Keyring isn't suid on nixos

Okay, I somehow solved it partially:

I had my keys in different Vaults (other than the default) and interpreted "Open and unlock 1Password, then navigate to your Personal or Private vault." with any private vault otherwise I would have expected the hint with only Personal/Default Vault :)

Now as I moved my keys to Personal I can see them all with ssh-add -L but when I try to connect:


❯ ssh root@vmh01.XXX.de
sign_and_send_pubkey: signing failed for ED25519 "XXX SSH-Key" from agent: agent refused operation
root@vmh01.XXX.de: Permission denied (publickey).


I guess it's related to the other issues where system authentication is not working (maybe polkit?) I will try to look into this :)

I have the full experience working ;) With some (motivational) help, keeping me on track, I got down into the deepness of polkit-debugging (https://wiki.archlinux.org/title/Polkit#Debugging/logging).

As the SSH-Auth relays on system-authentication (and so on polkit) it was really helpful for me while debugging, so I didn't had to lock/unlock my vault again for testing over and over. (just for anyone following me on the path)

1. SSH-Keys in non Standard/Personal-Vault
   Please make some hints in SSH-Key type Items in the App -> in such Vaults that they will not work. Having it in the docs is nice but as it could be interpreted different (see above - maybe my fault) this would be an improvement I guess. I hope in the long-term all non-shared (first) and later even shared (maybe keys shared without ability to download/view them for teams? ;)) Vaults are possible.

2. export SSH_AUTH_SOCK=~/.1password/agent.sock
   It help's a lot seeing/debugging the content of the keyring - for me it's part of "setup your system with 1password as ssh-auth-provider" so it would be in the snippet/getting started in the app (like the .ssh/config-thing) then in the docs (additional docs - again I love it)

3. Debugging further

with journalctl -feu polkit.service and


security.polkit = {
enable = true;
extraConfig = ''
polkit.addRule(function(action, subject) {
polkit.log("action=" + action);
polkit.log("subject=" + subject);
});
'';
}


and ssh -v root@XXX.XXX.de I was able to see in the journalctl related actions popping up. I was curios and adapted something I've seen on the ArchWiki page with the debug-output and I got it working the first time but with a hardcoded wildcard on the action:

```
security.polkit = {
enable = true;
extraConfig = ''
polkit.addRule(function(action, subject) {
polkit.log("action=" + action);
polkit.log("subject=" + subject);
});

    if (action.id == "com.1password.1Password.authorizeSshAgent") { 
        return polkit.Result.YES;
    }
'';

}
```
DONT USE THIS IT COMPROMISE YOUR SECURITY

1. Conclusion and solution

From then on I knew that there is something in my environment missing, what's prompting me for authorization when such a polkit action/event occurred. Originally searching for something like polkit-explorer-git (earlier) I saw the package polkit_gnome. Then I had some luck that one of my colleges also using i3wm had already implemented polkit_gnome in his config as systemd user-service in nixos:


systemd = {
user.services.polkit-gnome-authentication-agent-1 = {
description = "polkit-gnome-authentication-agent-1";
wants = [ "graphical-session.target" ];
wantedBy = [ "graphical-session.target" ];
after = [ "graphical-session.target" ];
serviceConfig = {
Type = "simple";
ExecStart = "${pkgs.polkit_gnome}/libexec/polkit-gnome-authentication-agent-1";
Restart = "on-failure";
RestartSec = 1;
TimeoutStopSec = 10;
};
};
};


For me personally it's more a user-managed thing so I moved it to my home-manager config, it works fine and the service-definition looks like this:

```
systemd.user.services = {
polkit-gnome-authentication-agent-1 = {
Unit = {
After = [ "graphical-session-pre.target" ];
Description = "polkit-gnome-authentication-agent-1";
PartOf = [ "graphical-session.target" ];
};

Service = {
  ExecStart = "${pkgs.polkit_gnome}/libexec/polkit-gnome-authentication-agent-1";
  Restart = "on-failure";
  RestartSec = 1;
  TimeoutStopSec = 10;
  Type = "simple";
};

Install = {
  WantedBy = [ "graphical-session.target" ];
};

};
};
```

I hope I can give something back to others in the community with this (maybe too detailed) trip-report with polkit these days ;)

Best Regards

Wow, @SebTM thank you for this writeup! There's a lot in here for me to absorb and digest.

Hey @Savanni, I'm pleased to help :)

Something to add up:

I'm currently trying to re-automate my backup-workflow (Vorta => Borg), to be not disrupted for every backup (currently hourly). I got it working to use "polkit.lookup" to get the "polkit.message" but somehow it's an issue to work with the (string?) result (of action.lookup) non of the documented javascript-functions is working:


polkit.log(action.lookup("polkit.message").indexOf("python"));
polkit.log(action.lookup("polkit.message").includes("python"));
polkit.log(action.lookup("polkit.message").search(/python/));
polkit.log((/python/.test(action.lookup("polkit.message")));


Polkit seems to segfault (with each of this approaches - single tested):

polkit.service: Main process exited, code=dumped, status=11/SEGV
polkit.service: Failed with result 'core-dump'.


https://gist.github.com/grawity/3886114?permalink_comment_id=4125345#gistcomment-4125345
https://wiki.archlinux.org/title/Polkit
https://www.freedesktop.org/software/polkit/docs/latest/polkit.8.html

It would be very helpful and appreciated if you could add an additional parameter "program" (like shown in the polkit-docs - freedesktop-link above) so the user can easily decide in a rule if he want's to e.g. generally permit the key access.

Currently I can match against the whole text which is kind of ugly:

polkit.addRule(function(action, subject) {
if (
action.id == "com.1password.1Password.authorizeSshAgent"
&& action.lookup("polkit.message") == "1Password is trying to allow \“Vorta\” to use the key \“Backup SSH-Key\” for SSH"
&& subject.isInGroup("auto-backup")
) {
polkit.log("Sucess Rule: \"Backup XXX\"");
return polkit.Result.YES;
}
});

and in case of the timed (automated) backup will break after each python-upgrade:

1Password is trying to allow “/nix/store/9px00aaqzb6n5p03i9wd8rx3msg95y9r-python3-3.9.11/bin/python3.9” to use the key “Personal SSH-Key” for SSH

(Would be cool if this/another value could be stripped from the path)

Best Wishes :v:

• Post edited by staff to remove possible sensitive information.

A followup after random finding: Something GUI/pinentry-based like would be very nice ;) - https://github.com/StanfordSNR/guardian-agent

Hey @Savanni,

did you have time to look into (https://1password.community/discussion/comment/635755/#Comment_635755) again/forward the request to the PO/Devs as suggestion/feature request? :)

Best Wishes

Hey @Savanni,

did you have time to look into ( https://1password.community/discussion/comment/635755/#Comment_635755 ) again/forward the request as suggestion/feature request? :)

Best Wishes

small reminder ;)

Ping?

Just wanted to express my gratitude for 1Password being available on NixOS, with browser support, which I did not expect at all tbh. You guys are awesome :)

For people new to NixOS like me arriving at this topic:

Install 1password as a system package using https://search.nixos.org/options?channel=22.11&show=programs._1password-gui.enable&from=0&size=50&sort=relevance&type=packages&query=1password. One can set the package to the beta version if desired (just add '-beta'). With just that, browser support already works (I did a reboot, not sure if that's required).

Keep up the great work!