Arch Linux User Repository

Does anyone want to co-maintain this package? I am currently having less time and this package is seeing some good development.

@techmanwalker: Hooray - Glad it is sorted!

With regards to your previous bug report at KDE (upsream): Your issue there is that without the kde file on Archlinux, you get an error like this one (I can reproduce it):

kscreenlocker_greet[9241]: pam_warn(kde:auth): function=pam_sm_authenticate … service=[kde]

It keeps trying to authenticate; the screen refreshes and shows a message to the line of "Authentication failed", which you, presumably, interpreted as if something was hitting "Enter" all the time. Nothing is hitting "Enter", the system just can't find a way to handle authentication.

So, for some reason KScreenLocker wants to authenticate directly via PAM, but can't (not without the kde file). This is surprising the upstream dev, pointing at a possible system-wide issue. I reckon that there should be a fallback (or even default in Plasma 6; I haven't delved deeper into this) via systemd-logind. The reason I believe this is that Fedora does not provide a kde file, and things work there anyway presumably.

In any event, all that has nothing to do directly with this package, and should be investigated elsewhere. If I may suggest: Please open an issue about that on the Archlinux forums. Once you know more, you can update the upstream (KDE) bug report. It is now closed for the wrong reason.

Update: Okay, I installed Fedora, and found out it does have a PAM service file kde! After digging around, I found it was installed via the package plasma-workspace. So, the issue is simply that kscreenlocker-git does not provide the kde file. This has been pointed out, and will be fixed soon, we hope!

I might be wrong, so I asked upstream

And anyway you can confirm that with a simple command:

With the official package:

build/kscreenlocker [main●] » tar tf kscreenlocker-6.5.5-1-x86_64.pkg.tar.zst | grep kde
usr/lib/pam.d/kde
usr/lib/pam.d/kde-fingerprint
usr/lib/pam.d/kde-smartcard
usr/share/dbus-1/interfaces/org.kde.screensaver.xml
usr/share/ksmserver/screenlocker/org.kde.passworddialog/
usr/share/ksmserver/screenlocker/org.kde.passworddialog/metadata.desktop

With kscreenlocker-git:

yay/kscreenlocker-git [master●] » tar tf kscreenlocker-git-6.6.80_r1614.g52499937-1-x86_64.pkg.tar.zst | grep kde 
usr/share/dbus-1/interfaces/org.kde.screensaver.xml
usr/share/ksmserver/screenlocker/org.kde.passworddialog/
usr/share/ksmserver/screenlocker/org.kde.passworddialog/metadata.desktop

So the issue turns out to be on kscreenlocker-git not providing the kde PAM file, it's not on your hands to fix it unfortunately so I'll need to head up to the other package maintainer.

And by the way, this is the only thing the official repo kde.pam contains:

#%PAM-1.0

auth       include                     system-local-login

account    include                     system-local-login

password   include                     system-local-login

session    include                     system-local-login

And its install command is just for the kscreenlocker-git maintainer to copy the kde.pam file to its repo and install it with this command at the end of package():

install -Dm644 "$srcdir"/kde.pam "$pkgdir"/usr/lib/pam.d/kde

I will try it right now to test it.

I cleared the override files I created with my suggestion with:

rm -r /etc/pam.d/plasmalogin* /etc/pam.d/kde

Perfect. Now it's broken again.

And then I modify kscreenlocker-git package and apply what I said: create kde.pam on the root repo, add it to sources, add the install line I mentioned in this commend and...

AND YES, TURNS OUT I WAS RIGHT. This indeed fixes the issue the same way the official Arch package do. I'm surprised that not even the main Plasma devs could explain what was happening at the moment.

So in summary, your package can stay as is! You don't need to change anything else. Thank you reeeeally much for finding out that the /usr/lib/pam.d files are actually used so we could find together the proper fix.

As the kde.pam file in official Arch is installed via kscreenlocker, I'll head up to kscreenlocker-git page to leave the fix and ask them to please implement it so this bug finally gets cleared up for once and forever. Would you like to support my suggestion in their page's comments to convince them to do, please?

Again, thank you really much for being so helpful!

@techmanwalker: From what I understand, this PAM service file is provided by the distro for the package kscreenlocker, or, in the case of an AUR package, by the maintainer of the software on the AUR. However, I might be wrong, so I asked upstream. My assumption is based on the fact that Archlinux, Debian, and FreeBSD provide their own kde file.

Do you install kscreenlocker-git via the AUR, or directly from git?

In either way, you would have to make sure that an Archlinux-specific PAM service file kde is provided.

For the package kscreenlocker in Archlinux, you can see that file here.

I left a comment on the AUR page for the kscreenlocker-git package that it might be lacking that file (it is not provided in any event).

If you build it yourself from upstream, you would have to provide this file yourself. I would just use the one as provided by Archlinux for the package in the official repo.

Upstream indicates that using the plasmalogin file would not be recommended.

@peregrinus The source of the issue is that none of the packages (neither this one nor kscreenlocker-git) install the kde PAM file. If that file doesn't exist, is invalid, is empty or doesn't link to anything (I only tested the 1st case so take it with a grain of salt), the issue triggers.

You can reproduce this by installing your package as-is and kscreenlocker-git. You'll see that to kde PAM file is installed and you will trigger this issue.

This broken state is particularly easy to trigger by migrating a stable Plasma install to the -git variants. None of both provide such file, and we enter the broken state.

I'll be happy to provide more testing if needed when I get home, but this is the core cause.

@techmanwalker: From the bug report it turns out that the PAM service kde is installed by KScreenLocker, and not by SDDM.

Would you be able to dig a bit deeper to find the source of the issue you are facing? Is there anything specific in plasmalogin that makes it work, but that is not available in kde? Or anything else? I see the upstream bug report you linked to originally was not really solved - you refer to an issue in this PKGBUILD.

I cannot reproduce the issue you are facing, which makes troubleshooting difficult for me.

Are there any particular issues you see in your logs when this issue occurs?

Hi @techmanwalker,

Happy to explore this with you and find a working solution! Though please don't get upset with me if I want to make sure we are making useful changes, before applying them.

According to pam.d(5) at the very bottom:

FILES

<snip>

/usr/lib/pam.d
the Linux-PAM vendor configuration directory. Files in /etc/pam.d override files with the same name in this directory.

So, this directory should be sufficient. In fact, I have other PAM files in there (kde, polkit, systemd).

What is probably the issue is that, from the KScreenLocker README.pam that you linked, KScreenLocker ought to be built with the correct PAM service linked, with

-DKSCREENLOCKER_PAM_SERVICE=<service>, and rename is to plasma or whatever Archlinux chooses as the PAM service file name.

I also see that not SDDM, but Archlinux's KScreenLocker itself appears to install that PAM service file (/usr/lib/pam.d/kde.pam). From the PKGBUILD:

package() {
  DESTDIR="$pkgdir" cmake --install build

  install -Dm644 "$srcdir"/kde.pam "$pkgdir"/usr/lib/pam.d/kde
  install -Dm644 "$srcdir"/kde-fingerprint.pam "$pkgdir"/usr/lib/pam.d/kde-fingerprint
  install -Dm644 "$srcdir"/kde-smartcard.pam "$pkgdir"/usr/lib/pam.d/kde-smartcard
}

I filed a bug upstream about this: https://bugs.kde.org/show_bug.cgi?id=515248

I will add the softlink you suggested to the PKGBUILD of this AUR package soon as a temporary workaround.

I hope this helps! Thanks for your input to get this sorted.

Thanks for answering!

Sorry for delayed response. We didn't have electricity for nearly a week.

Trust me, I really get the gripe. No problem.

These are already installed into /usr/lib/pam.d.

And that means they're not used at runtime. The Arch Wiki PAM site doesn't even cite it, exclusively /etc/pam.d just like /usr/lib/X11 files aren't used at runtime. Perhaps you can

for pamfile in "$srcdir/$_pkgname/data/pam/arch/"*; do
  install -Dm644 "$pamfile" "$pkgdir/etc/pam.d/$(basename "$pamfile")"
done

if [[ ! -e "$pkgdir/etc/pam.d/kde" ]]; then
  ln -s plasmalogin "$pkgdir/etc/pam.d/kde"
fi

to fix this issue! I still suggest to pull directly from data/pam instead of $pkgdir to not break if the PKGBUILD gets edited to change the CMAKE_INSTALL_PREFIX.

There is no file $pkgdir/etc/pam.d/kde, so that one does not seem necessary either? I am not sure how this would affect the issue you linked to anyway.

I'll cite exactly why.

From kscreenlocker/README.pam:

A valid PAM service definition must be specified, either by installing files into /etc/pam.d/ or by adding service configuration to /etc/pam.conf.

Either a valid "kde" service must be installed (or copied from the "login" service), or an alternative service must be specified using one of the definitions above. If the service is misconfigured, you will NOT be able to unlock a locked screen!

As the texts reads, the presence of /etc/pam.d/kde by symlinking to plasmalogin (the login manager in use) is critical for the screen locker to work. Otherwise, that bugs that makes it impossible to unlock normally triggers because of what I cited from the repo itself.

Hi @techmanwalker,

Sorry for delayed response. We didn't have electricity for nearly a week.

Regarding pam files: These are already installed into /usr/lib/pam.d.

There is no file $pkgdir/etc/pam.d/kde, so that one does not seem necessary either?

I am not sure how this would affect the issue you linked to anyway.

Please let me know if I am missing anything?