hi Marc,

I rebuilt it with said change, rebooted too, but after login gnome-k-d
still prompted me to enter my password. I am not sure why, but if it
works on your machine I am willing to upload this change.

best,