search

bilelmoussaoui / oo7

James Bond went on a new mission as a Secret Service provider
https://bilelmoussaoui.github.io/oo7/oo7/
MIT License
56 stars 11 forks source link

Missing API for changing secret of a dbus collection #94

Open haecker-felix opened 1 month ago

haecker-felix commented 1 month ago

Unlike portal::Keyring, we currently have no (direct) way to change the password of a dbus::Collection. I think the main problem here is that changing a collection password isn't part of the secret-service dbus specification.

Seahorse / gnome keyring work around this and have something custom implemented (org.gnome.keyring.InternalUnsupportedGuiltRiddenInterface).

A possible workaround I can see at the moment would be to load the collection as a keyring file via portal::Keyring and change the password there - although I'm not sure how many side effects it would have to fiddle with the keyring file directly instead of using the intended oo7/secret-service api.

I wonder if this is something we can fix on oo7 side, or if we need an updated/extended secret-service dbus specification.

bilelmoussaoui commented 1 month ago

Unlike portal::Keyring, we currently have no (direct) way to change the password of a dbus::Collection. I think the main problem here is that changing a collection password isn't part of the secret-service dbus specification.

At least gnome-keyring's current implementation doesn't allow any collections other than login/session. The former is unlocked when you log-in and the later stays alive for the duration of the session. Sadly you can't create new ones :p hopefully something we can fix with the new server implementation.

Seahorse / gnome keyring work around this and have something custom implemented (org.gnome.keyring.InternalUnsupportedGuiltRiddenInterface).

We would have to implement that interface for server side. But I would not expose that as an API at all.

A possible workaround I can see at the moment would be to load the collection as a keyring file via portal::Keyring and change the password there - although I'm not sure how many side effects it would have to fiddle with the keyring file directly instead of using the intended oo7/secret-service api.

I don't think there should be any effect imho. but maybe @ueno can think of something that might break (other than auto-unlocking when you login)

I wonder if this is something we can fix on oo7 side, or if we need an updated/extended secret-service dbus specification.

Asked differently, why you would want to change the collection's unlock password

haecker-felix commented 1 month ago

At least gnome-keyring's current implementation doesn't allow any collections other than login/session

Huh. I can add new collections from both Seahorse and KeyRack finely. How does this work if it is not implemented in g-k-d at all? Or do you mean something else?

image

Asked differently, why you would want to change the collection's unlock password

Own keyrings/collections which you created from Seahorse / KeyRack. You're only able to set the password once when you create the collection, afterwards there's no way of changing the password (at least using Key Rack, Seahorse has the ominous guilt ridden interface).

I don't think there should be any effect imho

I can give it a try. I was a tad worried when g-k-d has the file opened / writes something to it, and I access it at the same time with oo7 to change the password

other than auto-unlocking when you login

From KeyRack side I only would allow to change the password for custom collections either way, the login collection password should stay in sync with the user password so that the auto unlock works.

haecker-felix commented 2 weeks ago

I don't think there should be any effect imho

For the record, I successfully avoided having to fiddle with files at all by using the org.gnome.keyring.InternalUnsupportedGuiltRiddenInterface interface in Key Rack. This makes it possible to change keyring passwords the same way as Seahorse does.

See https://gitlab.gnome.org/sophie-h/key-rack/-/merge_requests/23

This works, but perhaps oo7 can provide a better API for this in the future, especially if it becomes a secret service/gnome keying server.

bilelmoussaoui commented 2 weeks ago

I don't think landing that was great, because it is not an interface I think we should keep in the future and it is tied to GNOME Keyring specifically.