Bug 486294 - Better PAM recommendations to distributions (no nologin).
Summary: Better PAM recommendations to distributions (no nologin).
Status: RESOLVED FIXED
Alias: None
Product: plasmashell
Classification: Plasma
Component: Screen locking (other bugs)
Version First Reported In: 6.2.4
Platform: Compiled Sources Linux
: NOR task
Target Milestone: 1.0
Assignee: Plasma Bugs List
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-04-29 12:57 UTC by Gabriel Barros
Modified: 2025-05-30 12:58 UTC (History)
3 users (show)

See Also:
Latest Commit:
Version Fixed/Implemented In:
Sentry Crash Report:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Gabriel Barros 2024-04-29 12:57:12 UTC
following recommendations on https://invent.kde.org/plasma/kscreenlocker/-/merge_requests/163 my distro adopted these files[0] in place of what was being shipped before[1].

One downside of the recommendation is that *unlocking* the desktop is now prevented if there's a shutdown scheduled (or other reason to have the `nologin` file present). because of the line `auth requisite pam_nologin.so`.

It is very frustrating if you get a notification on your lock screen about the system going down in 5min and all you can do is nervously wait to lose your work.

Are there good reasons to have the auth nologin module there? Can we recommend without it? Should we have sample files in this upstream distribution and avoid the communication issues? most packages i've seen just added the recommended text to their packaging script, and now you don't know if they are following upstream or not. Specially now that we cannot build without PAM? (https://bugs.kde.org/show_bug.cgi?id=455303)

--

[0] https://gitlab.archlinux.org/archlinux/packaging/packages/kscreenlocker/-/commit/7fd674f638497ba84e788118d3bbc524691974f0#6d3349510821738885fce1ed921375cb34e361f1

--

[1] https://wiki.archlinux.org/index.php?title=SDDM&oldid=805510#Using_a_fingerprint_reader

```
#/etc/pam.d/kde
auth 			sufficient  	pam_unix.so try_first_pass likeauth nullok
auth 			sufficient  	pam_fprintd.so
```
Comment 1 Gabriel Barros 2024-04-30 14:17:35 UTC Comment hidden (spam)
Comment 2 Gabriel Barros 2024-04-30 15:59:36 UTC Comment hidden (spam)
Comment 3 Nate Graham 2025-05-29 17:11:30 UTC
We have a wiki page now for information like this: https://community.kde.org/Distributions/Packaging_Recommendations

Right now it doesn't have anything about recommended PAM configuration, though. Worth adding.
Comment 5 Antonio Rojas 2025-05-29 19:14:54 UTC
Any reason this is not shipped upstream, like GNOME and SDDM do?
Comment 6 Nate Graham 2025-05-29 19:16:29 UTC
That sounds like a good idea!
Comment 7 Fabian Vogt 2025-05-30 12:58:14 UTC
(In reply to Antonio Rojas from comment #5)
> Any reason this is not shipped upstream, like GNOME and SDDM do?

SDDM no longer ships PAM files: https://github.com/sddm/sddm/pull/1856#issuecomment-1954175820