Backport of the upstream GNOME Keyring Secret Service memory-leak fixes to the
gnome-keyring 46.1 package shipped by Ubuntu 24.04 LTS (noble).
The core leak is already fixed upstream (first released in gnome-keyring 48.beta) but has not been backported to the 46.x line that Ubuntu 24.04 ships. This repository rebuilds the noble package with the fixes applied, for local use on a long-running 24.04 machine. It is also a clean basis for a later Ubuntu SRU (Stable Release Update) submission.
On a long-running Ubuntu 24.04 session the login gnome-keyring-daemon
(--start --components=pkcs11,secrets) grows without bound. Measured on the
affected host: VmRSS reached about 5.0 GB with roughly 9.4 GB committed (about
4.2 GB pushed to swap) over 49 days of uptime, at a rate near 4 MB per hour. The
growth is entirely anonymous heap (a single [heap] region of about 3.9 GB plus
a set of 64 MB glibc arenas); file descriptors and threads stay flat. Left alone
it trends toward swap thrashing and the OOM killer, which is a real risk on a
machine that must stay up.
daemon/dbus/gkd-secret-secret.c:gkd_secret_secret_parse() duplicates the
parameter and value buffers with g_memdup() but never installs a destroy
function. gkd_secret_secret_free() only scrubs those buffers with
egg_secure_clear() (an overwrite, not a free), so both are leaked on every
Secret Service store, unlock, and GetSecret call. The value buffer holds the
encrypted secret payload, so the leak is hundreds of bytes to kilobytes per
call. Frequent callers on a desktop (browser password stores, editor credential
storage, token refresh) drive the steady accumulation.
Full analysis: docs/root-cause.md.
- Upstream: fixed by commit
0d9b247a("daemon: Fix some memory leaks found by asan", merge request !71), first released in gnome-keyring 48.beta and present in 48.0 and 50.0. Not in 46.1 or 46.2. - Ubuntu 24.04: not backported. The archive ships
46.1-2ubuntu0.2, whose distro patches only address first-login secrets-service autounlock. - Later Ubuntu releases already ship a fixed gnome-keyring: 25.04 (48.0), 25.10 (48.0), 26.04 (50.0). Only 24.04 LTS (and the end-of-life 24.10) remain affected.
Three upstream commits, applied on top of the noble package (see patches/ for DEP-3 provenance):
| Patch | Upstream commit | First release | What it fixes |
|---|---|---|---|
| 0001 | 0d9b247a | 48.beta | Core parse() leak of the secret parameter and value buffers |
| 0002 | 2088c2f6 | 48.alpha | Adjacent identifier leaks on error paths (g_autofree) |
| 0003 | 6a6a529e | 48.beta | GckObjectList leak in lock_all() |
Patch 0001 is the fix for the multi-gigabyte growth. Patches 0002 and 0003 close smaller adjacent leaks and are included for completeness. For an upstream SRU submission, 0001 alone is the cleanest first step.
Build the patched packages (does not install or touch the running daemon):
./scripts/build.sh
Install the built packages:
./scripts/install.sh
The fix only takes effect once the daemon is restarted, which also reclaims the leaked memory. That step invalidates open keyring sessions and requires the login keyring to be unlocked again, so it is a separate, manual step:
./scripts/restart-keyring.sh
Observe the effect (read-only by default; --stress drives write traffic):
./scripts/verify-leak.sh
./scripts/verify-leak.sh --stress 20000
See docs/verification.md for the test plan and what to expect.
- This host must never power off and must keep remote access (NoMachine)
enabled. Nothing here reboots the machine or touches remote access; the only
disruptive step is the deliberate daemon restart in
restart-keyring.sh. - The local build uses a version suffix (
+leakfix1) that sorts below a future46.1-2ubuntu0.3, so an official Ubuntu SRU, once it lands, will cleanly supersede this local build. - ssh-agent is not involved; this daemon runs only the pkcs11 and secrets components.
The original scripts and documentation in this repository are licensed under the
MIT License (see LICENSE). The patch files under patches/ are
derived from upstream gnome-keyring and retain its license
(GPL-2.0-or-later / LGPL-2.1-or-later); see NOTICE.