KWallet is no longer unlocked at login. pam_kwallet_init hands the session environment to the PAM-launched ksecretd with `env`, and coreutils 9.12 changed `env` to shell-quote the values it prints. ksecretd therefore stores DBUS_SESSION_BUS_ADDRESS with the quotes inside the value, cannot connect to the session bus, and exits 1 before it ever opens the wallet. STEPS TO REPRODUCE 1. A system with coreutils >= 9.12, SDDM, Plasma/X11, kwallet-pam and ksecretd. 2. Wallet password identical to the login password, so PAM unlocking applies. 3. Log in at SDDM by typing the password. OBSERVED RESULT The wallet stays locked and the first application that wants it shows a password prompt. Nothing is logged: pam_kwallet5 reports success, and pam_kwallet.c:393 closes the daemon's stderr before execve, so the daemon's own diagnosis is discarded. Pointing pam_kwallet5's kwalletd= at a wrapper that gives ksecretd a real stderr shows what it was trying to say: kf.wallet.ksecretd: ksecretd5: client connected kf.wallet.ksecretd: ksecretd5: client disconnected kf.dbusaddons: DBus session bus not found. To circumvent this problem try the following command (with bash): export $(dbus-launch) ksecretd exited status 1 EXPECTED RESULT The wallet is unlocked at login, as it was with coreutils <= 9.11. CAUSE coreutils 9.12 NEWS, "Changes in behavior": 'env' and 'printenv' now quote printed environment variables honoring the QUOTING_STYLE environment variable, defaulting to shell-escape style. /usr/libexec/pam_kwallet_init does: env | socat STDIN UNIX-CONNECT:$PAM_KWALLET5_LOGIN ksecretd's waitForEnvironment() (kwallet 6.30.0, src/runtime/ksecretd/main.cpp:64-95, unchanged on master 4bc1cb00bb) reads that with fgets and putenv's each line verbatim, so values needing shell quoting arrive with the quotes as part of the value: DBUS_SESSION_BUS_ADDRESS='unix:path=/tmp/dbus-XXXXXXXXXX,guid=...' KDBusService then finds no usable session bus and main.cpp exits 1 before pamOpen() is reached. EVIDENCE - `env` prints MINICOM='-c on', while printenv, the shell and `env -0` all give -c on. - Capturing what pam_kwallet_init sent at a real login: 5 quoted values including the bus address, while every running process's own /proc/<pid>/environ had none. - Reproduced away from a real session: launching /usr/bin/ksecretd exactly as PAM does (--pam-login <pipe-fd> <socket-fd>, key down the pipe, environment down the socket) against a private dbus-run-session bus. With the address quoted it exits 1 with the message above; with it unquoted, everything else equal, it stays up and registers org.kde.ksecretd, org.kde.secretservicecompat and org.freedesktop.secrets. - Timing: coreutils 9.12 was installed at 00:06; the first login after it, at 00:17, is the first failure, and every login before that unlocked the wallet. - Fix confirmed at a real login: with QUOTING_STYLE=literal the daemon logs "Wallet opened by PAM" and no prompt appears. SUGGESTED FIX (one line, in pam_kwallet_init) QUOTING_STYLE=literal env | socat STDIN UNIX-CONNECT:$PAM_KWALLET5_LOGIN `env -0` is also unaffected by the coreutils change, but would need ksecretd to read NUL-delimited entries. RELATED ROBUSTNESS ISSUES (independent of coreutils) - pam_kwallet.c:393 closes fd 2 before execve, so the daemon's errors are discarded at login and this failure leaves no trace anywhere on the system. - waitForEnvironment() putenv's every line with no validation, and the handoff protocol has no framing or escaping, so a corrupt value is accepted silently. - A failed KDBusService registration exits 1 without telling PAM or the user, so the wallet just stays locked. - Minor, seen while reading that function: the accepted socket is never closed (only a dup of it is fclosed), and the 1000-byte line buffer splits longer entries such as LS_COLORS into bogus extra variables. SOFTWARE/OS VERSIONS Linux/KDE Plasma: Slackware-current, kernel 6.18.52, X11 session via SDDM 0.21.0 KDE Plasma Version: 6.7.5 KDE Frameworks Version: 6.30.0 (kwallet 6.30.0, kdbusaddons 6.30.0) Qt Version: 6.11.2 kwallet-pam: 6.7.5 coreutils: 9.12 (the trigger; 9.11 is unaffected)
Would you like to submit a merge request to fix it?
Created attachment 196244 [details] attachment-2297880-0.html I didn't before, will try my best ASAP On September 16, 2026 11:45:57 PM GMT+03:00, Nate Graham <bugzilla_noreply@kde.org> wrote: >https://bugs.kde.org/show_bug.cgi?id=525805 > >Nate Graham <nate@kde.org> changed: > > What |Removed |Added >---------------------------------------------------------------------------- > CC| |nate@kde.org > >--- Comment #1 from Nate Graham <nate@kde.org> --- >Would you like to submit a merge request to fix it? > >-- >You are receiving this mail because: >You reported the bug.
A possibly relevant merge request was started @ https://invent.kde.org/plasma/kwallet-pam/-/merge_requests/31
fwiw this is being reverted upstream https://lists.gnu.org/archive/html/coreutils/2026-09/msg00064.html
coreutils has reverted the change upstream (782a1e5bc2: env/printenv only quote when output is a terminal), so once distributions pick that up the plain env works again. MR !31 remains harmless and covers systems already on unpatched coreutils 9.12 (Slackware carries an equivalent patch in kwallet-pam-6.7.5-2). Happy for it to be merged or closed, whichever you prefer.
Thanks, Antonio, for mentioning our revert in coreutils here. I thought I didn't have a bug tracker account here, but I do. We had looked for places where these quoting changes would cause issues using Debian Code Search. Evidently, we missed this one among some others that don’t seem to be packaged by Debian, e.g., a Java Library. Apologies for the issues it caused.
Git commit 469570531a0ce2994dbe211e7f27834b73e868af by Omid Kordbache. Committed on 16/09/2026 at 22:01. Pushed by ngraham into branch 'master'. Pass the environment to ksecretd unquoted with coreutils >= 9.12 Since coreutils 9.12, env and printenv shell-quote the values they print, honouring QUOTING_STYLE and defaulting to shell-escape. pam_kwallet_init pipes env into ksecretd, which putenv()s each line verbatim, so values that need quoting arrive with the quotes inside them. One of them is DBUS_SESSION_BUS_ADDRESS: ksecretd cannot reach the session bus and exits before it unlocks the wallet. Ask env for literal output. Older versions of env ignore QUOTING_STYLE, so their output is unchanged, and -u keeps the variable itself out of the environment handed to ksecretd. Tested on Slackware -current with coreutils 9.12 at a real SDDM login (wallet unlocked, no prompt); env output also compared on coreutils 9.7 and 8.32. M +1 -1 pam_kwallet_init https://invent.kde.org/plasma/kwallet-pam/-/commit/469570531a0ce2994dbe211e7f27834b73e868af
Git commit 06ee5df93e4471c214292a799c07ff8ee68362d8 by Nate Graham. Committed on 26/09/2026 at 02:25. Pushed by ngraham into branch 'Plasma/6.8'. Pass the environment to ksecretd unquoted with coreutils >= 9.12 Since coreutils 9.12, env and printenv shell-quote the values they print, honouring QUOTING_STYLE and defaulting to shell-escape. pam_kwallet_init pipes env into ksecretd, which putenv()s each line verbatim, so values that need quoting arrive with the quotes inside them. One of them is DBUS_SESSION_BUS_ADDRESS: ksecretd cannot reach the session bus and exits before it unlocks the wallet. Ask env for literal output. Older versions of env ignore QUOTING_STYLE, so their output is unchanged, and -u keeps the variable itself out of the environment handed to ksecretd. Tested on Slackware -current with coreutils 9.12 at a real SDDM login (wallet unlocked, no prompt); env output also compared on coreutils 9.7 and 8.32. (cherry picked from commit 469570531a0ce2994dbe211e7f27834b73e868af) Co-authored-by: Omid Kordbache <omid@0mit.com> M +1 -1 pam_kwallet_init https://invent.kde.org/plasma/kwallet-pam/-/commit/06ee5df93e4471c214292a799c07ff8ee68362d8
Git commit 6a2e476dfe2d9498f464c4ae10a522edcc665bee by Nate Graham. Committed on 26/09/2026 at 02:27. Pushed by ngraham into branch 'Plasma/6.7'. Pass the environment to ksecretd unquoted with coreutils >= 9.12 Since coreutils 9.12, env and printenv shell-quote the values they print, honouring QUOTING_STYLE and defaulting to shell-escape. pam_kwallet_init pipes env into ksecretd, which putenv()s each line verbatim, so values that need quoting arrive with the quotes inside them. One of them is DBUS_SESSION_BUS_ADDRESS: ksecretd cannot reach the session bus and exits before it unlocks the wallet. Ask env for literal output. Older versions of env ignore QUOTING_STYLE, so their output is unchanged, and -u keeps the variable itself out of the environment handed to ksecretd. Tested on Slackware -current with coreutils 9.12 at a real SDDM login (wallet unlocked, no prompt); env output also compared on coreutils 9.7 and 8.32. (cherry picked from commit 469570531a0ce2994dbe211e7f27834b73e868af) Co-authored-by: Omid Kordbache <omid@0mit.com> M +1 -1 pam_kwallet_init https://invent.kde.org/plasma/kwallet-pam/-/commit/6a2e476dfe2d9498f464c4ae10a522edcc665bee