After update: 'sudo -u <user> secret-tool lookup' times out

I hope this is the right subforum.

I’ve been using the following code in a bash script to retrieve a stored password in order to automatically connect to a VPN:

pw=$(sudo -u <user> secret-tool lookup type <connection-ID> user <username>)

Where <user> is my user name and the other placeholders are metadata of the secret.
Since the last major update (1 week ago or so), the script fails:

secret-tool: Error calling StartServiceByName for org.freedesktop.secrets: Timeout was reached

However, running secret-tool lookup type <connection-ID> user <username> (as <user>) correctly returns the stored password.

Any ideas for what could be wrong?
I found threads like this and that which seem to point to the same issue, but they are years old and I can’t manage to connect the info to my use case …

Thanks in advance!

Appendix: inxi --admin --verbosity=7 --filter --no-host --width

System:
  Kernel: 5.10.68-1-MANJARO x86_64 bits: 64 compiler: gcc v: 11.1.0 
  parameters: BOOT_IMAGE=/boot/vmlinuz-5.10-x86_64 
  root=UUID=72ff51c6-0fc0-406c-9422-c09c3892d71d rw quiet apparmor=1 
  security=apparmor resume=UUID=207af92b-a410-4529-a76b-490aaa74df72 
  udev.log_priority=3 
  Desktop: Xfce 4.16.0 tk: Gtk 3.24.29 info: xfce4-panel wm: xfwm 4.16.1 vt: 7 
  dm: LightDM 1.30.0 Distro: Manjaro Linux base: Arch Linux 
Machine:
  Type: Convertible System: LENOVO product: 80X6 v: Lenovo YOGA 720-13IKB 
  serial: <filter> Chassis: type: 31 v: Lenovo YOGA 720-13IKB serial: <filter> 
  Mobo: LENOVO model: LNVNB161216 v: SDK0J40709 WIN serial: <filter> 
  UEFI: LENOVO v: 1YCN40WW(V2.07) date: 05/25/2018 
Battery:
  ID-1: BAT1 charge: 35.5 Wh (100.0%) condition: 35.5/48.0 Wh (74.0%) 
  volts: 8.6 min: 7.7 model: SIMPLO PABAS0241231 type: Li-ion serial: <filter> 
  status: Full 
  Device-1: hidpp_battery_0 model: Logitech MX Ergo Multi-Device Trackball 
  serial: <filter> charge: 55% (should be ignored) rechargeable: yes 
  status: Discharging 
Memory:
  RAM: total: 7.5 GiB used: 6.45 GiB (86.0%) 
  RAM Report: permissions: Unable to run dmidecode. Root privileges required. 
CPU:
  Info: Dual Core model: Intel Core i7-7500U bits: 64 type: MT MCP 
  arch: Amber/Kaby Lake note: check family: 6 model-id: 8E (142) stepping: 9 
  microcode: EA cache: L2: 4 MiB bogomips: 23209 
  Speed: 3500 MHz min/max: 400/3500 MHz Core speeds (MHz): 1: 3500 2: 3500 
  3: 3500 4: 3500 
  Flags: 3dnowprefetch abm acpi adx aes aperfmperf apic arat arch_perfmon art 
  avx avx2 bmi1 bmi2 bts clflush clflushopt cmov constant_tsc cpuid 
  cpuid_fault cx16 cx8 de ds_cpl dtes64 dtherm dts epb ept ept_ad erms est 
  f16c flexpriority flush_l1d fma fpu fsgsbase fxsr ht hwp hwp_act_window 
  hwp_epp hwp_notify ibpb ibrs ida intel_pt invpcid invpcid_single lahf_lm lm 
  mca mce md_clear mmx monitor movbe mpx msr mtrr nonstop_tsc nopl nx pae pat 
  pbe pcid pclmulqdq pdcm pdpe1gb pebs pge pln pni popcnt pse pse36 pti pts 
  rdrand rdseed rdtscp rep_good sdbg sep smap smep ss ssbd sse sse2 sse4_1 
  sse4_2 ssse3 stibp syscall tm tm2 tpr_shadow tsc tsc_adjust 
  tsc_deadline_timer vme vmx vnmi vpid x2apic xgetbv1 xsave xsavec xsaveopt 
  xsaves xtopology xtpr 
  Vulnerabilities: Type: itlb_multihit status: KVM: VMX disabled 
  Type: l1tf 
  mitigation: PTE Inversion; VMX: conditional cache flushes, SMT vulnerable 
  Type: mds mitigation: Clear CPU buffers; SMT vulnerable 
  Type: meltdown mitigation: PTI 
  Type: spec_store_bypass 
  mitigation: Speculative Store Bypass disabled via prctl and seccomp 
  Type: spectre_v1 
  mitigation: usercopy/swapgs barriers and __user pointer sanitization 
  Type: spectre_v2 mitigation: Full generic retpoline, IBPB: conditional, 
  IBRS_FW, STIBP: conditional, RSB filling 
  Type: srbds mitigation: Microcode 
  Type: tsx_async_abort status: Not affected 
Graphics:
  Device-1: Intel HD Graphics 620 vendor: Lenovo driver: i915 v: kernel 
  bus-ID: 00:02.0 chip-ID: 8086:5916 class-ID: 0300 
  Device-2: IMC Networks EasyCamera type: USB driver: uvcvideo bus-ID: 1-5:3 
  chip-ID: 13d3:5621 class-ID: 0e02 serial: <filter> 
  Display: x11 server: X.Org 1.20.13 compositor: xfwm4 v: 4.16.1 driver: 
  loaded: modesetting alternate: fbdev,vesa display-ID: :0.0 screens: 1 
  Screen-1: 0 s-res: 3600x1083 s-dpi: 96 s-size: 953x287mm (37.5x11.3") 
  s-diag: 995mm (39.2") 
  Monitor-1: eDP-1 res: 1920x1080 hz: 60 dpi: 166 size: 294x165mm (11.6x6.5") 
  diag: 337mm (13.3") 
  Monitor-2: DP-1 res: 1680x1050 hz: 60 dpi: 90 size: 474x297mm (18.7x11.7") 
  diag: 559mm (22") 
  OpenGL: renderer: Mesa Intel HD Graphics 620 (KBL GT2) v: 4.6 Mesa 21.2.2 
  direct render: Yes 
Audio:
  Device-1: Intel Sunrise Point-LP HD Audio vendor: Lenovo 
  driver: snd_hda_intel v: kernel alternate: snd_soc_skl bus-ID: 00:1f.3 
  chip-ID: 8086:9d71 class-ID: 0403 
  Device-2: Texas Instruments PCM2704C stereo audio DAC type: USB 
  driver: hid-generic,snd-usb-audio,usbhid bus-ID: 1-2.1:4 chip-ID: 08bb:27c4 
  class-ID: 0300 
  Sound Server-1: ALSA v: k5.10.68-1-MANJARO running: yes 
  Sound Server-2: JACK v: 1.9.19 running: no 
  Sound Server-3: PulseAudio v: 15.0 running: yes 
  Sound Server-4: PipeWire v: 0.3.37 running: yes 
Network:
  Device-1: Intel Wireless 8265 / 8275 driver: iwlwifi v: kernel port: 4040 
  bus-ID: 3f:00.0 chip-ID: 8086:24fd class-ID: 0280 
  IF: wlp63s0 state: up mac: <filter> 
  IP v4: <filter> type: dynamic noprefixroute scope: global 
  broadcast: <filter> 
  IP v6: <filter> type: dynamic noprefixroute scope: global 
  IP v6: <filter> type: noprefixroute scope: link 
  Device-2: Realtek RTL8153 Gigabit Ethernet Adapter type: USB driver: r8152 
  bus-ID: 2-2.4:3 chip-ID: 0bda:8153 class-ID: 0000 serial: <filter> 
  IF: enp0s20f0u2u4 state: up speed: 1000 Mbps duplex: full mac: <filter> 
  IP v4: <filter> type: dynamic noprefixroute scope: global 
  broadcast: <filter> 
  IP v6: <filter> type: dynamic noprefixroute scope: global 
  IP v6: <filter> type: noprefixroute scope: link 
  IF-ID-1: vpn0 state: down mac: N/A 
  WAN IP: <filter> 
Bluetooth:
  Device-1: Intel Bluetooth wireless interface type: USB driver: btusb v: 0.8 
  bus-ID: 1-7:7 chip-ID: 8087:0a2b class-ID: e001 
  Report: rfkill ID: hci0 rfk-id: 3 state: up address: see --recommends 
Logical:
  Message: No logical block device data found. 
RAID:
  Message: No RAID data found. 
Drives:
  Local Storage: total: 238.47 GiB used: 127.45 GiB (53.4%) 
  SMART Message: Required tool smartctl not installed. Check --recommends 
  ID-1: /dev/nvme0n1 maj-min: 259:0 vendor: Toshiba model: N/A 
  size: 238.47 GiB block-size: physical: 512 B logical: 512 B speed: 31.6 Gb/s 
  lanes: 4 type: SSD serial: <filter> rev: 41025KLA temp: 35.9 C scheme: GPT 
  Message: No optical or floppy data found. 
Partition:
  ID-1: / raw-size: 150.23 GiB size: 146.87 GiB (97.76%) 
  used: 124.69 GiB (84.9%) fs: ext4 dev: /dev/nvme0n1p6 maj-min: 259:6 
  label: N/A uuid: 72ff51c6-0fc0-406c-9422-c09c3892d71d 
  ID-2: /boot/efi raw-size: 260 MiB size: 256 MiB (98.46%) 
  used: 30.9 MiB (12.1%) fs: vfat dev: /dev/nvme0n1p1 maj-min: 259:1 
  label: SYSTEM_DRV uuid: B8EC-990F 
Swap:
  Kernel: swappiness: 60 (default) cache-pressure: 100 (default) 
  ID-1: swap-1 type: partition size: 15.71 GiB used: 2.73 GiB (17.4%) 
  priority: -2 dev: /dev/nvme0n1p7 maj-min: 259:7 label: N/A 
  uuid: 207af92b-a410-4529-a76b-490aaa74df72 
Unmounted:
  ID-1: /dev/nvme0n1p2 maj-min: 259:2 size: 16 MiB fs: <superuser required> 
  label: N/A uuid: N/A 
  ID-2: /dev/nvme0n1p3 maj-min: 259:3 size: 63.86 GiB fs: ntfs label: Windows 
  uuid: 1ADAED6EDAED469B 
  ID-3: /dev/nvme0n1p4 maj-min: 259:4 size: 7.42 GiB fs: ntfs label: LENOVO 
  uuid: CA8E07C68E07AA51 
  ID-4: /dev/nvme0n1p5 maj-min: 259:5 size: 1000 MiB fs: ntfs label: WINRE_DRV 
  uuid: D2F2EF30F2EF180D 
USB:
  Hub-1: 1-0:1 info: Full speed (or root) Hub ports: 12 rev: 2.0 
  speed: 480 Mb/s chip-ID: 1d6b:0002 class-ID: 0900 
  Hub-2: 1-2:2 info: Texas Instruments TUSB8041 4-Port Hub ports: 4 rev: 2.1 
  speed: 480 Mb/s chip-ID: 0451:8142 class-ID: 0900 
  Device-1: 1-2.1:4 info: Texas Instruments PCM2704C stereo audio DAC 
  type: Audio,HID driver: hid-generic,snd-usb-audio,usbhid interfaces: 3 
  rev: 1.1 speed: 12 Mb/s power: 20mA chip-ID: 08bb:27c4 class-ID: 0300 
  Device-2: 1-2.2:6 info: Kingston HyperX Alloy FPS Mechanical Gaming Keyboard 
  type: Keyboard,Mouse,HID driver: hid-generic,usbhid interfaces: 3 rev: 2.0 
  speed: 12 Mb/s power: 500mA chip-ID: 0951:16b7 class-ID: 0301 
  Device-3: 1-5:3 info: IMC Networks EasyCamera type: Video driver: uvcvideo 
  interfaces: 2 rev: 2.0 speed: 480 Mb/s power: 500mA chip-ID: 13d3:5621 
  class-ID: 0e02 serial: <filter> 
  Device-4: 1-6:5 info: Synaptics type: <vendor specific> driver: N/A 
  interfaces: 1 rev: 2.0 speed: 12 Mb/s power: 100mA chip-ID: 06cb:0081 
  class-ID: ff00 serial: <filter> 
  Device-5: 1-7:7 info: Intel Bluetooth wireless interface type: Bluetooth 
  driver: btusb interfaces: 2 rev: 2.0 speed: 12 Mb/s power: 100mA 
  chip-ID: 8087:0a2b class-ID: e001 
  Hub-3: 2-0:1 info: Full speed (or root) Hub ports: 6 rev: 3.0 speed: 5 Gb/s 
  chip-ID: 1d6b:0003 class-ID: 0900 
  Hub-4: 2-2:2 info: Texas Instruments TUSB8041 4-Port Hub ports: 4 rev: 3.0 
  speed: 5 Gb/s chip-ID: 0451:8140 class-ID: 0900 
  Device-1: 2-2.4:3 info: Realtek RTL8153 Gigabit Ethernet Adapter 
  type: Network driver: r8152 interfaces: 1 rev: 3.0 speed: 5 Gb/s 
  power: 256mA chip-ID: 0bda:8153 class-ID: 0000 serial: <filter> 
  Hub-5: 3-0:1 info: Full speed (or root) Hub ports: 2 rev: 2.0 
  speed: 480 Mb/s chip-ID: 1d6b:0002 class-ID: 0900 
  Hub-6: 3-1:2 info: VIA Labs VL813 Hub ports: 4 rev: 2.1 speed: 480 Mb/s 
  chip-ID: 2109:2813 class-ID: 0900 
  Device-1: 3-1.1:3 info: VIA Labs USB 2.0 BILLBOARD type: Billboard 
  driver: N/A interfaces: 1 rev: 2.0 speed: 480 Mb/s power: 100mA 
  chip-ID: 2109:0100 class-ID: 1100 serial: <filter> 
  Hub-7: 4-0:1 info: Full speed (or root) Hub ports: 2 rev: 3.1 speed: 10 Gb/s 
  chip-ID: 1d6b:0003 class-ID: 0900 
  Hub-8: 4-1:2 info: VIA Labs VL813 Hub ports: 4 rev: 3.0 speed: 5 Gb/s 
  chip-ID: 2109:0813 class-ID: 0900 
  Device-1: 4-1.2:3 info: Genesys Logic SD Card Reader and Writer 
  type: Mass Storage driver: usb-storage interfaces: 1 rev: 3.1 speed: 5 Gb/s 
  power: 896mA chip-ID: 05e3:0749 class-ID: 0806 serial: <filter> 
Sensors:
  System Temperatures: cpu: 47.5 C mobo: N/A 
  Fan Speeds (RPM): N/A 
Info:
  Processes: 308 Uptime: 3h 10m wakeups: 9 Init: systemd v: 249 
  tool: systemctl Compilers: gcc: 11.1.0 clang: 12.0.1 Packages: 1816 
  pacman: 1809 lib: 446 flatpak: 0 snap: 7 Shell: Bash v: 5.1.8 
  running-in: xfce4-terminal inxi: 3.3.06 

1 Like

What does:

pw=$(sudo -u user "secret-tool lookup type <connection-ID> user <username>")

do?

:thinking:

Returns sudo: secret-tool lookup <connection-ID> user <username>: command not found

Is the following reproducible?

  1. Create a new secret:
    echo mypassword | secret-tool store --label=testsecret mykey myvalue
  2. Retrieve the secret as yourself:
    secret-tool lookup mykey myvalue
    Returns mypassword
  3. Retrieve the secret as sudo:
    3.1. sudo -u "$USER" "secret-tool lookup mykey myvalue"
    Returns sudo: secret-tool lookup mykey myvalue: command not found
    3.2. sudo -u "$USER" secret-tool lookup mykey myvalue
    (waiting …)
    secret-tool: Error calling StartServiceByName for org.freedesktop.secrets: Timeout was reached

Also:

sudo -u "$USER" "secret-tool"
usage: secret-tool store --label='label' attribute value ...
       secret-tool lookup attribute value ...
       secret-tool clear attribute value ...
       secret-tool search [--all] [--unlock] attribute value ...

But:

sudo -u "$USER" "secret-tool lookup"
sudo: secret-tool lookup: command not found

And:

sudo -u "$USER" secret-tool lookup
secret-tool: must specify attribute and value pairs
usage: secret-tool store --label='label' attribute value ...
       secret-tool lookup attribute value ...
       secret-tool clear attribute value ...
       secret-tool search [--all] [--unlock] attribute value ...

I don’t get it. :grimacing:

A follow-up for the sake of completeness: I worked around this issue by simply packing my VPN connection command and the secret-tool lookup in two different scripts:
vpn_cmd.sh:

sudo openconnect vpn.url.com --user=<user> --passwd-on-stdin

vpn_connect.sh:

pw=$(secret-tool lookup <...>) # Retrieve password
echo "$pw" | vpn_cmd.sh # Pass the secret to the other script

vpn_cmd.sh is added to the list of files in /etc/sudoers that can be run as sudo without password confirmation. Thus, running vpn_connect.sh as non-sudo does the job.

1 Like

This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.