Errors after stable 2020-08-28 Update | in gdm.service which seem related to PAM changes

kagetora13 · 5 September 2020 04:03

After updating to the stable 2020-08-28 on my Gnome install I noticed the following errors when checking the gdm.service:

systemctl status gdm                                                       
gdm.service - GNOME Display Manager
Loaded: loaded (/usr/lib/systemd/system/gdm.service; enabled; vendor preset: disabled)
Active: active (running) since Fri 2020-09-04 23:13:19 EDT; 1min 18s ago
Main PID: 1159 (gdm)
 Tasks: 3 (limit: 18866)
 Memory: 9.0M
 CGroup: /system.slice/gdm.service
         └─1159 /usr/bin/gdm

Sep 04 23:13:19 hanna systemd[1]: Starting GNOME Display Manager...
Sep 04 23:13:19 hanna systemd[1]: Started GNOME Display Manager.
Sep 04 23:13:29 hanna gdm-fingerprint][3250]: PAM unable to dlopen(/usr/lib/security/pam_tally.so):>
Sep 04 23:13:29 hanna gdm-fingerprint][3250]: PAM adding faulty module: /usr/lib/security/pam_tally>
Sep 04 23:13:29 hanna gdm-fingerprint][3250]: gkr-pam: no password is available for user 
Sep 04 23:13:36 hanna gdm-password][3249]: gkr-pam: unable to locate daemon control file
Sep 04 23:13:36 hanna gdm-password][3249]: gkr-pam: stashed password to try later in open session
Sep 04 23:13:36 hanna gdm-password][3249]: pam_systemd_home(gdm-password:account): systemd-homed is>
Sep 04 23:13:37 hanna gdm-password][3249]: pam_unix(gdm-password:session): session opened for user >
Sep 04 23:13:37 hanna gdm-password][3249]: gkr-pam: gnome-keyring-daemon started properly and unloc>

I did read through the notes of the release where it was mentioned to correct the /etc/pam.d/system-login file. In my case there were no newpac files created. I had a working fingerprint reader in Gnome. I’ve included both my config files if there are suggestions on what to change. Thank you.

/etc/pam.d/system-login

#%PAM-1.0

auth       required   pam_faillock.so
auth       required   pam_shells.so
auth       requisite  pam_nologin.so
auth       include    system-auth

account    required   pam_faillock.so
account    required   pam_access.so
account    required   pam_nologin.so
account    include    system-auth

password   include    system-auth

session    optional   pam_loginuid.so
session    optional   pam_keyinit.so       force revoke
session    include    system-auth
session    optional   pam_motd.so          motd=/etc/motd
session    optional   pam_mail.so          dir=/var/spool/mail standard quiet
session   optional   pam_systemd.so
session    required   pam_env.so           user_readenv=1

/etc/pam.d/gdm-fingerprint

auth     required  pam_tally.so onerr=succeed file=/var/log/faillog
auth     required  pam_shells.so
auth     requisite pam_nologin.so
auth     required  pam_env.so
auth     required  pam_fprintd.so
auth     optional  pam_permit.so
auth     optional  pam_gnome_keyring.so

account  include   system-local-login

password required  pam_fprintd.so
password optional  pam_permit.so

session  optional  pam_keyinit.so force revoke
session  include   system-local-login
session  optional  pam_gnome_keyring.so  auto_start

/etc/pam.d/gdm-password

auth     include   system-local-login
auth     optional  pam_gnome_keyring.so

account  include   system-local-login

password include   system-local-login
password optional  pam_gnome_keyring.so use_authtok

session  optional  pam_keyinit.so force revoke
session  include   system-local-login
session  optional  pam_gnome_keyring.so auto_start

System Configuration

System: Host: N\A Kernel: 4.19.141-2-MANJARO x86_64 bits: 64 compiler: gcc v: 10.2.0
Desktop: GNOME 3.36.5 tk: GTK 3.24.22 wm: gnome-shell dm: GDM 3.34.1
Distro: Manjaro Linux
Machine: Type: Laptop System: LENOVO product: v: ThinkPad T430s

kagetora13 · 7 September 2020 21:29

I’m going to ping this post to see if anyone else has found a solution (plus let Phil know)

@philm

philm · 7 September 2020 22:14

kagetora13:

Sep 04 23:13:29 hanna gdm-fingerprint][3250]: PAM unable to dlopen(/usr/lib/security/pam_tally.so):>
Sep 04 23:13:29 hanna gdm-fingerprint][3250]: PAM adding faulty module: /usr/lib/security/pam_tally>

That is your issue. Needs fixing. Was also posted in the troubleshoots. pacdiff is your friend.

Else you can check for pacmarge.

kagetora13 · 7 September 2020 22:23

Hi Phil,

The thing is after the update there were no pacnew files created in the /etc/pam.d directory. So this is why I posted on the Manjaro forum. I had seen your release notes of the upstream change to pam.d.

So with no pacnew files I did not have anything to merge. Just reviewed your example you gave to another end user.

philm · 7 September 2020 22:28

pam_tally.so is depreciated. So the line can be replaced by pam_faillock.so preauth from pam_tally.so file=/var/log/faillog onerr=succeed

See also here for changes:

Which gdm package do you use anyway?

kagetora13 · 7 September 2020 22:44

Presently I am using “gdm-prime” version “3.36.2-1” which was configured to match the Nvidia Optimus laptops which in my case uses the older Nvidia 390 driver.

Based on your recommendation then my “gdm-fingerprint” file should really be as follows:

/etc/pam.d/gdm-fingerprint

auth     required  pam_shells.so
auth     requisite pam_nologin.so
auth     required  pam_faillock.so preauth

auth     required  pam_env.so
auth     required  pam_fprintd.so  
auth     optional  pam_permit.so
auth     optional  pam_gnome_keyring.so

account  include   system-local-login

password required  pam_fprintd.so
password optional  pam_permit.so

session  optional  pam_keyinit.so force revoke
session  include   system-local-login
session  optional  pam_gnome_keyring.so  auto_start

It seems the only remaining error I see is this:

journalctl -r | grep gkr-pam

Sep 07 19:36:38 hanna gdm-password][1900]: gkr-pam: gnome-keyring-daemon started properly and unlocked keyring
Sep 07 19:36:38 hanna gdm-password][1900]: gkr-pam: stashed password to try later in open session
Sep 07 19:36:38 hanna gdm-password][1900]: gkr-pam: unable to locate daemon control file
Sep 07 19:36:32 hanna gdm-fingerprint][1901]: gkr-pam: no password is available for user

philm · 7 September 2020 23:03

Please double-check and use the files from revision 6 as you still have some mixture, which is not working!

etc/pam.d/gdm-autologin
etc/pam.d/gdm-fingerprint
etc/pam.d/gdm-launch-environment
etc/pam.d/gdm-password
etc/pam.d/gdm-smartcard

sudo pacman -U http://mirror.easyname.at/manjaro/pool/sync/gdm-3.36.3-6-x86_64.pkg.tar.zst

As some is totally off on your end.

kagetora13 · 8 September 2020 01:39

Hi Phil,

I figured out the problem. On a high level the “gdm-prime” package from the AUR is not compatible with the PAM changes which would have come in the “gdm” 3.36.3-6. One of the configuration files “etc/pam.d/gdm-launch-environment” merged changes prevented the gdm-prime front end from loading.

I would like to suggest we add this to the release notes as gdm-prime has not been updated with the parent gdm package changes.

To fix the issue:

I replaced the ‘gdm-prime’ aur package with the ‘gdm’ Arch package.
This change also fixed the issue of X11 crashing to command line when I choose to log out of my session (where Nvidia Graphics card is disabled in the Thinkpad T430s bios and the Intel 4000 Graphics was being used).

Perhaps when the ‘gdm-prime’ package is updated I can give the Optimus setup a try again.

Note:

I still see this error which I will live with and monitor on future releases:

systemctl status gdm
● gdm.service - GNOME Display Manager
Loaded: loaded (/usr/lib/systemd/system/gdm.service; enabled; vendor preset: disabled)
Active: active (running) since Mon 2020-09-07 21:22:57 EDT; 16min ago
Main PID: 618 (gdm)
Tasks: 3 (limit: 18866)
Memory: 8.7M
CGroup: /system.slice/gdm.service
└─618 /usr/bin/gdm

Sep 07 21:22:57 hanna systemd[1]: Starting GNOME Display Manager…
Sep 07 21:22:57 hanna systemd[1]: Started GNOME Display Manager.
Sep 07 21:23:49 hanna gdm-password][2020]: gkr-pam: unable to locate daemon control file
Sep 07 21:23:49 hanna gdm-password][2020]: gkr-pam: stashed password to try later in open session
Sep 07 21:23:49 hanna gdm-password][2020]: pam_systemd_home(gdm-password:account): systemd-homed is not available: Unit dbus-org.freedesktop.home1.service not found.
Sep 07 21:23:49 hanna gdm-password][2020]: pam_unix(gdm-password:session): session opened for user rsruser(uid=1001) by (uid=0)
Sep 07 21:23:49 hanna gdm-password][2020]: gkr-pam: gnome-keyring-daemon started properly and unlocked keyring

system · 11 September 2020 01:39

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.