| Summary: | kscreenlocker fingerprint authentication fails after suspend/resume | ||
|---|---|---|---|
| Product: | [Plasma] plasmashell | Reporter: | willemvanhulle |
| Component: | Screen locking | Assignee: | Plasma Bugs List <plasma-bugs> |
| Status: | RESOLVED WORKSFORME | ||
| Severity: | major | CC: | nate |
| Priority: | NOR | ||
| Version First Reported In: | 6.3.6 | ||
| Target Milestone: | 1.0 | ||
| Platform: | NixOS | ||
| OS: | Linux | ||
| See Also: | https://bugs.kde.org/show_bug.cgi?id=506567 | ||
| Latest Commit: | Version Fixed In: | ||
| Sentry Crash Report: | |||
| Attachments: | fingerprint.nix (almost working NixOS fingerprint configuration) | ||
Thank you for the bug report! However Plasma 6.3.6 no longer receives updates or maintenance from KDE; active versions are 6.4 or newer. Please upgrade to an active version as soon as your distribution makes it available to you. Plasma is a fast-moving project, and bugs in one version are often fixed in the next one. If you need help with Plasma 6.3.6, please contact your distribution, who bears the responsibility of providing help for older releases that are no longer receiving updates from KDE. If you can reproduce the issue after upgrading to an active version, feel free to re-open this bug report. I have tested it in plasmashell 6.4.4 and it still doesnt work. I removed some tweaks and I got it working with a more minimal setup. I will update if it breaks again. It takes a lot of time to debug this. |
Created attachment 184074 [details] fingerprint.nix (almost working NixOS fingerprint configuration) SUMMARY kscreenlocker fails to authenticate using fingerprint (pam_fprintd) after system suspend/resume cycles. PAM module pam_fprintd is not invoked at all after resume, forcing password-only authentication. STEPS TO REPRODUCE 1. Configure fingerprint authentication with pam_fprintd and verify it works with kscreenlocker (see attachment for a configuration for NixOS) 2. Lock the screen and confirm fingerprint authentication works normally 3. Suspend the system (or wait until it suspends automatically) 4. Wait more than a few minutes (it varies) 5. Resume 6. Touch the fingerprint sensor OBSERVED RESULT After resume from suspend: - kscreenlocker UI appears to offer fingerprint authentication - pam_fprintd is never invoked (confirmed via system logs) - Authentication attempts skip directly to pam_unix (password authentication) - Only password authentication works until user session (or kscreenlocker_greet) restart EXPECTED RESULT Fingerprint authentication should continue working after suspend/resume cycles, with pam_fprintd being invoked normally as it was before suspend. SOFTWARE/OS VERSIONS Windows: N/A macOS: N/A Linux/KDE Plasma: NixOS 25.05 KDE Plasma Version: 6.3.6 KDE Frameworks Version: 6.14.0 Qt Version: 6.9.1 ADDITIONAL INFORMATION kscreenlocker seems to establish its PAM session context at startup and does not reinitialize after resume. When fprintd restarts after resume (required for USB device reinitialization), the existing kscreenlocker process retains a stale PAM session that cannot communicate with the restarted fprintd service. System logs show: - Before suspend: kscreenlocker_greet[PID]: pam_fprintd(kde-fingerprint:auth): [normal fingerprint activity] - After resume: kscreenlocker_greet[SAME_PID]: pam_unix(kde-fingerprint:auth): authentication failure (pam_fprintd never called) Workaround: 1. Use password authentication 2. Add a system services that restarts the lockscreen greeter: pkill -TERM kscreenlocker_greet