https://bugs.kde.org/show_bug.cgi?id=524786
Bug ID: 524786
Summary: KWallet fails to auto-unlock via PAM after upgrade to
kwallet 6.29.0 (kwalletd6/ksecretd never receives PAM
credentials in time)
Classification: Frameworks and Libraries
Product: kwallet-pam
Version First 6.7.4
Reported In:
Platform: EndeavourOS
OS: Linux
Status: REPORTED
Severity: normal
Priority: NOR
Component: general
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ---
DESCRIPTION
After upgrading kwallet from 6.28.0-1 to 6.29.0-1 (which per the changelog
"drops unused internal pamOpen from kwalletd"), KWallet no longer auto-unlocks
at login via pam_kwallet5.so, even though PAM appears to run correctly and pass
credentials. Every application accessing KWallet/Secret Service
(NetworkManager, KRDC, browsers, etc.) is now prompted for the wallet password
individually, instead of the wallet being unlocked automatically at login as it
was before this update.
This also occurs with the ArchWiki-documented kwalletd=/usr/bin/ksecretd
parameter explicitly added to the PAM session line — the behavior is unchanged
with or without this parameter.
STEPS TO REPRODUCE
1. Use a standard Arch/EndeavourOS PAM configuration for sddm with
pam_kwallet5.so auto_start in the session stack (as documented on the ArchWiki
"KDE Wallet" page).
2. Upgrade kwallet from 6.28.0 to 6.29.0 (and related packages:
signon-kwallet-extension 26.04.3 → 26.08.0).
3. Trigger any KWallet/Secret-Service access (e.g., let NetworkManager try to
fetch a stored VPN/WiFi secret, or open KRDC with a saved connection).
OBSERVED RESULT
- pam_kwallet5 correctly authenticates and passes credentials at login (visible
in journalctl), writing to /run/user/1000/kwallet5.socket.
- kwalletd6 is only started later via D-Bus lazy activation (delay observed
ranging from ~10 seconds to over 30 minutes across different logins/sessions),
by which point the PAM-supplied credentials are no longer used to unlock it.
- The Secret Service is repeatedly reported as toggling availability during the
session:
kwalletd6[...]: Secret Service availability changed: Unavailable
kwalletd6[...]: Secret Service availability changed: Available
- Every subsequent access to the wallet by an application prompts for the
password manually.
- Adding kwalletd=/usr/bin/ksecretd to the PAM session line (per current
ArchWiki guidance) does not change this behavior.
--- Before adding kwalletd= parameter: ---
Aug 25 07:20:14 host sddm-helper[1486]: pam_kwallet5: final socket path:
/run/user/1000/kwallet5.socket
Aug 25 07:20:17 host systemd[1435]: Started Unlock kwallet from pam
credentials.
Aug 25 07:20:17 host pam_kwallet_init[1723]: socat[1723] W address is opened in
read-write mode but only supports read-only
Aug 25 07:21:33 host systemd[1435]: Started
dbus-:[email protected].
Aug 25 07:21:33 host kwalletd6[13240]: Failed to register with host portal
QDBusError("org.freedesktop.portal.Error.Failed", "Could not register app ID:
App info not found for 'org.kde.kwalletd'")
Aug 25 07:22:16 host kwalletd6[13240]: Secret Service availability changed:
Unavailable
Aug 25 07:24:44 host kwalletd6[13240]: Secret Service availability changed:
Available
--- After adding kwalletd=/usr/bin/ksecretd to the PAM session line (no change
in behavior): ---
Aug 25 08:46:08 host sddm-helper[1477]: pam_kwallet5: final socket path:
/run/user/1000/kwallet5.socket
Aug 25 08:46:11 host systemd[1426]: Started Unlock kwallet from pam
credentials.
Aug 25 08:46:11 host pam_kwallet_init[1714]: socat[1714] W address is opened in
read-write mode but only supports read-only
Aug 25 08:46:36 host systemd[1426]: Started
dbus-:[email protected].
Aug 25 08:46:36 host kwalletd6[2473]: Failed to register with host portal
QDBusError("org.freedesktop.portal.Error.Failed", "Could not register app ID:
App info not found for 'org.kde.kwalletd'")
Aug 25 08:52:07 host kwalletd6[2473]: Secret Service availability changed:
Unavailable
Aug 25 09:26:34 host kwalletd6[2473]: Secret Service availability changed:
Available
--- PACKAGE VERSIONS AT TIME OF REGRESSION (from pacman.log) ---
2026-08-21 kwallet 6.28.0-1 -> 6.29.0-1
2026-08-21 signon-kwallet-extension 26.04.3-1 -> 26.08.0-1
2026-08-21 plasma-workspace 6.7.4-1 -> 6.7.4-3 (rebuild only)
2026-08-21 networkmanager-qt 6.28.0-1 -> 6.29.0-1
2026-08-22 networkmanager 1.58.0-1 -> 1.58.1-1
EXPECTED RESULT
KWallet should unlock automatically at login using the credentials supplied by
pam_kwallet5, as it did prior to the 6.28.0 -> 6.29.0 upgrade, without
requiring a manual password prompt on first access.
--
You are receiving this mail because:
You are watching all bug changes.
