Bug#1151170: gnome-keyring: disconnected Secret Service property reader can abort entire daemon

[Marcio Teixeira]

Package: gnome-keyring
Version: 48.0-1
Severity: normal
Tags: patch

DISCLOSURE OF AUTHORSHIP AND REVIEW STATUS

I am the user of the affected system and the contact for follow-up.

This report, the attached reproducer and the candidate patch were generated
by an AI assistant using Copilot SDK in VS Code. They have NOT been reviewed
by a human. Tests described below were executed by the agent. Authorization
to investigate or submit is not a claim of human technical review. Please
treat the explanation and patch as unreviewed candidates, not an endorsed
upstream fix. The submitter should retain this disclosure when forwarding.

Summary
-------

gnome-keyring-daemon can abort while handling a pending
org.freedesktop.DBus.Properties.Get request from a client which has already
disconnected. A missing per-client record propagates a NULL return without
the GError expected by GDBus, which asserts and terminates the daemon.

This was observed in one real private headless Secret Service instance,
and reproduced with the distribution /usr/bin/gnome-keyring-daemon using
only fictitious data and an isolated D-Bus. The exact client that triggered
the real incident is unknown. Normal polling tests did not reproduce the
failure; the attached test deliberately widens the race window.

Environment actually tested
---------------------------

Debian GNU/Linux forky/sid userspace with mixed testing/unstable
repositories, amd64, WSL2 kernel 6.18.54.1-microsoft-standard-WSL2.
This is not a claim of reproduction on a clean stable Debian installation.
gnome-keyring 48.0-1 (distribution binary)
libglib2.0-0t64 2.90.1-2
libgck-1-0 3.41.2-6+b1
libgcr-base-3-1 3.41.2-6+b1
libgcrypt20 1.12.4-2
dbus 1.16.2-8
systemd 262-1
python3-gi 3.58.0-1, gir1.2-glib-2.0 2.90.1-2

Observed failure
----------------

gkd_secret_service_get_pkcs11_session: assertion 'client' failed
secret_objects_lookup_gck_object_for_path: assertion 'session' failed
GLib-GIO:ERROR:../../../gio/gdbusconnection.c:4765:
invoke_get_property_in_idle_cb: assertion failed: (error != NULL)

The user service exited with signal 6/SIGABRT. Clients lost access to
credentials until the private daemon was started and unlocked again.
No credential disclosure or storage corruption was demonstrated. No real
keyring core dump was inspected or included. This is a service-availability
report, not a claim of remote code execution or a CVE assignment.

Reproduction (attach reproduce-disconnect.py)
-------------------------------------------

Requires /usr/bin/python3 with PyGObject/Gio, dbus-daemon, busctl and the
distribution gnome-keyring-daemon. No root privileges are required.

  /usr/bin/python3 -I -B reproduce-disconnect.py queued --count 3000 \
      --repeat 5 --expect-crash --daemon /usr/bin/gnome-keyring-daemon

The script creates a disposable HOME, storage, control directory and private
bus with no service activation. Core dumps are disabled. It pauses only
its own disposable foreground daemon, sends property reads through clients
which disconnect, resumes it and checks for the exact assertion signature.
All credentials are fictitious. It never uses the user's session bus.

The --expect-crash mode succeeds if at least one repetition observes the
specific SIGABRT signature. The race is nondeterministic: one run without
failure does not establish absence of the bug.

Controls:
  /usr/bin/python3 -I -B reproduce-disconnect.py persistent --count 1000 \
      --daemon /usr/bin/gnome-keyring-daemon
  /usr/bin/python3 -I -B reproduce-disconnect.py busctl --count 500 \
      --daemon /usr/bin/gnome-keyring-daemon

Expected: a disconnected client's pending request should fail or be
discarded without killing the Secret Service.
Actual: the complete daemon can abort.

Source-level explanation (AI analysis, not independently reviewed)
----------------------------------------------------------------

In upstream 48.0 daemon/dbus/gkd-secret-service.c,
service_name_owner_changed removes the disconnected client from the clients
table. A later gkd_secret_service_get_pkcs11_session lookup returns NULL.
In daemon/dbus/gkd-secret-objects.c,
secret_objects_lookup_gck_object_for_path returns early on the missing
session without populating error_out. A collection property getter passes
that NULL result to GLib, which requires an accompanying GError.

Candidate patch (attach 01-disconnected-client.patch)
----------------------------------------------------

The patch treats the missing client as a possible disconnect rather than
a critical assertion and explicitly returns a D-Bus error if the object
lookup cannot get a session, freeing the temporary path identifiers.
It prevents the reproduced daemon abort; it does not redesign client
lifetime handling or claim to solve all Secret Service races.

It applies to the official upstream 48.0 and 51.1 source tarballs.
Upstream archive SHA-256:
48.0: f20518c920e9ea3f9c9b8b44be8c50d8d7feecd0dd5624960f77bd2ca4fbeb9d
51.1: dfe7adc5876ef0670e7eba2907799bdbb8875ce58bb4208e1a52169bd16a47ca

The base 48.0 source was built with Meson 1.12.1, GCC 16.2, using:
  -Dssh-agent=false -Dpam=false -Dsystemd=disabled -Dselinux=disabled
  -Dmanpage=false -Ddebug-mode=false
Only daemon/gnome-keyring-daemon was built for use in isolated tests.
The unpatched rebuilt 48.0 also reproduced the failure.

Patched private build evidence, on the same host:
- 48.0: 10 x 5000 queued reads, no abort; a functional property read and
  collection Lock were checked after every repetition.
- 51.1: 5 x 5000 queued reads, same result. This was an upstream private
  build, not Debian 51.1-3 package testing.
- Eight upstream daemon/D-Bus suites and the secure-memory test executable
  passed in an isolated bus on the patched 48.0 test build, with
  debug-mode=true required for the upstream test hooks.

These are bounded regression results, not exhaustive assurance or an
estimate of daily crash frequency. The private build was subsequently
removed from active use in favour of the distribution binary to avoid
maintaining a downstream daemon. Its patch is supplied for maintainer review.

Related public report (not proof of identical local trigger):
https://github.com/jkoestinger/omarchy-vpn/issues/42

No identical Debian BTS entry was identified in a limited title/web search.
That search is not exhaustive; please merge or redirect if this is a duplicate.
Suggested severity is normal, subject to maintainer triage.


-- 
Marcio Teixeira
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 01-disconnected-client.patch
Type: application/octet-stream
Size: 956 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-gnome-maintainers/attachments/20261017/68fc4589/attachment-0001.obj>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: reproduce-disconnect.py
Type: text/x-python
Size: 10402 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-gnome-maintainers/attachments/20261017/68fc4589/attachment-0001.py>