Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Unwanted removal of key from KeePassXC SecretService #8916

Open
CrfzdPQM6 opened this issue Dec 23, 2022 · 1 comment
Open

Unwanted removal of key from KeePassXC SecretService #8916

CrfzdPQM6 opened this issue Dec 23, 2022 · 1 comment

Comments

@CrfzdPQM6
Copy link

CrfzdPQM6 commented Dec 23, 2022

Overview

KeepassXC is great.

I use KeePassXC to store the passphrase for my GPG authentication key, which is used for various SSH log-ins. I unlock my keepassxc db, and start my day. After a few minutes, though, I find my keepassxc in a modified state ('*' next to filename) and the passphrase for my authentication key has been deleted. Initially I blamed VSCode alone because this interacts with that passphrase a lot as (I think) it tries to update multiple git repositories open in a single window.

I noticed, too, that opening Skype seemed to trigger the issue, too, so I did that. I used dbus-monitor to see the delete request. I'm not sure how much to paste, so I've put just enough to show what's going on

method call time=1671787331.854669 sender=:1.1860 -> destination=org.freedesktop.secrets serial=102 path=/org/freedesktop/secrets/collection/KP_5FWork/<redacted>; interface=org.freedesktop.Secret.Item; member=Delete
method return time=1671787331.854736 sender=:1.660 -> destination=:1.1860 serial=125 reply_serial=101
   array [
      object path "/org/freedesktop/secrets/collection/KP_5FWork/<redacted>"
   ]
   array [
   ]
method return time=1671787331.854798 sender=:1.660 -> destination=:1.1860 serial=126 reply_serial=102
   object path "/org/freedesktop/secrets/prompt/<redacted>"
method call time=1671787331.854908 sender=:1.1860 -> destination=org.freedesktop.secrets serial=103 path=/org/freedesktop/secrets/collection/KP_5FWork/<redacted>; interface=org.freedesktop.Secret.Item; member=Delete
method call time=1671787331.854978 sender=:1.1860 -> destination=org.freedesktop.DBus serial=104 path=/org/freedesktop/DBus; interface=org.freedesktop.DBus; member=AddMatch
   string "type='signal',sender='org.freedesktop.secrets',interface='org.freedesktop.Secret.Prompt',path='/org/freedesktop/secrets/prompt/<redacted>'"
method return time=1671787331.854983 sender=org.freedesktop.DBus -> destination=:1.1860 serial=29 reply_serial=104
method return time=1671787331.855042 sender=:1.660 -> destination=:1.1860 serial=127 reply_serial=103
   object path "/org/freedesktop/secrets/prompt/<redacted>"
method call time=1671787331.855221 sender=:1.1860 -> destination=org.freedesktop.DBus serial=105 path=/org/freedesktop/DBus; interface=org.freedesktop.DBus; member=StartServiceByName
   string "org.freedesktop.secrets"
   uint32 0
error time=1671787331.855231 sender=org.freedesktop.DBus -> destination=:1.1860 error_name=org.freedesktop.DBus.Error.ServiceUnknown reply_serial=105
   string "The name org.freedesktop.secrets was not provided by any .service files"
method call time=1671787331.855257 sender=:1.1860 -> destination=org.freedesktop.DBus serial=106 path=/org/freedesktop/DBus; interface=org.freedesktop.DBus; member=AddMatch
   string "type='signal',sender='org.freedesktop.secrets',interface='org.freedesktop.Secret.Prompt',path='/org/freedesktop/secrets/prompt/<redacted>'"
method return time=1671787331.855261 sender=org.freedesktop.DBus -> destination=:1.1860 serial=31 reply_serial=106
method call time=1671787331.855348 sender=:1.1860 -> destination=org.freedesktop.DBus serial=107 path=/org/freedesktop/DBus; interface=org.freedesktop.DBus; member=StartServiceByName
   string "org.freedesktop.secrets"
   uint32 0
error time=1671787331.855352 sender=org.freedesktop.DBus -> destination=:1.1860 error_name=org.freedesktop.DBus.Error.ServiceUnknown reply_serial=107
   string "The name org.freedesktop.secrets was not provided by any .service files"
method call time=1671787331.855380 sender=:1.8 -> destination=:1.1860 serial=519 path=/org/ayatana/NotificationItem/Skype1/Menu; interface=com.canonical.dbusmenu; member=GetLayout
   int32 0
   int32 -1
   array [
      string "type"
      string "label"
      string "visible"
      string "enabled"
      string "children-display"
      string "accessible-desc"
   ]

It seems that the process with id 1.1860 (which I think is Skype, given other entries in the log) is triggering a delete request. I have no idea why. I don't get any prompt that something is trying to modify SecretService. I see that Skype has added an entry to SecretService, as well as deleting my GPG authentication subkey passphrase:

SkypeAccountProviderService:InterruptHandler/InterruptHandler (with an extremely long string as the 'passphrase')

How can I investigate further? I don't think this is Skype alone - I have the ignorant impression that any interaction with the keyring can trigger this problem. The issue becomes debilitating because after this happens in the background then I get prompted every time VSCode wants to use the passphrase for my authentication subkey, and I have to discard changes, manually re-open the database, and keep working until it happens again a few minutes later.

Steps to Reproduce

  1. Set up GPG subkey SSH authentication with passphrase in KeePassXC SecretService (or the gnome keyring)
  2. Watch something delete the passphrase from KeePassXC (or any other keyring)

Expected Behavior

Processes shouldn't be deleting passphrases
KeePassXC should prompt me when something tries, rather than allowing it.

Actual Behavior

KeePassXC allows the passphrase to be silently deleted and puts the database in a modified state ('*' after db filename)

Context

KeePassXC - 2.7.4
Revision: 63b2394

Operating System: Linux
Desktop Env: Sway
Windowing System: Wayland

@CrfzdPQM6
Copy link
Author

Any luck with this? Every time a key is deleted, I have to lock the database (waiting for a hardware token prompt to time-out in the process), and unlock it, only to have the key almost immediately deleted again sometimes. Any chance to help me debug this?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants