GNOME gets stuck because of GNOME Keyring

I’m trying to launch GNOME on a server in a docker container :slight_smile: (I guess it’s more about docker, then about a server.) Actually, I more or less succeeded, but there are issues. I’m using an ubuntu:22.04 image. And GNOME gets stuck for a couple of minutes before it launches:

Apr 28 03:33:29 265ca77e07d5 systemd[42]: Starting Start gnome-keyring as SSH agent...
Apr 28 03:33:29 265ca77e07d5 systemd[42]: Starting Start gnome-keyring for the Secrets Service, and PKCS #11...
Apr 28 03:33:29 265ca77e07d5 systemd[42]: Starting Monitor Session leader for GNOME Session...
Apr 28 03:33:29 265ca77e07d5 systemd[42]: Starting Session Migration...
Apr 28 03:33:29 265ca77e07d5 systemd[42]: Started Monitor Session leader for GNOME Session.
Apr 28 03:33:29 265ca77e07d5 gnome-keyring-daemon[143]: couldn't access control socket: /run/user/1000/keyring/control: No such file or directory
Apr 28 03:33:29 265ca77e07d5 gnome-keyring-d[143]: couldn't access control socket: /run/user/1000/keyring/control: No such file or directory
Apr 28 03:33:29 265ca77e07d5 gnome-keyring-daemon[146]: couldn't access control socket: /run/user/1000/keyring/control: No such file or directory
Apr 28 03:33:29 265ca77e07d5 gnome-keyring-d[146]: couldn't access control socket: /run/user/1000/keyring/control: No such file or directory
Apr 28 03:33:29 265ca77e07d5 gnome-keyring-daemon[146]: couldn't access control socket: /run/user/1000/keyring/control: No such file or directory
Apr 28 03:33:29 265ca77e07d5 gnome-keyring-d[146]: couldn't access control socket: /run/user/1000/keyring/control: No such file or directory
Apr 28 03:33:30 265ca77e07d5 sh[154]: dbus-update-activation-environment: setting SSH_AUTH_SOCK=/run/user/1000/keyring/ssh
Apr 28 03:33:30 265ca77e07d5 sh[154]: dbus-update-activation-environment: setting SSH_AGENT_LAUNCHER=gnome-keyring
Apr 28 03:33:30 265ca77e07d5 systemd[42]: Finished Session Migration.
Apr 28 03:33:30 265ca77e07d5 systemd[42]: Finished Start gnome-keyring as SSH agent.
# here
Apr 28 03:35:00 265ca77e07d5 systemd[42]: gnome-keyring.service: State 'stop-sigterm' timed out. Killing.
Apr 28 03:35:00 265ca77e07d5 systemd[42]: gnome-keyring.service: Failed with result 'timeout'.
Apr 28 03:35:00 265ca77e07d5 systemd[42]: Failed to start Start gnome-keyring for the Secrets Service, and PKCS #11.
Apr 28 03:35:00 265ca77e07d5 systemd[42]: Reached target Session services which should run early before the graphical session is brought up.
Apr 28 03:35:00 265ca77e07d5 systemd[42]: Reached target Tasks to be run before GNOME Session starts.
Apr 28 03:35:00 265ca77e07d5 systemd[42]: Starting GNOME Session Manager (session: gnome)...

Supposedly, it’s caused by GNOME Keyring. Maybe because it can’t find some files at /run/user. What makes it stuck? I don’t think I need GNOME Keyring. Is there a way to disable it?

More info here.

Not sure, but maybe pam_gnome_keyring.so is missing in your pam stack?

Maybe try this patch?

diff --git a/daemon/gkd-main.c b/daemon/gkd-main.c
index 5a9c58e9..f5274f2a 100644
--- a/daemon/gkd-main.c
+++ b/daemon/gkd-main.c
@@ -624,7 +624,7 @@ static void
 block_on_fd (int fd)
 {
        unsigned char dummy;
-       read (fd, &dummy, 1);
+       while (read (fd, &dummy, 1) < 0 && errno == EINTR);
 }
 
 static int

It would be weird, but if the intermediate process gets a signal, it might not be waiting long enough and the PAM module continues even though the environment is not yet ready.

2 posts were split to a new topic: Flagged topics and spam

No, the patch doesn’t help.

Putting the patch aside. W/ sleep 5 it succeeds:

May 02 04:53:38 025d55a48239 systemd[110]: Starting Start gnome-keyring for the Secrets Service, and PKCS #11...
May 02 04:53:38 025d55a48239 dbus-daemon[124]: [session uid=1000 pid=124] Activating service name='org.freedesktop.secrets' requested by ':1.18' (uid=1000 pid=250 comm="/usr/libexec/xdg-desktop-portal ")
May 02 04:53:38 025d55a48239 gnome-keyring-d[349]: -- main: 1046
May 02 04:53:38 025d55a48239 org.freedesktop.secrets[349]: gnome-keyring-daemon: no process capabilities, insecure memory might get used
May 02 04:53:38 025d55a48239 gnome-keyring-daemon[349]: couldn't access control socket: /run/user/1000/keyring/control: No such file or directory
May 02 04:53:38 025d55a48239 dbus-daemon[124]: [session uid=1000 pid=124] Successfully activated service 'org.freedesktop.secrets'
May 02 04:53:43 025d55a48239 gnome-keyring-d[363]: -- main: 1046
May 02 04:53:43 025d55a48239 gnome-keyring-daemon[363]: gnome-keyring-daemon: no process capabilities, insecure memory might get used
May 02 04:53:43 025d55a48239 gnome-keyring-daemon[363]: -- fork_and_print_environment: fork(), parent, 653
May 02 04:53:43 025d55a48239 gnome-keyring-daemon[364]: -- fork_and_print_environment: fork(), child, 684
May 02 04:53:43 025d55a48239 gnome-keyring-d[349]: The Secret Service was already initialized
May 02 04:53:43 025d55a48239 gnome-keyring-daemon[349]: The Secret Service was already initialized
May 02 04:53:43 025d55a48239 gnome-keyring-daemon[364]: -- main: cleanup_and_exit(0), 1124
May 02 04:53:43 025d55a48239 gnome-keyring-daemon[364]: -- cleanup_and_exit: exit(code), 0, 489
May 02 04:53:43 025d55a48239 gnome-keyring-daemon[363]: -- fork_and_print_environment: exit(0), 680
May 02 04:53:43 025d55a48239 systemd[110]: Finished Start gnome-keyring for the Secrets Service, and PKCS #11.

More lines:

May 02 04:53:38 025d55a48239 systemd[110]: Starting Start gnome-keyring for the Secrets Service, and PKCS #11...
May 02 04:53:38 025d55a48239 systemd[110]: Starting GNOME Remote Desktop...
May 02 04:53:38 025d55a48239 systemd[110]: Starting Monitor Session leader for GNOME Session...
May 02 04:53:38 025d55a48239 systemd[110]: Starting Session Migration...
May 02 04:53:38 025d55a48239 systemd[110]: Starting Rewrite dynamic launcher portal entries...
May 02 04:53:38 025d55a48239 systemd[110]: Finished Start gnome-keyring as SSH agent.
May 02 04:53:38 025d55a48239 systemd[110]: Started OpenSSH Agent.
May 02 04:53:38 025d55a48239 systemd[110]: Started Monitor Session leader for GNOME Session.
May 02 04:53:38 025d55a48239 systemd[110]: Finished Rewrite dynamic launcher portal entries.
May 02 04:53:38 025d55a48239 systemd[110]: Finished Session Migration.
May 02 04:53:38 025d55a48239 systemd[110]: Started GNOME Remote Desktop.
May 02 04:53:38 025d55a48239 dbus-daemon[124]: [session uid=1000 pid=124] Activating via systemd: service name='ca.desrt.dconf' unit='dconf.service' requested by ':1.16' (uid=1000 pid=222 comm="/usr/libexec/ibus-ui-gtk3 ")
May 02 04:53:38 025d55a48239 systemd[110]: Starting User preferences database...
May 02 04:53:38 025d55a48239 dbus-daemon[124]: [session uid=1000 pid=124] Successfully activated service 'ca.desrt.dconf'
May 02 04:53:38 025d55a48239 systemd[110]: Started User preferences database.
May 02 04:53:38 025d55a48239 avahi-daemon[32]: Server startup complete. Host name is 025d55a48239.local. Local service cookie is 4278655166.
May 02 04:53:38 025d55a48239 dbus-daemon[124]: [session uid=1000 pid=124] Successfully activated service 'org.freedesktop.impl.portal.desktop.gtk'
May 02 04:53:38 025d55a48239 systemd[110]: Started Portal service (GTK/GNOME implementation).
May 02 04:53:38 025d55a48239 xdg-desktop-por[250]: Failed to load RealtimeKit property: GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name org.freedesktop.RealtimeKit1 was not provided by any .service files
May 02 04:53:38 025d55a48239 xdg-desktop-por[250]: Failed to load RealtimeKit property: GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name org.freedesktop.RealtimeKit1 was not provided by any .service files
May 02 04:53:38 025d55a48239 xdg-desktop-por[250]: Failed to load RealtimeKit property: GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name org.freedesktop.RealtimeKit1 was not provided by any .service files
May 02 04:53:38 025d55a48239 dbus-daemon[124]: [session uid=1000 pid=124] Activating service name='org.freedesktop.secrets' requested by ':1.18' (uid=1000 pid=250 comm="/usr/libexec/xdg-desktop-portal ")
May 02 04:53:38 025d55a48239 gnome-keyring-d[349]: -- main: 1046
May 02 04:53:38 025d55a48239 org.freedesktop.secrets[349]: gnome-keyring-daemon: no process capabilities, insecure memory might get used
May 02 04:53:38 025d55a48239 gnome-keyring-daemon[349]: couldn't access control socket: /run/user/1000/keyring/control: No such file or directory
May 02 04:53:38 025d55a48239 gnome-keyring-d[349]: couldn't access control socket: /run/user/1000/keyring/control: No such file or directory
May 02 04:53:38 025d55a48239 dbus-daemon[124]: [session uid=1000 pid=124] Successfully activated service 'org.freedesktop.secrets'
May 02 04:53:38 025d55a48239 dbus-daemon[124]: [session uid=1000 pid=124] Successfully activated service 'org.freedesktop.portal.Desktop'
May 02 04:53:38 025d55a48239 systemd[110]: Started Portal service.
May 02 04:53:43 025d55a48239 gnome-keyring-d[363]: -- main: 1046
May 02 04:53:43 025d55a48239 gnome-keyring-daemon[363]: gnome-keyring-daemon: no process capabilities, insecure memory might get used
May 02 04:53:43 025d55a48239 gnome-keyring-daemon[363]: -- fork_and_print_environment: fork(), parent, 653
May 02 04:53:43 025d55a48239 gnome-keyring-d[363]: -- fork_and_print_environment: fork(), parent, 653
May 02 04:53:43 025d55a48239 gnome-keyring-d[364]: -- fork_and_print_environment: fork(), child, 684
May 02 04:53:43 025d55a48239 gnome-keyring-daemon[364]: -- fork_and_print_environment: fork(), child, 684
May 02 04:53:43 025d55a48239 gnome-keyring-d[349]: The Secret Service was already initialized
May 02 04:53:43 025d55a48239 gnome-keyring-daemon[349]: The Secret Service was already initialized
May 02 04:53:43 025d55a48239 gnome-keyring-d[364]: -- main: cleanup_and_exit(0), 1124
May 02 04:53:43 025d55a48239 gnome-keyring-daemon[364]: -- main: cleanup_and_exit(0), 1124
May 02 04:53:43 025d55a48239 gnome-keyring-d[364]: -- cleanup_and_exit: exit(code), 0, 489
May 02 04:53:43 025d55a48239 gnome-keyring-daemon[364]: -- cleanup_and_exit: exit(code), 0, 489
May 02 04:53:43 025d55a48239 gnome-keyring-d[363]: -- fork_and_print_environment: exit(0), 680
May 02 04:53:43 025d55a48239 gnome-keyring-daemon[363]: -- fork_and_print_environment: exit(0), 680
May 02 04:53:43 025d55a48239 systemd[110]: Finished Start gnome-keyring for the Secrets Service, and PKCS #11.

W/o sleep it fails:

May 02 05:09:02 ab6aaba04124 systemd[109]: Starting Start gnome-keyring for the Secrets Service, and PKCS #11...
May 02 05:09:02 ab6aaba04124 gnome-keyring-d[309]: -- main: 1046
May 02 05:09:02 ab6aaba04124 gnome-keyring-daemon[309]: gnome-keyring-daemon: no process capabilities, insecure memory might get used
May 02 05:09:02 ab6aaba04124 gnome-keyring-daemon[309]: -- fork_and_print_environment: fork(), parent, 653
May 02 05:09:02 ab6aaba04124 gnome-keyring-daemon[321]: -- fork_and_print_environment: fork(), child, 684
May 02 05:09:02 ab6aaba04124 gnome-keyring-daemon[321]: couldn't access control socket: /run/user/1000/keyring/control: No such file or directory
May 02 05:09:02 ab6aaba04124 gnome-keyring-daemon[309]: -- fork_and_print_environment: exit(0), 680
May 02 05:09:02 ab6aaba04124 gnome-keyring-daemon[321]: -- main: return 0, 1210
May 02 05:09:02 ab6aaba04124 dbus-daemon[124]: [session uid=1000 pid=124] Activating service name='org.freedesktop.secrets' requested by ':1.19' (uid=1000 pid=251 comm="/usr/libexec/xdg-desktop-portal ")
May 02 05:09:02 ab6aaba04124 gnome-keyring-d[347]: -- main: 1046
May 02 05:09:02 ab6aaba04124 org.freedesktop.secrets[347]: gnome-keyring-daemon: no process capabilities, insecure memory might get used
May 02 05:09:02 ab6aaba04124 gnome-keyring-daemon[347]: couldn't access control socket: /run/user/1000/keyring/control: No such file or directory
May 02 05:09:02 ab6aaba04124 dbus-daemon[124]: [session uid=1000 pid=124] Successfully activated service 'org.freedesktop.secrets'
May 02 05:10:32 ab6aaba04124 systemd[109]: gnome-keyring.service: State 'stop-sigterm' timed out. Killing.
May 02 05:10:32 ab6aaba04124 systemd[109]: gnome-keyring.service: Failed with result 'timeout'.
May 02 05:10:32 ab6aaba04124 systemd[109]: Failed to start Start gnome-keyring for the Secrets Service, and PKCS #11.

More lines:

May 02 05:09:02 ab6aaba04124 systemd[109]: Starting Start gnome-keyring for the Secrets Service, and PKCS #11...
May 02 05:09:02 ab6aaba04124 systemd[109]: Starting GNOME Remote Desktop...
May 02 05:09:02 ab6aaba04124 systemd[109]: Starting Monitor Session leader for GNOME Session...
May 02 05:09:02 ab6aaba04124 systemd[109]: Starting Session Migration...
May 02 05:09:02 ab6aaba04124 systemd[109]: Starting Rewrite dynamic launcher portal entries...
May 02 05:09:02 ab6aaba04124 systemd[109]: Finished Start gnome-keyring as SSH agent.
May 02 05:09:02 ab6aaba04124 systemd[109]: Started OpenSSH Agent.
May 02 05:09:02 ab6aaba04124 systemd[109]: Started Monitor Session leader for GNOME Session.
May 02 05:09:02 ab6aaba04124 gnome-keyring-d[309]: -- main: 1046
May 02 05:09:02 ab6aaba04124 gnome-keyring-daemon[309]: gnome-keyring-daemon: no process capabilities, insecure memory might get used
May 02 05:09:02 ab6aaba04124 gnome-keyring-daemon[309]: -- fork_and_print_environment: fork(), parent, 653
May 02 05:09:02 ab6aaba04124 gnome-keyring-d[309]: -- fork_and_print_environment: fork(), parent, 653
May 02 05:09:02 ab6aaba04124 systemd[109]: Finished Rewrite dynamic launcher portal entries.
May 02 05:09:02 ab6aaba04124 gnome-keyring-daemon[321]: -- fork_and_print_environment: fork(), child, 684
May 02 05:09:02 ab6aaba04124 gnome-keyring-daemon[321]: couldn't access control socket: /run/user/1000/keyring/control: No such file or directory
May 02 05:09:02 ab6aaba04124 gnome-keyring-d[321]: -- fork_and_print_environment: fork(), child, 684
May 02 05:09:02 ab6aaba04124 gnome-keyring-d[321]: couldn't access control socket: /run/user/1000/keyring/control: No such file or directory
May 02 05:09:02 ab6aaba04124 systemd[109]: Finished Session Migration.
May 02 05:09:02 ab6aaba04124 gnome-keyring-daemon[309]: -- fork_and_print_environment: exit(0), 680
May 02 05:09:02 ab6aaba04124 gnome-keyring-d[309]: -- fork_and_print_environment: exit(0), 680
May 02 05:09:02 ab6aaba04124 gnome-keyring-daemon[321]: -- main: return 0, 1210
May 02 05:09:02 ab6aaba04124 gnome-keyring-d[321]: -- main: return 0, 1210
May 02 05:09:02 ab6aaba04124 systemd[109]: Started GNOME Remote Desktop.
May 02 05:09:02 ab6aaba04124 dbus-daemon[124]: [session uid=1000 pid=124] Activating via systemd: service name='ca.desrt.dconf' unit='dconf.service' requested by ':1.15' (uid=1000 pid=220 comm="/usr/libexec/ibus-ui-gtk3 ")
May 02 05:09:02 ab6aaba04124 systemd[109]: Starting User preferences database...
May 02 05:09:02 ab6aaba04124 dbus-daemon[124]: [session uid=1000 pid=124] Successfully activated service 'ca.desrt.dconf'
May 02 05:09:02 ab6aaba04124 systemd[109]: Started User preferences database.
May 02 05:09:02 ab6aaba04124 dbus-daemon[124]: [session uid=1000 pid=124] Successfully activated service 'org.freedesktop.impl.portal.desktop.gtk'
May 02 05:09:02 ab6aaba04124 systemd[109]: Started Portal service (GTK/GNOME implementation).
May 02 05:09:02 ab6aaba04124 xdg-desktop-por[251]: Failed to load RealtimeKit property: GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name org.freedesktop.RealtimeKit1 was not provided by any .service files
May 02 05:09:02 ab6aaba04124 xdg-desktop-por[251]: Failed to load RealtimeKit property: GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name org.freedesktop.RealtimeKit1 was not provided by any .service files
May 02 05:09:02 ab6aaba04124 xdg-desktop-por[251]: Failed to load RealtimeKit property: GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name org.freedesktop.RealtimeKit1 was not provided by any .service files
May 02 05:09:02 ab6aaba04124 dbus-daemon[124]: [session uid=1000 pid=124] Activating service name='org.freedesktop.secrets' requested by ':1.19' (uid=1000 pid=251 comm="/usr/libexec/xdg-desktop-portal ")
May 02 05:09:02 ab6aaba04124 gnome-keyring-d[347]: -- main: 1046
May 02 05:09:02 ab6aaba04124 org.freedesktop.secrets[347]: gnome-keyring-daemon: no process capabilities, insecure memory might get used
May 02 05:09:02 ab6aaba04124 gnome-keyring-daemon[347]: couldn't access control socket: /run/user/1000/keyring/control: No such file or directory
May 02 05:09:02 ab6aaba04124 gnome-keyring-d[347]: couldn't access control socket: /run/user/1000/keyring/control: No such file or directory
May 02 05:09:02 ab6aaba04124 dbus-daemon[124]: [session uid=1000 pid=124] Successfully activated service 'org.freedesktop.secrets'
May 02 05:09:02 ab6aaba04124 dbus-daemon[124]: [session uid=1000 pid=124] Successfully activated service 'org.freedesktop.portal.Desktop'
May 02 05:09:02 ab6aaba04124 systemd[109]: Started Portal service.
May 02 05:09:11 ab6aaba04124 systemd[1]: NetworkManager-dispatcher.service: Deactivated successfully.
May 02 05:09:31 ab6aaba04124 systemd[1]: systemd-hostnamed.service: Deactivated successfully.
May 02 05:10:32 ab6aaba04124 systemd[109]: gnome-keyring.service: State 'stop-sigterm' timed out. Killing.
May 02 05:10:32 ab6aaba04124 systemd[109]: gnome-keyring.service: Failed with result 'timeout'.
May 02 05:10:32 ab6aaba04124 systemd[109]: Failed to start Start gnome-keyring for the Secrets Service, and PKCS #11.

So supposedly it exits, but systemd waits, then sends SIGTERM, then SIGKILL:

May 02 05:09:02 ab6aaba04124 gnome-keyring-daemon[309]: -- fork_and_print_environment: exit(0), 680
May 02 05:09:02 ab6aaba04124 gnome-keyring-daemon[321]: -- main: return 0, 1210
May 02 05:10:32 ab6aaba04124 systemd[109]: gnome-keyring.service: State 'stop-sigterm' timed out. Killing.
May 02 05:10:32 ab6aaba04124 systemd[109]: gnome-keyring.service: Failed with result 'timeout'.
May 02 05:10:32 ab6aaba04124 systemd[109]: Failed to start Start gnome-keyring for the Secrets Service, and PKCS #11.

Which makes me think that something blocks the process from exiting. Although I’m not sure if a process can remain after exit() or return from main().

What else can I check?

UPD BTW, when it succeeds it does cleanup_and_exit(), when it doesn’t, it proceeds to the end of main(). Not sure if it tells anything.

Also, w/o pam_gnome_keyring.so it fails even w/ sleep if I’m not mistaken (I need to confirm it). What the PAM module has to do with it? How do they interact? And generally some insights into what are the moving parts and how they interact would probably be of use.

Well, I tried it on recent Debians and it works. Originally I was experimenting on Debian 8:

Debian 8, Docker 18.06.3-ce - It fails. It looks like gnome-keyring-daemon exits, and at the same time like it doesn’t.

Debian 9, Docker 19.03.15 - Can’t use the ubuntu:22.04 image. See here.

Debian 10, Docker 20.10.8 - It succeeds but needs privileged: yes in docker-compose.yml.

Debian 11, Docker 20.10.10 - It succeeds but needs privileged: yes in docker-compose.yml and cgroup v1 (legacy or hybrid mode) on the host.

As such the issue can probably be ignored. Although this “it exits but doesn’t” thing… I’d still like to figure out what’s going on there.

UPD BTW, when it succeeds it does cleanup_and_exit(), when it doesn’t, it proceeds to the end of main(). Not sure if it tells anything.

Right, it doesn’t seem to be detecting the already running service. Or, for some reason it decides to quit immediately (SIGTERM, SIGHUP?).

So supposedly it exits, but systemd waits, then sends SIGTERM, then SIGKILL:

Well, there must be something still running. But it could be the intermediate child, I don’t think it ever printed anything in your debug log.

Not sure, I feel you need a bit more debug printing here to understand what is going on. I would:

  1. Print the arguments passed to the daemon at the start of main()
  2. Print the own pid and return value of every fork() (I have a hard time following the exact process hierarchy, especially as we might have a race with two daemons starting at the same time)
  3. Make sure every exit() in the code prints something.

EDIT: I would really not be surprised if we have a race condition of some sort here.

EDIT2: Hmm, I think we also need an EINTR retry loop for the waitpid.

diff --git a/daemon/gkd-main.c b/daemon/gkd-main.c
index 5a9c58e9..943174bf 100644
--- a/daemon/gkd-main.c
+++ b/daemon/gkd-main.c
@@ -624,7 +624,7 @@ static void
 block_on_fd (int fd)
 {
        unsigned char dummy;
-       read (fd, &dummy, 1);
+       while (read (fd, &dummy, 1) < 0 && errno == EINTR);
 }
 
 static int
@@ -653,7 +653,7 @@ fork_and_print_environment (void)
                        if (pid == -1)
                                exit (1);
 
-                       waitpid (pid, &status, 0);
+                       while ((waitpid (pid, &status, 0) < 0) && errno == EINTR);
                        if (WEXITSTATUS (status) != 0)
                                exit (WEXITSTATUS (status));