Lines
76.9 %
Functions
93.75 %
Branches
100 %
// org.freedesktop.Secret.Service
use std::{
collections::HashMap,
sync::{
Arc, RwLock,
atomic::{AtomicU32, Ordering},
},
};
use oo7::{
Key, Secret,
dbus::{
Algorithm, ServiceError,
api::{DBusSecretInner, Properties},
file::{Keyring, LockedKeyring, UnlockedKeyring},
use tokio::sync::Mutex;
use tokio_stream::StreamExt;
use zbus::{
fdo::{RequestNameFlags, RequestNameReply},
names::UniqueName,
object_server::SignalEmitter,
proxy::Defaults,
zvariant::{ObjectPath, Optional, OwnedObjectPath, OwnedValue, Value},
#[cfg(any(feature = "gnome_native_crypto", feature = "gnome_openssl_crypto"))]
pub use crate::gnome::internal::InternalInterface;
#[cfg(any(feature = "plasma_native_crypto", feature = "plasma_openssl_crypto"))]
use crate::plasma::prompter::in_plasma_environment;
use crate::{
collection::Collection,
error::{Error, custom_service_error},
migration::{self, PendingMigration},
prompt::{Prompt, PromptAction, PromptRole},
session::{PeerInfo, Session, SessionType},
const DEFAULT_COLLECTION_ALIAS_PATH: ObjectPath<'static> =
ObjectPath::from_static_str_unchecked("/org/freedesktop/secrets/aliases/default");
/// Prompter type
#[derive(Clone, Copy, PartialEq, Eq)]
pub enum PrompterType {
#[allow(clippy::upper_case_acronyms)]
GNOME,
Plasma,
Cli,
}
#[derive(Clone)]
pub struct Service {
// Properties
pub(crate) collections: Arc<Mutex<HashMap<OwnedObjectPath, Collection>>>,
// Other attributes
connection: Arc<RwLock<Option<zbus::Connection>>>,
// sessions mapped to their corresponding object path on the bus
sessions: Arc<Mutex<HashMap<OwnedObjectPath, Session>>>,
session_index: Arc<AtomicU32>,
// prompts mapped to their corresponding object path on the bus
prompts: Arc<Mutex<HashMap<OwnedObjectPath, Prompt>>>,
prompt_index: Arc<AtomicU32>,
// pending collection creations: prompt_path -> (label, alias)
pending_collections: Arc<Mutex<HashMap<OwnedObjectPath, (String, String)>>>,
// pending keyring migrations: name -> migration
pub(crate) pending_migrations: Arc<Mutex<HashMap<String, PendingMigration>>>,
// Data directory for keyrings (e.g., ~/.local/share or test temp dir)
data_dir: std::path::PathBuf,
// PAM socket path (None for tests that don't need PAM listener)
pub(crate) pam_socket: Option<std::path::PathBuf>,
// Override for prompter type (mainly for tests)
pub(crate) prompter_type_override: Arc<Mutex<Option<PrompterType>>>,
#[zbus::interface(name = "org.freedesktop.Secret.Service")]
impl Service {
#[zbus(out_args("output", "result"))]
pub async fn open_session(
&self,
algorithm: Algorithm,
input: Value<'_>,
#[zbus(header)] header: zbus::message::Header<'_>,
#[zbus(object_server)] object_server: &zbus::ObjectServer,
) -> Result<(OwnedValue, OwnedObjectPath), ServiceError> {
let (public_key, aes_key) = match algorithm {
Algorithm::Plain => (None, None),
Algorithm::Encrypted => {
let client_public_key = Key::try_from(input).map_err(|err| {
custom_service_error(&format!(
"Input Value could not be converted into a Key {err}."
))
})?;
let private_key = Key::generate_private_key().map_err(|err| {
custom_service_error(&format!("Failed to generate private key {err}."))
(
Some(Key::generate_public_key(&private_key).map_err(|err| {
custom_service_error(&format!("Failed to generate public key {err}."))
})?),
Some(
Key::generate_aes_key(&private_key, &client_public_key).map_err(|err| {
custom_service_error(&format!("Failed to generate aes key {err}."))
})?,
),
)
let sender = if let Some(s) = header.sender() {
s.to_owned()
} else {
#[cfg(any(test, feature = "test-util"))]
{
// For p2p test connections, use a dummy sender since p2p
// connections don't have a bus to assign unique
// names
UniqueName::try_from(":p2p.test").unwrap()
#[cfg(not(any(test, feature = "test-util")))]
return Err(custom_service_error("Failed to get sender from header."));
let peer_info = async {
let proxy = zbus::fdo::DBusProxy::new(&self.connection()).await.ok()?;
let pid = proxy
.get_connection_unix_process_id(sender.as_ref().into())
.await
.ok()?;
let cmdline = tokio::fs::read(format!("/proc/{pid}/cmdline")).await.ok()?;
let name = cmdline.split(|&b| b == 0).next()?;
let name = std::path::Path::new(std::str::from_utf8(name).ok()?)
.file_name()?
.to_str()?
.to_owned();
let session_type = SessionType::detect(pid).await;
Some(PeerInfo::new(pid, name, session_type))
.await;
let session = Session::new(
aes_key.map(Arc::new),
self.clone(),
sender.clone(),
peer_info,
let path = OwnedObjectPath::from(session.path().clone());
match session.peer_info() {
Some(info) => {
tracing::info!("Client {} ({}) connected, session: {}", sender, info, path)
None => tracing::info!("Client {} connected, session: {}", sender, path),
self.sessions
.lock()
.insert(path.clone(), session.clone());
object_server.at(&path, session).await?;
let service_key = public_key
.map(OwnedValue::from)
.unwrap_or_else(|| Value::new::<Vec<u8>>(vec![]).try_into_owned().unwrap());
Ok((service_key, path))
#[zbus(out_args("collection", "prompt"))]
pub async fn create_collection(
properties: Properties,
alias: &str,
) -> Result<(OwnedObjectPath, ObjectPath<'_>), ServiceError> {
let label = properties.label().to_owned();
let alias = alias.to_owned();
// Create a prompt to get the password for the new collection
let prompt = Prompt::new(
PromptRole::CreateCollection,
label.clone(),
None,
let prompt_path = OwnedObjectPath::from(prompt.path().clone());
// Store the collection metadata for later creation
self.pending_collections
.insert(prompt_path.clone(), (label, alias));
// Create the collection creation action
let service = self.clone();
let creation_prompt_path = prompt_path.clone();
let action = PromptAction::new(move |secret: Option<Secret>| async move {
let collection_path = service
.complete_collection_creation(&creation_prompt_path, secret)
.await?;
Ok(Value::new(collection_path).try_into_owned().unwrap())
});
prompt.set_action(action).await;
// Register the prompt
self.prompts
.insert(prompt_path.clone(), prompt.clone());
self.object_server().at(&prompt_path, prompt).await?;
tracing::debug!("CreateCollection prompt created at `{}`", prompt_path);
// Return empty collection path and the prompt path
Ok((OwnedObjectPath::default(), prompt_path.into()))
#[zbus(out_args("unlocked", "locked"))]
pub async fn search_items(
attributes: HashMap<String, String>,
) -> Result<(Vec<OwnedObjectPath>, Vec<OwnedObjectPath>), ServiceError> {
let mut unlocked = Vec::new();
let mut locked = Vec::new();
let collections = self.collections.lock().await;
for collection in collections.values() {
let items = collection.search_inner_items(&attributes).await?;
for item in items {
if item.is_locked().await {
locked.push(item.path().clone().into());
unlocked.push(item.path().clone().into());
if unlocked.is_empty() && locked.is_empty() {
tracing::debug!(
"Items with attributes {:?} does not exist in any collection.",
attributes
);
tracing::debug!("Items with attributes {:?} found.", attributes);
Ok((unlocked, locked))
#[zbus(out_args("unlocked", "prompt"))]
pub async fn unlock(
objects: Vec<OwnedObjectPath>,
) -> Result<(Vec<OwnedObjectPath>, OwnedObjectPath), ServiceError> {
tracing::info!("Unlock requested for {} objects.", objects.len());
let (unlocked, not_unlocked) = self.set_locked(false, &objects).await?;
if !not_unlocked.is_empty() {
// Extract the label and collection before creating the prompt
let label = self.extract_label_from_objects(¬_unlocked).await;
let collection = self.extract_collection_from_objects(¬_unlocked).await;
let prompt = Prompt::new(self.clone(), PromptRole::Unlock, label, collection).await;
let path = OwnedObjectPath::from(prompt.path().clone());
// Create the unlock action
// The prompter will handle secret validation
// Here we just perform the unlock operation
// First, check for pending migrations (without holding
// collections lock)
for object in ¬_unlocked {
let collection = {
let collections = service.collections.lock().await;
collections.get(object).cloned()
if let Some(collection) = collection {
// Check if this collection has a pending migration by
// name
let migration_opt = {
let pending = service.pending_migrations.lock().await;
pending.get(collection.name()).cloned()
if let Some(migration) = migration_opt {
let migration_name = migration.name();
"Attempting migration for '{}' during unlock",
migration_name
// Attempt migration with the provided secret (no
// locks held)
match migration.migrate(&service.data_dir, secret.as_ref()).await {
Ok(unlocked_keyring) => {
tracing::info!(
"Successfully migrated '{}' during unlock",
// Replace the keyring in the collection
let mut keyring_guard = collection.keyring.write().await;
*keyring_guard = Some(Keyring::Unlocked(unlocked_keyring));
drop(keyring_guard);
// Dispatch items from the migrated keyring
if let Err(e) = collection.dispatch_items().await {
tracing::error!(
"Failed to dispatch items after migration: {}",
e
// Remove from pending migrations
service
.pending_migrations
.remove(migration_name);
Err(e) => {
tracing::warn!(
"Failed to migrate '{}' during unlock: {}",
migration_name,
let _ = collection.set_locked(false, secret.clone()).await;
// Normal unlock
// Try to find as item within collections
let mut found_collection = None;
if let Some(item) = collection.item_from_path(object).await {
found_collection = Some((
collection.clone(),
item.clone(),
collection.is_locked().await,
));
break;
drop(collections);
if let Some((collection, item, is_locked)) = found_collection {
if is_locked {
let keyring = collection.keyring.read().await;
match keyring.as_ref() {
Some(k) if !k.is_locked() => {
let _ = item.set_locked(false, k.as_unlocked()).await;
_ => {
drop(keyring);
Ok(Value::new(not_unlocked).try_into_owned().unwrap())
.insert(path.clone(), prompt.clone());
self.object_server().at(&path, prompt).await?;
return Ok((unlocked, path));
Ok((unlocked, OwnedObjectPath::default()))
#[zbus(out_args("locked", "Prompt"))]
pub async fn lock(
tracing::info!("Lock requested for {} objects.", objects.len());
let (locked, not_locked) = self.set_locked(true, &objects).await?;
// Locking never requires prompts, so not_locked should always be empty
debug_assert!(
not_locked.is_empty(),
"Lock operation should never require prompts"
Ok((locked, OwnedObjectPath::default()))
#[zbus(out_args("secrets"))]
pub async fn get_secrets(
items: Vec<OwnedObjectPath>,
session: OwnedObjectPath,
) -> Result<HashMap<OwnedObjectPath, DBusSecretInner>, ServiceError> {
"GetSecrets called for {} items with session {}.",
items.len(),
session
let mut secrets = HashMap::new();
'outer: for collection in collections.values() {
for item in &items {
if let Some(item) = collection.item_from_path(item).await {
match item.get_secret(session.clone()).await {
Ok((secret,)) => {
secrets.insert(item.path().clone().into(), secret);
// To avoid iterating through all the remaining
// collections, if the
// items secrets are already retrieved.
if secrets.len() == items.len() {
break 'outer;
// Avoid erroring out if an item is locked.
Err(ServiceError::IsLocked(_)) => {
continue;
Err(err) => {
return Err(err);
"GetSecrets returned {} of {} requested secrets.",
secrets.len(),
items.len()
Ok(secrets)
#[zbus(out_args("collection"))]
pub async fn read_alias(&self, name: &str) -> Result<OwnedObjectPath, ServiceError> {
// Map "login" alias to "default" for compatibility with gnome-keyring
let alias_to_find = if name == Self::LOGIN_ALIAS {
oo7::dbus::Service::DEFAULT_COLLECTION
name
for (path, collection) in collections.iter() {
if collection.alias().await == alias_to_find {
tracing::debug!("Collection: {} found for alias: {}.", path, name);
return Ok(path.to_owned());
tracing::info!("Collection with alias {} does not exist.", name);
Ok(OwnedObjectPath::default())
pub async fn set_alias(
name: &str,
collection: OwnedObjectPath,
) -> Result<(), ServiceError> {
for (path, other_collection) in collections.iter() {
if *path == collection {
other_collection.set_alias(name).await;
tracing::info!("Collection: {} alias updated to {}.", collection, name);
return Ok(());
tracing::info!("Collection: {} does not exist.", collection);
Err(ServiceError::NoSuchObject(format!(
"The collection: {collection} does not exist.",
)))
#[zbus(property, name = "Collections")]
pub async fn collections(&self) -> Vec<OwnedObjectPath> {
self.collections.lock().await.keys().cloned().collect()
#[zbus(signal, name = "CollectionCreated")]
pub async fn collection_created(
signal_emitter: &SignalEmitter<'_>,
collection: &ObjectPath<'_>,
) -> zbus::Result<()>;
#[zbus(signal, name = "CollectionDeleted")]
pub async fn collection_deleted(
#[zbus(signal, name = "CollectionChanged")]
pub async fn collection_changed(
const LOGIN_ALIAS: &str = "login";
/// Set the prompter type override
#[allow(unused)]
pub(crate) async fn set_prompter_type(&self, prompter_type: PrompterType) {
*self.prompter_type_override.lock().await = Some(prompter_type);
/// Get the prompter type to use based on the caller's session type
pub(crate) async fn prompter_type(&self, peer_info: Option<&PeerInfo>) -> PrompterType {
if let Some(override_type) = self.prompter_type_override.lock().await.as_ref() {
return *override_type;
let is_graphical = peer_info
.map(|p| p.session_type().is_graphical())
.unwrap_or_default();
if is_graphical {
if in_plasma_environment(&self.connection()).await {
return PrompterType::Plasma;
return PrompterType::GNOME;
PrompterType::Cli
pub(crate) fn new(
pam_socket: Option<std::path::PathBuf>,
) -> Self {
Self {
collections: Arc::new(Mutex::new(HashMap::new())),
connection: Default::default(),
sessions: Arc::new(Mutex::new(HashMap::new())),
session_index: Arc::new(AtomicU32::new(0)),
prompts: Arc::new(Mutex::new(HashMap::new())),
prompt_index: Arc::new(AtomicU32::new(0)),
pending_collections: Arc::new(Mutex::new(HashMap::new())),
pending_migrations: Arc::new(Mutex::new(HashMap::new())),
data_dir,
pam_socket,
prompter_type_override: Arc::new(Mutex::new(None)),
pub async fn run(
secret: Option<Secret>,
request_replacement: bool,
) -> Result<zbus::Connection, Error> {
// Compute data directory from environment variables
let data_dir = std::env::var_os("XDG_DATA_HOME")
.filter(|h| !h.is_empty())
.map(std::path::PathBuf::from)
.filter(|p| p.is_absolute())
.or_else(|| {
std::env::var_os("HOME")
.map(|p| p.join(".local/share"))
})
.ok_or_else(|| {
Error::IO(std::io::Error::new(
std::io::ErrorKind::NotFound,
"No data directory found (XDG_DATA_HOME or HOME)",
// Compute PAM socket path from environment variable
let pam_socket = std::env::var_os("OO7_PAM_SOCKET").map(std::path::PathBuf::from);
let service = Self::new(data_dir, pam_socket);
// Start PAM listener early so it can buffer secrets arriving before
// D-Bus is ready (e.g. during PAM-initiated login startup).
tracing::info!("Starting PAM listener");
let pam_listener = crate::pam_listener::PamListener::new(service.clone());
let pam_listener_replay = pam_listener.clone();
tokio::spawn(async move {
if let Err(e) = pam_listener.start().await {
tracing::error!("PAM listener error: {}", e);
// The name is requested only once the service is initialized
let connection = zbus::connection::Builder::session()?
.serve_at(
oo7::dbus::api::Service::PATH.as_deref().unwrap(),
service.clone(),
)?
.build()
connection
.object_server()
.at(
InternalInterface::new(service.clone()),
// Discover existing keyrings
let discovered_keyrings = service.discover_keyrings(secret.clone()).await?;
let connection_clone = connection.clone();
.initialize(connection, discovered_keyrings, secret, true)
let mut flags = RequestNameFlags::AllowReplacement | RequestNameFlags::DoNotQueue;
if request_replacement {
flags |= RequestNameFlags::ReplaceExisting;
match connection_clone
.request_name_with_flags(
oo7::dbus::api::Service::DESTINATION.as_deref().unwrap(),
flags,
.await?
RequestNameReply::PrimaryOwner | RequestNameReply::AlreadyOwner => {}
RequestNameReply::Exists | RequestNameReply::InQueue => {
return Err(Error::Zbus(zbus::Error::NameTaken));
// Replay any secrets that the PAM listener buffered during startup
pam_listener_replay.replay_buffered_secrets().await;
Ok(connection_clone)
#[allow(dead_code)]
pub async fn run_with_connection(
connection: zbus::Connection,
) -> Result<Self, Error> {
// Serve the service at the standard path
let default_keyring = if let Some(secret) = secret.clone() {
vec![(
"default".to_owned(),
"Login".to_owned(),
oo7::dbus::Service::DEFAULT_COLLECTION.to_owned(),
Keyring::Unlocked(UnlockedKeyring::temporary(secret).await?),
)]
vec![]
.initialize(connection, default_keyring, secret, false)
Ok(service)
/// Generate a unique label and alias by checking registered
/// collections and appending a counter if needed. Returns a tuple of
/// (label, alias).
fn make_unique_label_and_alias(
collections: &HashMap<OwnedObjectPath, Collection>,
label: &str,
) -> (String, String) {
// Sanitize the label to create the path (for checking uniqueness)
let base_path = crate::collection::collection_path(label)
.expect("Sanitized label should always produce valid object path");
if !collections.contains_key(&base_path) {
return (label.to_owned(), alias.to_owned());
// Append counter until we find a unique one
let mut counter = 2;
loop {
let path = crate::collection::collection_path(&format!("{label}{counter}"))
let new_label = format!("{}{}", label, counter);
let new_alias = format!("{}{}", alias, counter);
if !collections.contains_key(&path) {
return (new_label, new_alias);
counter += 1;
/// Discover existing keyrings in the data directory
/// Returns a vector of (name, label, alias, keyring) tuples
pub(crate) async fn discover_keyrings(
) -> Result<Vec<(String, String, String, Keyring)>, Error> {
let mut discovered = Vec::new();
let keyrings_dir = self.data_dir.join("keyrings");
// Scan for v1 keyrings first
let v1_dir = keyrings_dir.join("v1");
if v1_dir.exists() {
tracing::debug!("Scanning for v1 keyrings in {}", v1_dir.display());
if let Ok(mut entries) = tokio::fs::read_dir(&v1_dir).await {
while let Ok(Some(entry)) = entries.next_entry().await {
let path = entry.path();
// Skip directories and non-.keyring files
if path.is_dir() || path.extension() != Some(std::ffi::OsStr::new("keyring")) {
if let Some(name) = path.file_stem().and_then(|s| s.to_str()) {
tracing::debug!("Found v1 keyring: {name}");
// Try to load the keyring
match self.load_keyring(&path, name, secret.as_ref()).await {
Ok((name, label, alias, keyring)) => {
discovered.push((name, label, alias, keyring))
Err(e) => tracing::warn!("Failed to load keyring {:?}: {}", path, e),
// Scan for v0 keyrings
if keyrings_dir.exists() {
tracing::debug!("Scanning for v0 keyrings in {}", keyrings_dir.display());
if let Ok(mut entries) = tokio::fs::read_dir(&keyrings_dir).await {
if migration::stamp_path(&path).exists() {
tracing::debug!("Found v0 keyring: {name}");
// Discover KWallet keyrings for migration
#[cfg(feature = "kwallet_migration")]
self.discover_kwallet_keyrings(&self.data_dir, secret.as_ref(), &mut discovered)
let pending_count = self.pending_migrations.lock().await.len();
if discovered.is_empty() && pending_count == 0 {
tracing::info!("No keyrings discovered in data directory");
"Discovered {} keyring(s), {pending_count} pending migration(s)",
discovered.len(),
Ok(discovered)
/// Discover KWallet keyrings for migration
async fn discover_kwallet_keyrings(
data_dir: &std::path::Path,
secret: Option<&Secret>,
discovered: &mut Vec<(String, String, String, Keyring)>,
) {
let kwallet_dir = data_dir.join("kwalletd");
if !kwallet_dir.exists() {
tracing::debug!("No kwalletd directory found, skipping KWallet discovery");
return;
tracing::debug!("Scanning for KWallet files in {}", kwallet_dir.display());
let Ok(mut entries) = tokio::fs::read_dir(&kwallet_dir).await else {
tracing::warn!("Failed to read kwalletd directory");
// Only process .kwl files
if path.extension().is_none_or(|ext| ext != "kwl") {
let Some(name) = path.file_stem().and_then(|s| s.to_str()) else {
tracing::debug!("Found KWallet file: {name}");
// Use lowercased name as alias
let alias = name.to_lowercase();
let label = {
let mut chars = name.chars();
match chars.next() {
None => String::new(),
Some(first) => first.to_uppercase().collect::<String>() + chars.as_str(),
let migration = PendingMigration::KWallet {
name: name.to_owned(),
path: path.clone(),
label: label.clone(),
alias: alias.clone(),
if let Some(secret) = secret {
tracing::debug!("Attempting immediate migration of KWallet keyring '{name}'",);
match migration.migrate(&self.data_dir, Some(secret)).await {
Ok(unlocked) => {
tracing::info!("Successfully migrated KWallet keyring '{name}' to oo7",);
discovered.push((
name.to_owned(),
label,
alias,
Keyring::Unlocked(unlocked),
"Failed to migrate KWallet keyring '{name}' at {}: {e}. Creating locked placeholder collection.",
migration.path().display()
// Migration failed or no secret - create locked placeholder and
// register for pending migration
"Creating locked placeholder for KWallet keyring '{name}', will migrate on unlock",
match LockedKeyring::open_at(&self.data_dir, name).await {
Ok(locked) => {
"Created locked placeholder for '{name}', adding to pending migrations",
alias.clone(),
Keyring::Locked(locked),
self.pending_migrations
.insert(name.to_owned(), migration);
tracing::error!("Failed to create placeholder keyring for '{name}': {e}");
/// Load a single keyring from a file path
/// Returns (name, label, alias, keyring)
async fn load_keyring(
path: &std::path::Path,
) -> Result<(String, String, String, Keyring), Error> {
let alias = if name.eq_ignore_ascii_case(Self::LOGIN_ALIAS) {
oo7::dbus::Service::DEFAULT_COLLECTION.to_owned()
name.to_owned().to_lowercase()
// Use name as label (capitalized for consistency with Login)
let keyring = match LockedKeyring::load(path).await {
Ok(locked_keyring) => {
// Successfully loaded as v1 keyring
match locked_keyring.unlock(secret.clone()).await {
tracing::info!("Unlocked keyring '{}' from {:?}", name, path);
Keyring::Unlocked(unlocked)
"Failed to unlock keyring '{}' with provided secret: {}. Keeping it locked.",
name,
// Reload as locked since unlock consumed it
Keyring::Locked(LockedKeyring::load(path).await?)
tracing::debug!("No secret provided, keeping keyring '{}' locked", name);
Keyring::Locked(locked_keyring)
Err(oo7::file::Error::VersionMismatch(Some(version)))
if version.first() == Some(&0) =>
// v0 is the legacy version
// This is a v0 keyring that needs migration
"Found legacy v0 keyring '{name}' at {}, registering for migration",
path.display()
let migration = PendingMigration::V0 {
path: path.to_path_buf(),
tracing::debug!("Attempting immediate migration of v0 keyring '{name}'",);
match migration.migrate(&self.data_dir, secret).await {
tracing::info!("Successfully migrated v0 keyring '{name}' to v1",);
return Ok((name.to_owned(), label, alias, Keyring::Unlocked(unlocked)));
"Failed to migrate v0 keyring '{name}': {e}. Creating locked placeholder collection.",
// Migration failed - create locked placeholder and register for
// pending migration
"Creating locked placeholder for v0 keyring '{}', will migrate on unlock",
let locked = LockedKeyring::open(name).await?;
Keyring::Locked(locked)
// Plain legacy keyrings, written by gnome-keyring for an empty
// password, don't have the binary file header. Their migration
// doesn't need a secret, so if it fails this isn't a keyring.
Err(oo7::file::Error::FileHeaderMismatch(_)) => {
"Found legacy plain keyring '{name}' at {}, migrating",
Keyring::Unlocked(migration.migrate(&self.data_dir, secret).await?)
return Err(e.into());
Ok((name.to_owned(), label, alias, keyring))
/// Initialize the service with collections and start client disconnect
/// handler
pub(crate) async fn initialize(
mut discovered_keyrings: Vec<(String, String, String, Keyring)>, /* (name, label, alias,
* keyring) */
auto_create_default: bool,
) -> Result<(), Error> {
*self.connection.write().unwrap() = Some(connection.clone());
let object_server = connection.object_server();
let mut collections = self.collections.lock().await;
// Check if we have a default collection
let has_default = discovered_keyrings.iter().any(|(_, _, alias, _)| {
alias == oo7::dbus::Service::DEFAULT_COLLECTION || alias == Self::LOGIN_ALIAS
if !has_default && auto_create_default {
tracing::info!("No default collection found, creating 'Login' keyring");
let keyring = if let Some(secret) = secret {
UnlockedKeyring::open_at(&self.data_dir, Self::LOGIN_ALIAS, Some(secret))
.map(Keyring::Unlocked)
LockedKeyring::open_at(&self.data_dir, Self::LOGIN_ALIAS)
.map(Keyring::Locked)
let keyring = keyring.inspect_err(|e| {
tracing::error!("Failed to create default Login keyring: {}", e);
let is_locked = if keyring.is_locked() {
"locked"
"unlocked"
discovered_keyrings.push((
Self::LOGIN_ALIAS.to_owned(),
keyring,
tracing::info!("Created default 'Login' collection ({})", is_locked);
// Build all collections under the lock, then register on D-Bus after
// releasing it to avoid deadlocks with incoming calls.
let mut built_collections: Vec<(Collection, String)> = Vec::new();
for (name, label, alias, keyring) in discovered_keyrings {
tracing::info!("Setting up collection '{name}' (alias: {alias}).");
let (unique_label, unique_alias) =
Self::make_unique_label_and_alias(&collections, &label, &alias);
let collection =
Collection::new(&name, &unique_label, &unique_alias, self.clone(), keyring).await;
collections.insert(collection.path().to_owned().into(), collection.clone());
built_collections.push((collection, unique_alias));
// Always create session collection (always temporary)
let session_collection = Collection::new(
"session",
oo7::dbus::Service::SESSION_COLLECTION,
Keyring::Unlocked(UnlockedKeyring::temporary(Secret::random().unwrap()).await?),
collections.insert(
session_collection.path().to_owned().into(),
session_collection.clone(),
// Now register on D-Bus and dispatch items without holding the lock
for (collection, alias) in &built_collections {
collection.dispatch_items().await?;
object_server
.at(collection.path(), collection.clone())
if alias == oo7::dbus::Service::DEFAULT_COLLECTION {
.at(DEFAULT_COLLECTION_ALIAS_PATH, collection.clone())
let session_path = session_collection.path().to_owned();
object_server.at(&session_path, session_collection).await?;
// Spawn client disconnect handler
tokio::spawn(async move { service.on_client_disconnect().await });
// Spawn stale session cleanup task
tokio::spawn(async move { service.cleanup_stale_sessions().await });
Ok(())
async fn on_client_disconnect(&self) -> zbus::Result<()> {
let rule = zbus::MatchRule::builder()
.msg_type(zbus::message::Type::Signal)
.sender("org.freedesktop.DBus")?
.interface("org.freedesktop.DBus")?
.member("NameOwnerChanged")?
.arg(2, "")?
.build();
let mut stream =
zbus::MessageStream::for_match_rule(rule, &self.connection(), None).await?;
while let Some(message) = stream.try_next().await? {
let body = message.body();
let Ok((_name, old_owner, new_owner)) =
body.deserialize::<(String, Optional<UniqueName<'_>>, Optional<UniqueName<'_>>)>()
else {
debug_assert!(new_owner.is_none()); // We enforce that in the matching rule
let old_owner = old_owner
.as_ref()
.expect("A disconnected client requires an old_owner");
if let Some(session) = self.session_from_sender(old_owner).await {
let client_name = match session.peer_info() {
Some(info) => format!("{old_owner} ({info})"),
None => old_owner.to_string(),
session.mark_stale().await;
"Client {} disconnected. Session: {} marked for cleanup.",
client_name,
session.path()
async fn cleanup_stale_sessions(&self) {
let mut interval = tokio::time::interval(std::time::Duration::from_secs(30));
interval.tick().await;
let stale_paths: Vec<_> = {
let sessions = self.sessions.lock().await;
let mut paths = Vec::new();
for (path, session) in sessions.iter() {
if session.is_stale().await {
paths.push(path.clone());
paths
for path in stale_paths {
if let Some(session) = self.session(&path).await {
match session.close().await {
Ok(_) => tracing::info!("Stale session {} cleaned up.", path),
tracing::error!("Failed to clean up stale session {}: {}", path, err)
pub async fn set_locked(
locked: bool,
objects: &[OwnedObjectPath],
let mut without_prompt = Vec::new();
let mut with_prompt = Vec::new();
for object in objects {
let resolved = Self::resolve_alias(&collections, object)
.unwrap_or_else(|| object.clone());
let mut found = false;
let collection_locked = collection.is_locked().await;
if resolved == *path {
found = true;
if collection_locked == locked {
"Collection: {} is already {}.",
resolved,
if locked { "locked" } else { "unlocked" }
without_prompt.push(resolved.clone());
} else if locked {
// Locking never requires a prompt
collection.set_locked(true, None).await?;
// Unlocking may require a prompt
with_prompt.push(resolved.clone());
} else if let Some(item) = collection.item_from_path(&resolved).await {
// If collection is locked, can't perform any item
// lock/unlock operations
if collection_locked {
// Unlocking an item when collection is locked requires
// unlocking collection
if !locked {
// Can't lock an item when collection is locked
return Err(ServiceError::IsLocked(format!(
"Cannot lock item {} when collection is locked",
resolved
)));
} else if locked == item.is_locked().await {
"Item: {} is already {}.",
item.set_locked(locked, k.as_unlocked()).await?;
if locked {
if !found {
tracing::warn!("Object: {} does not exist.", object);
Ok((without_prompt, with_prompt))
pub fn connection(&self) -> zbus::Connection {
self.connection
.read()
.unwrap()
.clone()
.expect("service is not initialized")
pub fn object_server(&self) -> zbus::ObjectServer {
self.connection().object_server().clone()
/// Drop the service's reference to its connection.
///
/// The connection's object server holds the service, which in turn holds
/// the connection, so neither is ever freed otherwise.
pub(crate) fn release_connection(&self) {
self.connection.write().unwrap().take();
async fn resolve_alias(
path: &ObjectPath<'_>,
) -> Option<OwnedObjectPath> {
let alias = path.strip_prefix("/org/freedesktop/secrets/aliases/")?;
let alias_to_find = if alias == Self::LOGIN_ALIAS {
alias
for (real_path, collection) in collections.iter() {
return Some(real_path.clone());
None
pub async fn collection_from_path(&self, path: &ObjectPath<'_>) -> Option<Collection> {
if let Some(collection) = collections.get(path).cloned() {
return Some(collection);
let resolved = Self::resolve_alias(&collections, path).await?;
collections.get(&resolved).cloned()
pub fn session_index(&self) -> u32 {
self.session_index.fetch_add(1, Ordering::Relaxed)
pub(crate) async fn session_from_sender(&self, sender: &UniqueName<'_>) -> Option<Session> {
sessions.values().find(|s| s.sender() == sender).cloned()
pub async fn peer_display_name(&self, sender: &UniqueName<'_>) -> String {
match self.session_from_sender(sender).await {
Some(session) => match session.peer_info() {
Some(info) => format!("{sender} ({info})"),
None => sender.to_string(),
pub async fn session(&self, path: &ObjectPath<'_>) -> Option<Session> {
let session = self.sessions.lock().await.get(path).cloned()?;
session.unmark_stale().await;
Some(session)
pub async fn remove_session(&self, path: &ObjectPath<'_>) {
self.sessions.lock().await.remove(path);
pub async fn remove_collection(&self, path: &ObjectPath<'_>) {
self.collections.lock().await.remove(path);
if let Ok(signal_emitter) =
self.signal_emitter(oo7::dbus::api::Service::PATH.as_deref().unwrap())
let _ = self.collections_changed(&signal_emitter).await;
pub fn prompt_index(&self) -> u32 {
self.prompt_index.fetch_add(1, Ordering::Relaxed)
pub async fn prompt(&self, path: &ObjectPath<'_>) -> Option<Prompt> {
self.prompts.lock().await.get(path).cloned()
pub async fn remove_prompt(&self, path: &ObjectPath<'_>) {
self.prompts.lock().await.remove(path);
// Also clean up pending collection if it exists
self.pending_collections.lock().await.remove(path);
pub async fn register_prompt(&self, path: OwnedObjectPath, prompt: Prompt) {
self.prompts.lock().await.insert(path, prompt);
pub async fn pending_collection(
prompt_path: &ObjectPath<'_>,
) -> Option<(String, String)> {
.get(prompt_path)
.cloned()
pub async fn create_collection_with_secret(
) -> Result<OwnedObjectPath, ServiceError> {
// Create a persistent keyring with the provided secret
let keyring = UnlockedKeyring::open_at(&self.data_dir, &label.to_lowercase(), secret)
.map_err(|err| custom_service_error(&format!("Failed to create keyring: {err}")))?;
// Write the keyring file to disk immediately
keyring
.write()
.map_err(|err| custom_service_error(&format!("Failed to write keyring file: {err}")))?;
let keyring = Keyring::Unlocked(keyring);
let name = label.to_lowercase();
// Create the collection with unique label and alias
let (unique_label, unique_alias) = {
Self::make_unique_label_and_alias(&collections, label, alias)
let collection_path: OwnedObjectPath = collection.path().to_owned().into();
// Register with object server
self.object_server()
// Add to collections
self.collections
.insert(collection_path.clone(), collection);
// Emit CollectionCreated signal
let service_path = oo7::dbus::api::Service::PATH.as_ref().unwrap();
let signal_emitter = self.signal_emitter(service_path)?;
Service::collection_created(&signal_emitter, &collection_path).await?;
// Emit PropertiesChanged for Collections property to invalidate client
// cache
self.collections_changed(&signal_emitter).await?;
"Collection `{}` created with label '{}'",
collection_path,
label
Ok(collection_path)
pub async fn complete_collection_creation(
let Some((label, alias)) = self.pending_collection(prompt_path).await else {
return Err(ServiceError::NoSuchObject(format!(
"No pending collection for prompt `{prompt_path}`"
let collection_path = self
.create_collection_with_secret(&label, &alias, secret)
self.pending_collections.lock().await.remove(prompt_path);
pub fn signal_emitter<'a, P>(
path: P,
) -> Result<zbus::object_server::SignalEmitter<'a>, oo7::dbus::ServiceError>
where
P: TryInto<ObjectPath<'a>>,
P::Error: Into<zbus::Error>,
let signal_emitter = zbus::object_server::SignalEmitter::new(&self.connection(), path)?;
Ok(signal_emitter)
/// Extract the collection label from a list of object paths
/// The objects can be either collections or items
async fn extract_label_from_objects(&self, objects: &[OwnedObjectPath]) -> String {
if objects.is_empty() {
return String::new();
// Check if at least one of the objects is a Collection
if let Some(collection) = self.collection_from_path(object).await {
return collection.label().await;
// Get the collection path from the first item
// assumes all items are from the same collection
if let Some(path_str) = objects.first().and_then(|p| p.as_str().rsplit_once('/')) {
let collection_path = path_str.0;
if let Ok(obj_path) = ObjectPath::try_from(collection_path)
&& let Some(collection) = self.collection_from_path(&obj_path).await
String::new()
/// Extract the collection from a list of object paths
async fn extract_collection_from_objects(
) -> Option<Collection> {
return None;
// (assumes all items are from the same collection)
let path = objects
.first()
.as_str()
.rsplit_once('/')
.map(|(parent, _)| parent)?;
self.collection_from_path(&ObjectPath::try_from(path).unwrap())
/// Attempt to migrate pending keyrings with the provided secret
/// Returns a list of successfully migrated keyring names
pub async fn migrate_pending_keyrings(&self, secret: &Secret) -> Vec<String> {
let mut migrated = Vec::new();
let mut pending = self.pending_migrations.lock().await;
let mut to_remove = Vec::new();
for (name, migration) in pending.iter() {
tracing::debug!("Attempting to migrate pending keyring: {name}");
let label = migration.label();
let alias = migration.alias();
// Create a collection for this migrated keyring with unique
// label and alias
let keyring = Keyring::Unlocked(unlocked);
Collection::new(name, &unique_label, &unique_alias, self.clone(), keyring)
// Dispatch items
"Failed to dispatch items for migrated keyring '{name}': {e}",
if let Err(e) = self
"Failed to register migrated collection '{name}' with object server: {e}",
.insert(collection_path.clone(), collection.clone());
if alias == oo7::dbus::Service::DEFAULT_COLLECTION
&& let Err(e) = self
.at(DEFAULT_COLLECTION_ALIAS_PATH, collection)
"Failed to register default alias for migrated collection '{name}': {e}",
self.signal_emitter(oo7::dbus::api::Service::PATH.as_ref().unwrap())
let _ =
Service::collection_created(&signal_emitter, &collection_path).await;
tracing::info!("Migrated keyring '{name}' added as collection",);
migrated.push(name.clone());
to_remove.push(name.clone());
"Failed to migrate keyring '{name}' found at {} with provided secret: {e}",
for name in &to_remove {
pending.remove(name);
migrated
#[cfg(test)]
mod tests;
mod unencrypted_tests;