Packaging App with Linux Kernel Keyring Support

Help
1

I’m working on packaging Proton Pass CLI (PR #470407) and encountering permission issues with the Linux kernel keyring.

The application uses keyring-rs with the kernel backend to store encryption keys. When attempting to store a key via add_key(), it fails with EACCES (Permission denied):

 > strace -e keyctl result/bin/pass-cli login
keyctl(KEYCTL_GET_KEYRING_ID, KEY_SPEC_SESSION_KEYRING, 0) = 521763819
keyctl(KEYCTL_GET_PERSISTENT, -1, KEY_SPEC_SESSION_KEYRING) = 8888588
keyctl(KEYCTL_SEARCH, 521763819, "user", "keyring-rs:cli-local-key@ProtonP"..., 0) = -1 EACCES (Permission denied)

> keyctl show
Session Keyring
 844533279 --alswrv   1000 65534  keyring: _uid_ses.1000
 764978731 --alswrv   1000 65534   \_ keyring: _uid.1000
 805469897 --alswrv   1000   100   \_ user: keyring-rs:cli-local-key@ProtonPassCLI

The root cause is that the default session keyring _uid_ses.1000 has group 65534 (nogroup), which the user doesn’t belong to and therefore cannot write to.

Temporary solution: Creating a new session keyring works:

keyctl session -
pass-cli login  # Now succeeds

But this keyring is ephemeral and destroyed when the shell exits, requiring re-login each time.

Questions

  1. Is this an issue with my NixOS configuration?
  2. Is there an established pattern in nixpkgs for packaging applications that use the Linux kernel keyring?
  3. Should the keyring configuration be handled at the package level, or is this purely a system-level concern that users need to configure themselves?
  4. Are there existing packages in nixpkgs that properly handle kernel keyring access I could reference?

Any guidance would be greatly appreciated!

2 Likes
2

I switched my desktop environment from GNOME to COSMIC, and the issue has been resolved. The problem appears to have been related to my gnome-keyring configuration.

Running pass-cli now successfully stores credentials in the session keyring:

> keyctl show
Session Keyring
926959038 --alswrv      0     0  keyring: _ses
474721133 --alswrv      0 65534   _ keyring: _uid.0
238008255 --alswrv   1000   100   _ user: keyring-rs:cli-local-key@ProtonPassCLI
 99513628 --alswrv   1000 65534   _ keyring: _persistent.1000
238008255 --alswrv   1000   100   |   _ user: keyring-rs:cli-local-key@ProtonPassCLI
199062391 ----s-rv      0     0   _ user: invocation_id