If you use fingerprint login on GDM, you’ve probably run into this: it unlocks your session but GNOME Keyring stays locked, because fprint only returns a yes/no, not your password. So every app that needs the keyring pops up a separate password prompt, or people just disable the keyring lock entirely and store secrets in plaintext.
I wrote a small PAM module that avoids both of those. Instead of storing the keyring password anywhere in the open, it seals it inside the TPM and binds the seal to your current Secure Boot state. The password only comes back out if the boot chain matches what it was sealed against, so fingerprint login unlocks the keyring the same way password login always did, without a second prompt and without a plaintext secret sitting on disk.
Requirements: TPM 2.0 with a resource manager available at /dev/tpmrm0, Secure Boot enabled, and GDM. It’s tested on Fedora, Ubuntu and Debian, x86_64 and aarch64. It won’t help on KDE/KWallet setups or machines without Secure Boot, since the whole point is tying the seal to that boot state.
Install and setup instructions are in the repo
I’ve been running this on my own setup for a while now, but I’d like more eyes on it from people with different distro/kernel/BIOS combos, especially anyone who just got a 13 Pro and is doing a fresh install. If something breaks or the TPM sealing behaves differently on your hardware, open an issue, that’s exactly the kind of feedback that’s useful at this stage.