From Fedora Project Wiki

< Changes

Revision as of 05:33, 26 October 2020 by Ueno (talk | contribs)

Modular GNOME Keyring services


The monolithic gnome-keyring-daemon will be split into dedicated sub-daemons, so that they can be consistently managed by systemd.


  • Product: Workstation
  • Responsible WG: Workstation

Current status

  • Targeted release: Fedora 34
  • Last updated: 2020-10-26
  • FESCo issue: <will be assigned by the Wrangler>
  • Tracker bug: <will be assigned by the Wrangler>
  • Release notes tracker: <will be assigned by the Wrangler>

Detailed Description

While GNOME Keyring was originally aiming at the central cryptographic service on desktop, its scope has been gradually reduced over years. Notable examples are gpg-agent removal in 2015, PKCS #11 module deprecation and ssh-agent rewrite to wrap ssh-agent from OpenSSH in 2018.

All the GNOME Keyring services are exposed as part of a single daemon program called gnome-keyring-daemon, launched by the session manager (gnome-session) or PAM depending on desktop environments. Now that only the essential service remaining in gnome-keyring-daemon are D-Bus secret-service and the ssh-agent wrapper, it would be worth splitting the daemon into sub-daemons, so they can be managed by systemd.


Benefit to Fedora

This will bring in consistent experience of setting up and managing the GNOME Keyring services thanks to the fine grained systemd service units. This would simplify the security related services running on desktop, and make it easier to adopt modern security features e.g., hardware-based security.


  • Proposal owners:

gnome-keyring-daemon currently provides 3 services: D-Bus secret-service, ssh-agent wrapper, and a control socket for PAM to automatically unlock the login keyring. Those services are either split out, or removed in favor of other means, in the following steps:

    • The D-Bus secret-service is made to be D-Bus activatable
    • Move the ssh-agent code from the gnome-keyring package to the gcr package, making it socket activatable
    • Modify the PAM module to use libsecret API to unlock the login keyring, instead of through the control socket
    • Install systemd unit files for those services, modify the current session initialization sequence to use them

As a stretch goal, we may move the D-Bus secret-service implementation to libsecret, so we can remove the gnome-keyring package from the default compose.

  • Other developers: N/A (not a System Wide Change)
  • Policies and guidelines: N/A (not a System Wide Change)
  • Trademark approval: N/A (not needed for this Change)
  • Alignment with Objectives:

Upgrade/compatibility impact

The migration should be transparent.

N/A (not a System Wide Change)

How To Test

Check if the GNOME Keyring services are now managed by systemd, using systemctl status. Check if the existing applications (Seahorse, SSH clients, etc.) still work.

N/A (not a System Wide Change)

User Experience

No visible change should be observed by normal users.


N/A (not a System Wide Change)

Contingency Plan

  • Contingency mechanism: (What to do? Who will do it?) N/A (not a System Wide Change)
  • Contingency deadline: N/A (not a System Wide Change)
  • Blocks release? N/A (not a System Wide Change), Yes/No
  • Blocks product? product


N/A (not a System Wide Change)

Release Notes