Create "Default keyring" from command line on CentOS 7

Question

I have a CentOS 7.4 machine that I need to start in kiosk mode. There is a touch screen attached to that machine and on boot, google chrome must start in full screen and load a certain web page.

What I did so far was the following:

• installed google chrome 70.x (yum install google-chrome-stable)
• created a 'kiosk' user without a password
• I setup the kiosk user to autologin

• created the following file: /home/kiosk/.config/autostart/chrome-kiosk.desktop which contains (among several lines) the following line:

  Exec=/usr/bin/google-chrome-stable --incognito --kiosk --disable-web-security --user-data-dir=/home/kiosk/Documents/kiosk/tmp/ --test-type file:///home/kiosk/Documents/kiosk/offline.html

When the computer starts, kiosk user automatically logins and chrome starts in full screen loading the offline.html page as I specified in the above config file.

So far so good. Bu the problem is that on first load (after setting kiosk user to autologin) the system tells me that 'an application wants to create a new keyring called "Default keyring"'. Then prompts the user to enter a keyring password.

I got rid of that by following the steps described here: http://ask.xmodulo.com/disable-entering-password-unlock-default-keyring.html. Actually I instructed the user of the machine to perform the steps described there, as I only have ssh access to the machine and I cannot acces the graphical interface.

But what I need to do is to find an automated way to get rid of that keyring stuff. I found plenty of links that describe how to solve this issue but all of them requires access to the graphical interface, but as I said I only have ssh access.

I have a shell script that installs chrome and other packages, creates the kiosk user, adds the /home/kiosk/.config/autostart/chrome-kiosk.desktop config file, etc.. I want to fix the keyring stuff also by command line completely. There are several machines that I will have to run the script on. I don't want to instruct the users to perform the manual steps described in the link above but instead to solve everything from command line.

Is there any way to do that? The security is not an issue as the machines will be some local (offline) machines.

Answer 1

You can create the default keyring with this bash script:

mkdir -p /home/kiosk/.local/share/keyrings/ echo -n "Default_keyring" > /home/kiosk/.local/share/keyrings/default cat > /home/kiosk/.local/share/keyrings/Default_keyring.keyring << EOF [keyring] display-name=Default keyring ctime=0 mtime=0 lock-on-idle=false lock-after=false EOF chmod og= /home/kiosk/.local/share/keyrings/ chmod og= /home/kiosk/.local/share/keyrings/Default_keyring.keyring chown -R kiosk:kiosk /home/kiosk/.local 

This creates the keyring file and a default file which points to it, and correctly sets the owner and permissions. The keyring is created without password protection. When opening Chromium, it no longer prompts to create the keyring.

Answer 2

I do this by:

1. Deploying .desktop files to disable the gnome-keyring services (so: gnome-keyring-pkcs11.desktop, gnome-keyring-secrets.desktop, gnome-keyring-ssh.desktop) to the kiosk user's ~/.config/autostart with the following content:

   [Desktop Entry] Hidden=true 

2. Setting 0700 permissions on /usr/bin/gnome-keyring-daemon so it's only executable by root and not loaded via PAM when the kiosk user logs in.

I'm not sure the first step is completely necessary - perhaps if the services weren't disabled you'd just get errors in logs when they try to connect to the keyring daemon; I haven't tried.

I deploy this using Ansible, but a shell script or similar would work just as well.