Register as the default Secret Service provider (DBus service)

[raffaelemancuso]

In Tools->Settings->Secret Service, in the General tab, there should be an option to register KeePassXC as systemd default Secret Service provider.

On Ubuntu 20.10 this can be achieved by opening /usr/share/dbus-1/services/org.freedesktop.secrets.service and changing

Exec=/usr/bin/keepassxc/usr/bin/gnome-keyring-daemon --start --foreground --components=secrets

into

Exec=/usr/bin/keepassxc

We can probably have a backup of the file and if the user de-select the option we restore the backup

REASON

When an application ask for the Secret Service API on D-Bus, if there is no provider, systemd will open the defaut provider as specified in that service file. On Ubuntu this will default to gnome-keyring.

Enabling "KeePassXC freedesktop.org Secret Service integration" does not change this behavior. If KeePassXC is not already opened, at a Secret Service request on D-Bus, gnome-keyring, not KeePassXC, will be opened.

For a real use case scenario, see Maestral#352.

TEMPORARY WORKAROUND

Open a terminal and run

sudo sed -i -E 's/Exec=.*/Exec=\/usr\/bin\/keepassxc/g' /usr/share/dbus-1/services/org.freedesktop.secrets.service

[droidmonkey]

You should never change files in /usr/share like that, it will get overwritten on the next update to gnome-keyring. It also requires root permissions, which you should not be giving to KeePassXC. This will not be implemented.

[raffaelemancuso]

If we can't change /usr/share files, what is the correct official way to change systemd default Secret Service provider?

WORK AROUNDS

it will get overwritten on the next update to gnome-keyring.

Can we chattr +i the file?

It also requires root permissions, which you should not be giving to KeePassXC. This will not be implemented.

We an make a separate bash script with only that line, so the user can check before running

[droidmonkey]

You'll have to ask the Ubuntu team on this one.

[ntninja]

@raffaem: The right place to put system customization is (almost) always /etc. In this case however there seems to be no /etc directory for this, so the next best place would be /usr/local/share, where you can override the service activation file by placing a file with the same name in /usr/local/share/dbus-1/services.

Therefore:

sudo mkdir -p /usr/local/share/dbus-1/services
sudo tee /usr/local/share/dbus-1/services/org.freedesktop.secrets.service <<EOF
[D-BUS Service]
Name=org.freedesktop.secrets
Exec=/usr/bin/keepassxc
EOF

However dbus-daemon also supports per-user customization for session service activation and this is something that KeePassXC could reasonably use:

mkdir -p "${XDG_DATA_HOME:-${HOME}/.local/share}/dbus-1/services"
cat > "${XDG_DATA_HOME:-${HOME}/.local/share}/dbus-1/services/org.freedesktop.secrets.service" <<EOF
[D-BUS Service]
Name=org.freedesktop.secrets
Exec=/usr/bin/keepassxc
EOF

See https://dbus.freedesktop.org/doc/dbus-daemon.1.html for all the details of dbus configuration (in particular the <standard_session_servicedirs/>).

[droidmonkey]

@Aetf can we add the above to secret service settings so you can easily change the default provider to keepassxc?