Bug#994961: glib2.0: gnome-keyring unable to unlock login keyring on some systems since GLib 2.70.0-1

[Francois Marier]

Source: glib2.0
Version: 2.70.0-1
Severity: important

It looks like Bug #981420 was reintroduced in 2.70.0-1, as foreshadowed by
the 2.66.4-4 changelog entries:

 glib2.0 (2.66.4-4) unstable; urgency=medium
 .
   * d/patches: Update patch series to upstream commit 2.66.4-27-g0051c0635
     - Partially revert security hardening from 2.66.4-2: allow
       DBUS_SESSION_BUS_ADDRESS to be taken from the environment by
       setcap executables (to avoid regressing gnome-keyring) and by
       setgid executables (to avoid regressing msmtp).
       (Closes: #981420, #981555)
       Note that this is likely to be reverted in GLib 2.70.x to provide
       better hardening. The D-Bus session bus is not designed to be used
       by processes that have elevated privileges.

I am no longer able to start gnome-keyring-daemon:

  $ gnome-keyring-daemon -r
  ** Message: 14:57:35.890: couldn't connect to dbus session bus: Cannot spawn a message bus when setuid
  ** Message: 14:57:35.890: Replacing daemon, using directory: /run/user/1000/keyring
  GNOME_KEYRING_CONTROL=/run/user/1000/keyring
  SSH_AUTH_SOCK=/run/user/1000/keyring/ssh

gnome-keyring-daemon itself isn't SETUID:

  $ ls -l /usr/bin/gnome-keyring-daemon
  -rwxr-xr-x 1 root root 1.1M Aug 21 04:43 /usr/bin/gnome-keyring-daemon*
  
  $ sudo getcap /usr/bin/gnome-keyring-daemon
  /usr/bin/gnome-keyring-daemon cap_ipc_lock=ep

I do have the dbus-user-session package installed.

Francois

-- System Information:
Debian Release: bookworm/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 5.10.0-8-amd64 (SMP w/4 CPU threads)
Kernel taint flags: TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=fr_CA.utf8, LC_CTYPE=fr_CA.utf8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled