Always unlock all libsecret items in Password Manager and OSCrypt

components/os_crypt/libsecret_util_linux.cc

Index: components/os_crypt/libsecret_util_linux.cc
diff --git a/components/os_crypt/libsecret_util_linux.cc b/components/os_crypt/libsecret_util_linux.cc
index 0e01aef05b568286ab28640569543acfbbaff295..358bc1b57afffb2792d81ba15927d8867490939e 100644
--- a/components/os_crypt/libsecret_util_linux.cc
+++ b/components/os_crypt/libsecret_util_linux.cc
@@ -26,8 +26,6 @@ decltype(
 decltype(&::secret_item_load_secret_sync)
     LibsecretLoader::secret_item_load_secret_sync;
 decltype(&::secret_value_unref) LibsecretLoader::secret_value_unref;
-decltype(
-    &::secret_service_lookup_sync) LibsecretLoader::secret_service_lookup_sync;
 
 bool LibsecretLoader::libsecret_loaded_ = false;
 
@@ -42,8 +40,6 @@ const LibsecretLoader::FunctionInfo LibsecretLoader::kFunctions[] = {
      reinterpret_cast<void**>(&secret_password_clear_sync)},
     {"secret_password_store_sync",
      reinterpret_cast<void**>(&secret_password_store_sync)},
-    {"secret_service_lookup_sync",
-     reinterpret_cast<void**>(&secret_service_lookup_sync)},
     {"secret_service_search_sync",
      reinterpret_cast<void**>(&secret_service_search_sync)},
     {"secret_value_get_text", reinterpret_cast<void**>(&secret_value_get_text)},
@@ -102,11 +98,12 @@ bool LibsecretLoader::LibsecretIsAvailable() {
        {nullptr, SECRET_SCHEMA_ATTRIBUTE_STRING}}};
 
   GError* error = nullptr;
-  GList* found =
-      secret_service_search_sync(nullptr,  // default secret service
-                                 &kDummySchema, attrs.Get(), SECRET_SEARCH_ALL,
-                                 nullptr,  // no cancellable ojbect
-                                 &error);
+  GList* found = secret_service_search_sync(
+      nullptr,  // default secret service
+      &kDummySchema, attrs.Get(),
+      static_cast<SecretSearchFlags>(SECRET_SEARCH_ALL | SECRET_SEARCH_UNLOCK),

[vasilii, 2016/10/21 14:10:07]

Will it unlock if nothing is found?
What actually happens when the Keyring is locked? Can you read metadata at
least?

[cfroussios, 2016/10/21 17:56:36]

Search will always return the SecretItems, which individually may or may not be
locked. Metadata isn't protected.

In this particular call unlocking is redundant, because we're expecting no
results. I added this so that I can make it a rule that we always unlock the
stuff that we use. Tests now expect this flag without caring what we're
fetching.

Is there a case where we only need the metadata? I didn't see it.

[vasilii, 2016/10/24 10:41:14]

This method will never unlock anything, we put SECRET_SEARCH_UNLOCK only for
consistency. Is it correct?

[cfroussios, 2016/10/24 11:25:55]

Yes, it's only for consistency. I don't expect any effect here.

[vasilii, 2016/10/24 12:39:35]

Acknowledged.

+      nullptr,  // no cancellable ojbect
+      &error);
   bool success = (error == nullptr);
   if (error)
     g_error_free(error);