From 1a743d34673ce61966e8a8c876ceb1a8dc6533da Mon Sep 17 00:00:00 2001 From: David Heinemeier Hansson Date: Sat, 21 Feb 2026 15:03:16 +0100 Subject: [PATCH] Prevent password-based SDDM logins from creating an encrypted login keyring --- install/login/sddm.sh | 5 +++++ migrations/1771682500.sh | 10 ++++++++++ 2 files changed, 15 insertions(+) create mode 100644 migrations/1771682500.sh diff --git a/install/login/sddm.sh b/install/login/sddm.sh index 273a6c7b..a0366b3b 100644 --- a/install/login/sddm.sh +++ b/install/login/sddm.sh @@ -14,5 +14,10 @@ Current=omarchy EOF fi +# Prevent password-based SDDM logins from creating an encrypted login keyring +# (which conflicts with the passwordless Default_keyring used for auto-unlock) +sudo sed -i '/-auth.*pam_gnome_keyring\.so/d' /etc/pam.d/sddm +sudo sed -i '/-password.*pam_gnome_keyring\.so/d' /etc/pam.d/sddm + # Don't use chrootable here as --now will cause issues for manual installs sudo systemctl enable sddm.service diff --git a/migrations/1771682500.sh b/migrations/1771682500.sh new file mode 100644 index 00000000..cea2d702 --- /dev/null +++ b/migrations/1771682500.sh @@ -0,0 +1,10 @@ +echo "Prevent SDDM password login from creating encrypted login keyring" + +# Remove the encrypted login keyring if it exists (it conflicts with the passwordless Default_keyring) +rm -f "$HOME/.local/share/keyrings/login.keyring" + +# Remove gnome-keyring auth/password lines from sddm PAM so password-based logins +# don't create an encrypted login keyring. Keep the session line to start the daemon, +# which will auto-unlock the passwordless Default_keyring. +sudo sed -i '/-auth.*pam_gnome_keyring\.so/d' /etc/pam.d/sddm +sudo sed -i '/-password.*pam_gnome_keyring\.so/d' /etc/pam.d/sddm