From Fedora Project Wiki

oo7 Secrets Service Provider

Summary

Switch the default Secrets Service provider for Fedora desktops from KWallet and GNOME Keyring to oo7.

Owner

Current status

Detailed Description

A new universal secrets storage system has been developed in the form of oo7 that replaces KWallet's backend and GNOME Keyring. Package up oo7-daemon and associated support code and change the Fedora default secrets storage backend to it across all desktops.

Feedback

Benefit to Fedora

The idea with this new secrets storage system is to support a new model for credentials where scoped authorization is possible for applications and services. Additionally, it opens the door for mediating access to FIDO2-based authentication mechanisms. This lends itself well to enabling limited trust to secrets for sandboxed applications, among other things. KDE Plasma, COSMIC, and GNOME (among others) are all converging on this and so enabling this allows Fedora to remain at the forefront of supporting desktop technologies.

Scope

  • Proposal owners:
    • Package oo7-daemon, PAM module, and other support code
    • Add oo7 PAM module to relevant PAM configs where gnome-keyring and kwallet PAM modules are listed
    • Adjust comps to replace gnome-keyring with oo7-daemon
    • Adjust dependencies in desktops to use oo7 instead of gnome-keyring
  • Other developers: N/A (not needed for this Change)
  • Policies and guidelines: N/A (not needed for this Change)
  • Trademark approval: N/A (not needed for this Change)
  • Alignment with the Fedora Strategy: N/A (not needed for this Change)

Upgrade/compatibility impact

The oo7 service will automatically migrate existing data from GNOME Keyring and KWallet, so no user interaction is required to handle the transition.


How To Test

Once oo7-daemon and related code are packaged and updated configuration lands in Rawhide, users can test this simply by upgrading and using things that leverage the secrets service like normal.


User Experience

This is expected to be fairly transparent to the user.

Dependencies

This will involve updating the PAM configuration files for the desktops and login managers used across Fedora deliverables.


Contingency Plan

  • Contingency mechanism: Revert swap to oo7 and defer to the next release
  • Contingency deadline: Beta freeze
  • Blocks release? Yes


Documentation

More information about oo7 is present in the upstream project documentation.

Release Notes

Fedora Linux now uses the oo7 as the default secrets service provider, replacing older solutions like GNOME Keyring. This brings enhanced security to secrets management, particularly for sandboxed applications, and enables FIDO2 authentication secrets.

Retrieved from "https://fedoraproject.org/w/index.php?title=Changes/oo7_Secrets_Service_Provider&oldid=779861"