crouton: Required key not available

$ sudo edit-chroot -all
name: debian
encrypted: no
Entering /mnt/stateful_partition/crouton/chroots/debian...
crouton: version 1-20170315143304~master:95589555
release: jessie
architecture: amd64
xmethod: xorg
targets: xfce,x11,xorg,xiwi
host: version 9460.60.0 (Official Build) beta-channel edgar 
kernel: Linux localhost 3.18.0-14582-g2fa17b5c810f #1 SMP PREEMPT Mon Jun 5 16:58:26 PDT 2017 x86_64 GNU/Linux
freon: yes
Not unmounting /mnt/stateful_partition/crouton/chroots/debian as another instance is using it.

Please describe your issue:

When I try to do write (reading is fine) action with Downloads directory, I always got:

$ echo asd > ~/Downloads/test
bash: /home/bblaskov/Downloads/test: Required key not available

Writing outside of Downloads is fine:

$ echo asd > ~/test
$ cat ~/test 
asd

Mounts:

$ mount | grep Downlo
/dev/mmcblk0p1 on /home/bblaskov/Downloads type ext4 (rw,nosuid,nodev,relatime,seclabel,commit=600,data=ordered)

What else can I provide?

About this issue

Original URL
State: closed
Created 7 years ago
Reactions: 1
Comments: 23 (4 by maintainers)

Links to this issue

Issues with Crouton making it less fun to use

Most upvoted comments

The “quick and dirty” fix for this is to comment out the line revoking the key during su -l. The relevant line in /etc/pam.d/su-l should be commented out as below.

# session		optional	pam_keyinit.so force revoke

The point is that Debian/Ubuntu now revokes the keys when doing su -l by default. However, crouton activates the chroot via su -l. Perhaps crouton should be using some other method (schroot or other?) to enter the chroot.

kapilhp on Dec 15, 2019

Thanks for the “quick and dirty” fix. It works great. I agree, not the most elegant, but at least my editor can save to ~/Downloads/ again

Just to be clear for others, one needs to edit the /etc/pam.d/su-l file inside the chroot, and then restart the chroot.

I didn’t have an su-1 file and my su file didn’t have that line so I searched in pam.d and found that it was in /etc/pam.d/sshd. Commented it out there and I can modify files in my ~/Downloads folder from ssh. Thanks a bunch!

edit this was on xenial with the cli-extra chroot.

gmcmicken on Dec 21, 2019

I’d like to mention that on CloudReady v78 and Debian 10 Buster + XFCE both workarounds worked.

That is to say in crosh

shell keyctl link @s @us && keyctl link @s @u sudo startxfce4

works and editing the /edc/pam.d/ files to comment out

# session optional pam_keyinit.so force revoke

Just one method is necessary to get the key in the OS.

goldstar611 on Mar 18, 2020