How to replace Gnome keyring with KeepassXC as secret service?

Please double check this, since it is the default.

If it is started this early, it is not so simple. A systemd service is a good idea, but not a system service. I would try a user service. dbus-monitor needs to run as your user in this environment, since you need to to monitor your session.
Also Pipes and redirects wont work directly in ExecStart= . You need to use a Bash process or even better don’t redirect, everything will be saved in the journal anyway. If you need a file, you might want to use something like StandardOutput=file:/home/user/dbus-monitor.log
https://www.freedesktop.org/software/systemd/man/systemd.exec.html#StandardOutput=

I did not tried this, maybe it wont work. An alternative would be to removed the 3 dbus service files that Gnome-Keyring installs.

I’m not sure how Gnome stores my Wifi passwords.
I just did the following:

  • “Forget” my Wifi AP (so that it asks me for a password again when I try to connect)
  • Kill the Gnome keyring process and verify it’s not running.
  • Connect to my Wifi AP and enter the password.
  • Verify that the Gnome keyring process is still not running.
  • Check if the password has been saved by disconnecting from the AP again and connecting again

And indeed the password for my Wifi AP is saved… somewhere, but I don’t think it’s in Gnome keyring because it is not even running.

Is it safe to remove dbus service files? Who is responsible for starting these services? Is dbus just automatically reading all files from that directory and executing all the services or could there be another program explicitly trying to run these services potentially crashing in the process? :thinking:

As a workaround/test, just disable gnome-keyring:

sudo systemctl disable --now gnome-keyring
systemctl disable --now --user gnome-keyring

And then to stop them from running again:

sudo systemctl mask gnome-keyring
systemctl mask --user user gnome-keyring

And you should be able to reboot and theoretically it shouldn’t be running anymore.

After setting the wifi passwords to only be accessible to my user, Gnome stored them using the secret service (At the moment I had Gnome keyring killed and KeepassXC was the secret service so the password got stored in KeepassXC.)
But this means, that Gnome didn’t store the password in Gnome keyring before… : /

I have already masked the systemd service as mentioned before. Gnome keyring is currently not started by the systemd service, but by a dbus service.

Well, then I suggest you back those files up, reboot and test.

Restore them from the backups if required. (This can even be done from a Live environment if you can access them.)

You can simply check the settings of your Wifi connection in Gnome Setting in the Wifi Tab. If you click on the little gear, a new window opens. Switch to the Security Tab, and click on the little icon in the password box. If you chose “Store the password only for this user”, which is the default, NM will try to store it in your Keyring. I believe there is a fallback if the keyring is not available and can not started thru dbus.
If you choose “Store the password for all users”, it is saved in the connection file in /etc/NetworkManager/system-connections

As save as it can be deleting system files. But I would say it is kind of save, since only the Keyring can not started, after you logged in. However, I also did not thought that GDM fails if you edit the PAM files. :man_shrugging: And of course if some other Gnome part don’t like it, you might get the “Something went wrong” message.

A program that can access the dbus, and ask either for org.freedesktop.impl.portal.Secret or org.freedesktop.secrets or org.gnome.keyring
Only you can try to find this out on your system.

A program ask for one of the three dbus services specifically.