[bug#38160] GNOME Keyring service

[bug#38160] GNOME Keyring service

[Leo Prikler]

[-- Attachment #1: Type: text/plain, Size: 623 bytes --]

Hello,

If you're using gnome-keyring on Guix with the default configuration,
you probably noticed, that you have to put in your login password twice
-- once in GDM, once afterwards to unlock the keyring.  This is not
very user-friendly.

It turns out, that there is a solution for this, which is detailed in
[1].  The attached patch implements the simple version, i.e. it adds
pam_gnome_keyring.so to the end of a block.  It will not work in
presence of a pam-entry with (control "sufficient"), but it does work
for extending the default desktop setup.

Regards,

Leo

[1] https://wiki.gnome.org/Projects/GnomeKeyring/Pam

[-- Attachment #2: 0001-gnu-Add-gnome-keyring-service.patch --]
[-- Type: text/x-patch, Size: 4638 bytes --]

From 9ac5f99a65f0599a3210443305042155f9b06e39 Mon Sep 17 00:00:00 2001
From: Leo Prikler <leo.prikler@student.tugraz.at>
Date: Sat, 9 Nov 2019 16:14:45 +0100
Subject: [PATCH] gnu: Add GNOME Keyring service

* gnu/services/desktop.scm: (<gnome-keyring-configuration>): New record type.
(gnome-keyring-service-type): New service type.
* doc/guix.texi: Document it.
---
 doc/guix.texi            | 30 +++++++++++++++++++++++
 gnu/services/desktop.scm | 53 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 83 insertions(+)

diff --git a/doc/guix.texi b/doc/guix.texi
index 27cb31dde5..5f693ed3ac 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -15609,6 +15609,36 @@ bluetooth keyboard or mouse.
 Users need to be in the @code{lp} group to access the D-Bus service.
 @end deffn

+@defvr {Scheme Variable} gnome-keyring-service-type
+This is the type of the service that adds the
+@uref{https://wiki.gnome.org/Projects/GnomeKeyring, GNOME Keyring}.  Its value is a @code{gnome-keyring-configuration} object (see below.)
+
+This service adds the @code{gnome-keyring} package to the system profile
+and extends PAM with entries using @code{pam_gnome_keyring.so}, unlocking
+a user's login keyring when they log in or setting its password with passwd.
+@end defvr
+
+@deftp {Data Type} gnome-keyring-configuration
+Configuration record for the GNOME Keyring service.
+
+@table @asis
+@item @code{keyring} (default: @code{gnome-keyring})
+The GNOME keyring package to use.
+@item @code{pam-services}
+An alist (SERVICE . KIND) of PAM services to extend.  SERVICE is the name
+of an existing service to extend and KIND is one of @code{login} or
+@code{passwd}.  If @code{login} is given, it adds an optional
+@code{pam_gnome_keyring.so} to the auth block without arguments and to
+the session block with @code{auto_start}.
+If @code{passwd} is given, it adds an optional @code{pam_gnome_keyring.so}
+to the password block without arguments.
+
+By default, this field contains ``gdm-password'' with the value @code{login}
+and ``passwd'' is with the value @code{passwd}.
+@end table
+@end deftp
+
+
 @node Sound Services
 @subsection Sound Services

diff --git a/gnu/services/desktop.scm b/gnu/services/desktop.scm
index 0152e86e8a..3e0a33dba8 100644
--- a/gnu/services/desktop.scm
+++ b/gnu/services/desktop.scm
@@ -135,6 +135,10 @@
             inputattach-configuration?
             inputattach-service-type

+            gnome-keyring-configuration
+            gnome-keyring-configuration?
+            gnome-keyring-service-type
+
             %desktop-services))

 ;;; Commentary:
@@ -1064,6 +1068,55 @@ as expected.")))
    (description "Return a service that runs inputattach on a device and
 dispatches events from it.")))

+\f
+;;;
+;;; gnome-keyring-service-type
+;;;
+
+(define-record-type* <gnome-keyring-configuration> gnome-keyring-configuration
+  make-gnome-keyring-configuration
+  gnome-keyring-configuration?
+  (keyring gnome-keyring-package (default gnome-keyring))
+  (pam-services gnome-keyring-pam-services (default '(("gdm-password" . login)
+                                                      ("passwd" . passwd)))))
+
+(define (pam-gnome-keyring config)
+  (define (%pam-keyring-entry . arguments)
+    (pam-entry
+     (control "optional")
+     (module (file-append (gnome-keyring-package config)
+                          "/lib/security/pam_gnome_keyring.so"))
+     (arguments arguments)))
+
+  (list
+   (lambda (service)
+     (case (assoc-ref (gnome-keyring-pam-services config)
+                      (pam-service-name service))
+       ((login)
+        (pam-service
+         (inherit service)
+         (auth (append (pam-service-auth service)
+                       (list (%pam-keyring-entry))))
+         (session (append (pam-service-session service)
+                          (list (%pam-keyring-entry "auto_start"))))))
+       ((passwd)
+        (pam-service
+         (inherit service)
+         (password (append (pam-service-password service)
+                           (list (%pam-keyring-entry))))))
+       (else service)))))
+
+(define gnome-keyring-service-type
+  (service-type
+   (name 'gnome-keyring)
+   (extensions (list
+                (service-extension pam-root-service-type pam-gnome-keyring)))
+   (default-value (gnome-keyring-configuration))
+   (description "Return a service, that adds the @code{gnome-keyring} package
+to the system profile and extends PAM with entries using
+@code{pam_gnome_keyring.so}, unlocking a user's login keyring when they log in
+or setting its password with passwd.")))
+
 \f
 ;;;
 ;;; The default set of desktop services.
--
2.24.0

bug#38160: GNOME Keyring service

[Ludovic Courtès]

[-- Attachment #1: Type: text/plain, Size: 528 bytes --]

Hi Leo,

Leo Prikler <leo.prikler@student.tugraz.at> skribis:

> From 9ac5f99a65f0599a3210443305042155f9b06e39 Mon Sep 17 00:00:00 2001
> From: Leo Prikler <leo.prikler@student.tugraz.at>
> Date: Sat, 9 Nov 2019 16:14:45 +0100
> Subject: [PATCH] gnu: Add GNOME Keyring service
>
> * gnu/services/desktop.scm: (<gnome-keyring-configuration>): New record type.
> (gnome-keyring-service-type): New service type.
> * doc/guix.texi: Document it.

Nice!  Applied with the minor doc changes below.

Thanks,
Ludo’.


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: Type: text/x-patch, Size: 1946 bytes --]

diff --git a/doc/guix.texi b/doc/guix.texi
index 51948dc0f7..712f814cdc 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -15755,7 +15755,8 @@ Users need to be in the @code{lp} group to access the D-Bus service.
 
 @defvr {Scheme Variable} gnome-keyring-service-type
 This is the type of the service that adds the
-@uref{https://wiki.gnome.org/Projects/GnomeKeyring, GNOME Keyring}.  Its value is a @code{gnome-keyring-configuration} object (see below.)
+@uref{https://wiki.gnome.org/Projects/GnomeKeyring, GNOME Keyring}.  Its
+value is a @code{gnome-keyring-configuration} object (see below.)
 
 This service adds the @code{gnome-keyring} package to the system profile
 and extends PAM with entries using @code{pam_gnome_keyring.so}, unlocking
@@ -15768,14 +15769,18 @@ Configuration record for the GNOME Keyring service.
 @table @asis
 @item @code{keyring} (default: @code{gnome-keyring})
 The GNOME keyring package to use.
+
 @item @code{pam-services}
-An alist (SERVICE . KIND) of PAM services to extend.  SERVICE is the name
-of an existing service to extend and KIND is one of @code{login} or
-@code{passwd}.  If @code{login} is given, it adds an optional
+A list of @code{(@var{service} . @var{kind})} pairs denoting PAM
+services to extend, where @var{service} is the name of an existing
+service to extend and @var{kind} is one of @code{login} or
+@code{passwd}.
+
+If @code{login} is given, it adds an optional
 @code{pam_gnome_keyring.so} to the auth block without arguments and to
-the session block with @code{auto_start}.
-If @code{passwd} is given, it adds an optional @code{pam_gnome_keyring.so}
-to the password block without arguments.
+the session block with @code{auto_start}.  If @code{passwd} is given, it
+adds an optional @code{pam_gnome_keyring.so} to the password block
+without arguments.
 
 By default, this field contains ``gdm-password'' with the value @code{login}
 and ``passwd'' is with the value @code{passwd}.

[bug#38160] GNOME Keyring service

[Ludovic Courtès]

Leo Prikler <leo.prikler@student.tugraz.at> skribis:

> From 9ac5f99a65f0599a3210443305042155f9b06e39 Mon Sep 17 00:00:00 2001
> From: Leo Prikler <leo.prikler@student.tugraz.at>
> Date: Sat, 9 Nov 2019 16:14:45 +0100
> Subject: [PATCH] gnu: Add GNOME Keyring service
>
> * gnu/services/desktop.scm: (<gnome-keyring-configuration>): New record type.
> (gnome-keyring-service-type): New service type.
> * doc/guix.texi: Document it.

BTW, do you think ‘gnome-service-type’ should always enable
‘gnome-keyring-service-type’?  I would think it’s a good idea.

Thoughts?

Ludo’.

[bug#38160] GNOME Keyring service

[Ludovic Courtès]

Hi Leo,

Leo Prikler <leo.prikler@student.tugraz.at> skribis:

[...]

>> BTW, do you think ‘gnome-service-type’ should always enable
>> ‘gnome-keyring-service-type’?  I would think it’s a good idea.
>> 
>> Thoughts?
>> 
>> Ludo’.
> I'm not too sure about that, to be honest.
> 1. Using GNOME does not imply using its Keyring.  I personally have one
> Guix machine, which just uses GNOME to launch some games, and I could
> imagine some Guix folks do the same with Emacs.  
> 2. The default configuration is made so that it works with GDM, which
> is reasonable, as that is the default for Guix as well.  However, it
> would be possible to launch GNOME from other DMs, which would need
> different configuration.
> Of course, since the service itself is rather small, it would likely
> just "do nothing" for both groups.  However, I would still prefer the
> explicit composition of services over an implicit one – unless a "GNOME
> with GDM and everything else" service was to be added to Guix. 
> Alternatively, we could define a variable %gnome-desktop-services,
> which extends %desktop-services with GNOME, this service, and some
> other GNOME-related services, e.g. one for evolution-data-server.

OK.  I don’t use GNOME myself but I think the goal is for
‘gnome-service-type’ and ‘%desktop-services’ to provide something that
works out of the box, and that’s why I thought it might make sense to
have the keyring service as a default.

But anyway, I understand what you’re saying, so we can leave it as is
and we can always revisit it later if someone feels a need.

Thanks!

Ludo’.

PS: Please keep the bug Cc’d.