Bug 508567 - kmail akonadi fails to access kwallet and kio due to SELinux
Summary: kmail akonadi fails to access kwallet and kio due to SELinux
Status: REPORTED
Alias: None
Product: kmail2
Classification: Applications
Component: general (other bugs)
Version First Reported In: 6.5.0
Platform: openSUSE Linux
: NOR major
Target Milestone: ---
Assignee: kdepim bugs
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-08-21 17:13 UTC by Christian Hacker
Modified: 2025-08-24 20:44 UTC (History)
1 user (show)

See Also:
Latest Commit:
Version Fixed In:
Sentry Crash Report:


Attachments
screenshot Kde Wallet Manager gui (113.20 KB, image/png)
2025-08-24 20:24 UTC, Christian Hacker
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Christian Hacker 2025-08-21 17:13:02 UTC
2025-08-19a
Kmail: Could not read the password: user rejected wallet access
kf.kio.core: couldn't create worker: "Unknown protocol 'akonadi'."

Before this problem:
Installed all available software updates with zypper dup
openSUSE Tumbleweed 20250818

KDE Plasma Version: 6.4.4
KDE Frameworks Version: 6.17.0
Qt Version: 6.9.1
Kernel Version: 6.16.1-1-default (64-bit)
Graphics Platform: X11
Processors: 22 × Intel® Core™ Ultra 7 155H
Memory: 128 GiB of RAM (125.1 GiB usable)
Graphics Processor: Intel® Arc
Manufacturer: ASUSTeK COMPUTER INC.
Product Name: NUC14RVH-B

Then:
Rebooted the host into Kde Plasma desktop.

The Kde desktop is configured with Kde Wallet Manager to have the Kmail imap accounts passwords saved in the wallet.

Reproduce the problem with:
Log into the Kde desktop.
Open the configured default Kde wallet via the password prompt.
Start Kmail and attempt to synchronize emails from configured imap server accounts; using kwallet.

Attempt to review with:
Open Akonadi Console and enable logging in it. Restart the failed Agent(s).
After this action, for unknown reasons, the problem with kmail akonadi wallet access disappears.

However, the problem does re-appear after a new login into the Kde desktop.

Note:
The Kde Wallet Manager has 3 wallets configured, but only one is actively used, and is the default wallet.
The wallets and their contents have not been changed during or after the recent software updates.

Other information:
The User has 4 Kde Activities configured, with 5 virtual desktops in each.
The Kde desktop has the "Icons-and-Text Task Manager" configured.

## Kde desktop pop-up message Error--KIOExec

    Internal Error
    Please send a full bug report at https://bugs.kde.org
    Akonadi::Exception: No remote identifier specified

## Kde desktop Notifications for the problem

KMail
    <akonadi_resource_name>: Could not connect to the IMAP-server imap.ionos.de.
    Could not read the password: user rejected wallet access

    Resource <akonadi_resource_name> is broken.
    Could not connect to the IMAP-server imap.ionos.de.
    Could not read the password: user rejected wallet access

## Journalctl -f -o short-full

    Tue 2025-08-19 17:22:40 CEST suse8 systemd[1710]: Started KMail - Mail Client.
    Tue 2025-08-19 17:22:41 CEST suse8 akonadiserver[2910]: org.kde.pim.akonadiserver: Subscriber "" disconnected
    Tue 2025-08-19 17:22:41 CEST suse8 akonadiserver[2910]: org.kde.pim.akonadiserver: New notification connection (registered as Akonadi::Server::NotificationSubscriber(0x7fafd8245ff0) )
    Tue 2025-08-19 17:22:41 CEST suse8 akonadiserver[2910]: org.kde.pim.akonadiserver: New notification connection (registered as Akonadi::Server::NotificationSubscriber(0x7fafd82770a0) )

    NOTE Kmail Kwallet akonadi error context:
    Tue 2025-08-19 17:22:41 CEST suse8 kmail[5205]: org.kde.pim.pimcommonactivities: Plasma activities is not running:  1

    Tue 2025-08-19 17:22:41 CEST suse8 akonadiserver[2910]: org.kde.pim.akonadiserver: New notification connection (registered as Akonadi::Server::NotificationSubscriber(0x7fafd8245ff0) )
    Tue 2025-08-19 17:22:41 CEST suse8 akonadiserver[2910]: org.kde.pim.akonadiserver: New notification connection (registered as Akonadi::Server::NotificationSubscriber(0x7fafd819bdc0) )
    Tue 2025-08-19 17:22:41 CEST suse8 akonadiserver[2910]: org.kde.pim.akonadiserver: New notification connection (registered as Akonadi::Server::NotificationSubscriber(0x7fafd82c8340) )
    Tue 2025-08-19 17:22:41 CEST suse8 akonadiserver[2910]: org.kde.pim.akonadiserver: Subscriber "" disconnected
    Tue 2025-08-19 17:22:41 CEST suse8 akonadiserver[2910]: org.kde.pim.akonadiserver: New notification connection (registered as Akonadi::Server::NotificationSubscriber(0x7fafd82808e0) )
    Tue 2025-08-19 17:22:41 CEST suse8 akonadiserver[2910]: org.kde.pim.akonadiserver: New notification connection (registered as Akonadi::Server::NotificationSubscriber(0x7fafd8242f50) )
    Tue 2025-08-19 17:22:41 CEST suse8 akonadiserver[2910]: org.kde.pim.akonadiserver: Subscriber Akonadi::Server::NotificationSubscriber(0x7fafd82770a0) identified as "KMail Kernel ETM - 94388865270912"
    Tue 2025-08-19 17:22:41 CEST suse8 akonadiserver[2910]: org.kde.pim.akonadiserver: Subscriber Akonadi::Server::NotificationSubscriber(0x7fafd8245ff0) identified as "SpecialCollectionsMonitor - 94388865502336"
    Tue 2025-08-19 17:22:41 CEST suse8 akonadiserver[2910]: org.kde.pim.akonadiserver: Subscriber Akonadi::Server::NotificationSubscriber(0x7fafd819bdc0) identified as "MessageListTagMonitor - 94388869200592"
    Tue 2025-08-19 17:22:41 CEST suse8 akonadiserver[2910]: org.kde.pim.akonadiserver: Subscriber Akonadi::Server::NotificationSubscriber(0x7fafd82808e0) identified as "MessageViewerMonitor - 94388861879808"
    Tue 2025-08-19 17:22:41 CEST suse8 akonadiserver[2910]: org.kde.pim.akonadiserver: Subscriber Akonadi::Server::NotificationSubscriber(0x7fafd82808e0) identified as "MessageViewerMonitor - 94388861879808"
    Tue 2025-08-19 17:22:41 CEST suse8 akonadiserver[2910]: org.kde.pim.akonadiserver: Subscriber Akonadi::Server::NotificationSubscriber(0x7fafd8242f50) identified as "TagActionManagerMonitor - 94388867906384"
    Tue 2025-08-19 17:22:41 CEST suse8 kded6[2039]: Registering ":1.117/StatusNotifierItem" to system tray
    Tue 2025-08-19 17:22:41 CEST suse8 akonadiserver[2910]: org.kde.pim.akonadiserver: New notification connection (registered as Akonadi::Server::NotificationSubscriber(0x7fafd8283130) )
    Tue 2025-08-19 17:22:41 CEST suse8 akonadiserver[2910]: org.kde.pim.akonadiserver: Subscriber Akonadi::Server::NotificationSubscriber(0x7fafd8283130) identified as "FilterManagerTagMonitor - 94388880485552"

    NOTE Kmail Kwallet akonadi error context:
    Tue 2025-08-19 17:22:41 CEST suse8 kwalletd6[2428]: kf.wallet.kwalletd: "Item not found"
    Tue 2025-08-19 17:22:41 CEST suse8 kwalletd6[2428]: kf.wallet.kwalletd: "Entry not found, key: 1090011078, folder: mailtransports"
    Tue 2025-08-19 17:22:41 CEST suse8 kmail[5205]: org.kde.pim.mailtransport: We have an error during reading password for 1090011078 "Entry not found"
    Tue 2025-08-19 17:22:42 CEST suse8 kwalletd6[2428]: kf.wallet.kwalletd: "Item not found"

    NOTE Kmail Kwallet akonadi error context:
    Tue 2025-08-19 17:22:42 CEST suse8 kwalletd6[2428]: kf.wallet.kwalletd: "Entry not found, key: 2034185836, folder: mailtransports"
    Tue 2025-08-19 17:22:42 CEST suse8 kmail[5205]: org.kde.pim.mailtransport: We have an error during reading password for 2034185836 "Entry not found"

    NOTE Kmail Kwallet akonadi error context:
    Tue 2025-08-19 17:22:42 CEST suse8 kwalletd6[2428]: kf.wallet.kwalletd: "Item not found"
    Tue 2025-08-19 17:22:42 CEST suse8 kwalletd6[2428]: kf.wallet.kwalletd: "Entry not found, key: 2064882029, folder: mailtransports"
    Tue 2025-08-19 17:22:42 CEST suse8 kmail[5205]: org.kde.pim.mailtransport: We have an error during reading password for 2064882029 "Entry not found"
    Tue 2025-08-19 17:22:42 CEST suse8 akonadiserver[2910]: org.kde.pim.akonadiserver: New notification connection (registered as Akonadi::Server::NotificationSubscriber(0x7fafd82c7b30) )
    Tue 2025-08-19 17:22:42 CEST suse8 akonadiserver[2910]: org.kde.pim.akonadiserver: Subscriber Akonadi::Server::NotificationSubscriber(0x7fafd82c7b30) identified as "MessageListTagCacheMonitor - 140380871871680"
    Tue 2025-08-19 17:22:42 CEST suse8 kmail[5205]: QFont::setPixelSize: Pixel size <= 0 (0)
    Tue 2025-08-19 17:22:42 CEST suse8 kmail[5205]: QFont::setPixelSize: Pixel size <= 0 (0)
    Tue 2025-08-19 17:22:42 CEST suse8 akonadiserver[2910]: org.kde.pim.akonadiserver.search: Executing search "kmail2-421651176-SearchSession"
    Tue 2025-08-19 17:22:42 CEST suse8 akonadiserver[2910]: org.kde.pim.akonadiserver.search: Search  "kmail2-421651176-SearchSession" done (without remote search)

    NOTE Kmail Kwallet akonadi error context:
    Tue 2025-08-19 17:23:13 CEST suse8 systemd[1710]: Starting Fuse interface for KIO...
    Tue 2025-08-19 17:23:13 CEST suse8 systemd[1710]: Started Fuse interface for KIO.
    Tue 2025-08-19 17:23:13 CEST suse8 kio-fuse[5361]: kf.kio.core: couldn't create worker: "Unknown protocol 'akonadi'."

    NOTE Kmail Kwallet akonadi error context:
    Tue 2025-08-19 17:23:13 CEST suse8 systemd[1710]: Started Agent Configuration Dialog.
    Tue 2025-08-19 17:23:13 CEST suse8 kioexec[5367]: kf.kio.core: Protocol Class of url QUrl("akonadi:akonadi_imap_resource_3") , isn't ':local', cancelling job.
    Tue 2025-08-19 17:23:13 CEST suse8 kioworker[5380]: kf.i18n: KLocalizedString: Domain is not set for this string, translation will not work. Please see https://api.kde.org/frameworks/ki18n/html/prg_guide.html msgid: "Protocol name" msgid_plural: "" msgctxt: "@info:shell"
    Tue 2025-08-19 17:23:13 CEST suse8 kioworker[5380]: kf.i18n: KLocalizedString: Domain is not set for this string, translation will not work. Please see https://api.kde.org/frameworks/ki18n/html/prg_guide.html msgid: "Socket name" msgid_plural: "" msgctxt: "@info:shell"
    Tue 2025-08-19 17:23:13 CEST suse8 kioworker[5380]: kf.i18n: KLocalizedString: Domain is not set for this string, translation will not work. Please see https://api.kde.org/frameworks/ki18n/html/prg_guide.html msgid: "Socket name" msgid_plural: "" msgctxt: "@info:shell"

    Tue 2025-08-19 17:23:13 CEST suse8 kioexec[5367]: kf.kio.workers.file: readData() returned -1
    Tue 2025-08-19 17:23:13 CEST suse8 kioexec[5367]: kf.kio.core: Connection::send() called with connection not inited
    Tue 2025-08-19 17:24:14 CEST suse8 systemd[1710]: app-org.kde.akonadi.configdialog@c8cb37fbdb674ed99e8253c6dbfbd198.service: Main process exited, code=exited, status=1/FAILURE
    Tue 2025-08-19 17:24:14 CEST suse8 systemd[1710]: app-org.kde.akonadi.configdialog@c8cb37fbdb674ed99e8253c6dbfbd198.service: Failed with result 'exit-code'.

Bye
Comment 1 michaelk83 2025-08-22 05:40:54 UTC
(In reply to Christian Hacker from comment #0)
> Kmail: Could not read the password: user rejected wallet access

Check your allow/deny lists in KWalletManager.
Might also be related to bug 506158, though less likely.
Comment 2 Christian Hacker 2025-08-24 20:24:39 UTC
Created attachment 184411 [details]
screenshot Kde Wallet Manager gui
Comment 3 Christian Hacker 2025-08-24 20:34:53 UTC
(In reply to michaelk83 from comment #1)
2025-08-24c
Thank you for the hints.
Yes, Opensuse enforces SELinux now.
The following solved this problem for me at this time:
openSUSE Tumbleweed 20250820
kwalletd6 6.17.0-1.1

chris@suse8:~/tmp
$> restorecon -rFv /home/chris
Relabeled /home/chris from system_u:object_r:user_home_dir_t:s0 to unconfined_u:object_r:user_home_dir_t:s0
...
Relabeled /home/chris/.local/share/kwalletd from system_u:object_r:data_home_t:s0 to unconfined_u:object_r:data_home_t:s0

Kmail akonadi wallet access does function ok here now.
I am uncertain about what the design target should be for the selinux security labels.

Regarding the Kde Wallet Manager gui, is it possible that the internal application state is inconsistent?
The gui says for each configured wallet that it is currently closed.
But in the Plasma Panel, the active application icon message says "A wallet is open".

The User did open the default wallet via the gui at login time.
The wallet close behavior is configured to be "when last application stops using it", and "when screensaver starts", only.
So, the gui should display and handle the default wallet as "open".

See the attached image.
Bye
Comment 4 michaelk83 2025-08-24 20:44:40 UTC
(In reply to Christian Hacker from comment #3)

The "closed" wallets may be related to bug 459287.

I don't know if KWallet can do anything about SELinux on its end. I think that's up to user configuration. Maybe just add it to a readme somewhere.