moonD4rk/HackBrowserData · error

open session: %w

Error message

open session: %w

What it means

Connected to the Secret Service, but opening the per-call crypto session (org.freedesktop.Secret.Service.OpenSession with a plain DH/AES algorithm) failed. Without a session no secrets can be read or transferred.

Source

Thrown at masterkey/retriever_linux.go:38

// DBusRetriever queries GNOME Keyring / KDE Wallet via D-Bus Secret Service.
type DBusRetriever struct{}

func (r *DBusRetriever) RetrieveKey(hints Hints) ([]byte, error) {
	storage := hints.KeychainLabel
	conn, err := dbus.SessionBus()
	if err != nil {
		return nil, fmt.Errorf("dbus session: %w", err)
	}

	svc, err := keyring.GetSecretService(conn)
	if err != nil {
		return nil, fmt.Errorf("secret service: %w", err)
	}

	session, err := svc.OpenSession()
	if err != nil {
		return nil, fmt.Errorf("open session: %w", err)
	}
	defer session.Close()

	collections, err := svc.GetAllCollections()
	if err != nil {
		return nil, fmt.Errorf("get collections: %w", err)
	}

	for _, col := range collections {
		items, err := col.GetAllItems()
		if err != nil {
			continue
		}
		for _, item := range items {
			label, err := item.GetLabel()
			if err != nil {
				continue
			}

View on GitHub (pinned to 0503d04d7a)

Solutions

1. Restart the keyring daemon: killall gnome-keyring-daemon then log out/in (or gnome-keyring-daemon --start --components=secrets)
2. Re-run the tool — transient daemon states often clear on retry
3. Check audit logs for SELinux/AppArmor denials and add allow rules for the Secret Service interface
4. Test manually with secret-tool (libsecret) to confirm the service can open sessions at all

null

key, err := dbusRetriever.RetrieveKey(hints)
if err != nil && strings.HasPrefix(err.Error(), "open session:") {
    time.Sleep(time.Second) // keyring daemon may be restarting
    key, err = dbusRetriever.RetrieveKey(hints)
    if err != nil { key, _ = posixRetriever.RetrieveKey(hints) }
}

When it happens

Trigger: svc.OpenSession() returns an error: the keyring daemon rejects the session algorithm, the service is in a bad state, or the D-Bus call is rejected (service busy, daemon restarting, SELinux/AppArmor denial).

Common situations: gnome-keyring-daemon mid-restart or wedged after login; hardened MAC policies (SELinux/AppArmor) blocking Secret Service method calls; incompatible/unusual keyring implementations on minimal systems.

Understand the failure class

Background: Database query failed: Internal Server Error 500s wrapping SQL, Prisma, and connection failures — what to check first — this error's family across 16 libraries.

Related errors

• secret service: %w
• dbus session: %w
• get collections: %w
• get secret for %s: %w
• not found in credential store

AI-assisted analysis of moonD4rk/HackBrowserData@0503d04d7a (2026-09-06). Data as JSON: /api/errors/c6795c74cf3696a5. Report an issue: GitHub.