1

I'm trying to implement a systemd hook (systemd-sleep) to connect and disconnect from protonvpn. However, these scripts are executed as root and do not have access to the keyring. The backend is kwallet, since I am on fedora-kde plasma. When I execute protonvpn-cli c --sc, I get the following error:

[...] keyring_data_user = ExecutionEnvironment().keyring[ File "/usr/lib/python3.10/site-packages/protonvpn_nm_lib/core/keyring/linuxkeyring.py", line 32, in __getitem__ raise exceptions.KeyringError(e) protonvpn_nm_lib.exceptions.KeyringError: Environment variable DBUS_SESSION_BUS_ADDRESS is unset

I tried several things, none of them worked:

  • run sudo -E -u myuser protonvpn-cli c --sc, or replacing -E by -i, or none.
  • importing the DBUS session of myuser (who is currently logged ir and has kwallet opened). In this case, I get the error [...] bus = secretstorage.dbus_init() File "/usr/lib/python3.10/site-packages/secretstorage/__init__.py", line 80, in dbus_init raise SecretServiceNotAvailableException(str(ex)) from ex secretstorage.exceptions.SecretServiceNotAvailableException: [Errno 32] Broken pipe
  • I tried systemd --user services, but I've found no way to link this service to the suspend.target, or hibernate.target, since they are system targets and are executed on separate process.

Is there a way give access the an already opened kwallet to this hook script?

crapula
  • 61
  • 4
  • This cannot work reliably in general, as the systemd hook can (and will) be executed when no user is logged in and hence no session bus is running and the user’s keyring is not unlocked. You either need to make the systemd hook execute inside the user session (using `systemd --user`) or set the VPN up system-wide and store the credentials outside the user session. – Philip Withnall Jun 09 '22 at 09:52
  • Thank you @philip-withnall for your comment. I already tried creating a couple of systemd --user services (to disconnect and connect back). I just edited my post to mention this. The problem is that I could not tie them to suspend because suspend.target is a system level service. I've heard about a workaround that consist in creating user services for suspend, but it felt a bit too complex, and I thought there may be a more canonical way of doing this. – crapula Jun 09 '22 at 12:13

0 Answers0