Hi,

If I understand correctly, since 2.7.0, apps requesting secrets via SecretService have to be authorised to do so, either every time a secret request is issued (Allow Selected) or permanently (Allow All and Future). I understand the value of this feature which strengthens KeepassXC's security.

However, in my case isync uses secret-tool to retrieve the password of my IMAP account, with something along the lines of:

PassCmd "/usr/bin/secret-tool lookup host mail.example.org account joe@example.org"

The issue now is that every run of the mail sync process creates a new secret-tool process so KeypassXC asks interactively for authorisation to deliver the secret. I imagine that the SecretService implementation is designed to save the PID or other fingerprint of a running process and whitelist it and does not have short-lived processes in mind (just a guess, sorry, I haven't looked at the implementation details).

As you can imagine, this is a bit cumbersome. I've set for the time being ConfirmAccessItem=false, however maybe it'd be nice to have more fine grained authorisation rules like: "all requests coming from a process with binary /usr/bin/secret-tool and parent /usr/bin/mbsync are authorised to retrieve secret A". I'm rather happy with ConfirmAccessItem=false as, if I recall correctly, it restores the behaviour of the previous version of KeepassXC however, does my proposal make any sense to you?

Thanks.