pam_ecryptfs: seteuid error

[Thomas Hood]

I get this error message in the syslog when I authenticate succesfully in the screensaver.

---
ApportVersion: 2.6.1-0ubuntu6
Architecture: amd64
DistroRelease: Ubuntu 12.10
EcryptfsInUse: Yes
GnomeSessionIdleInhibited: No
GnomeSessionInhibitors: None
GsettingsGnomeSession:
 org.gnome.desktop.session idle-delay uint32 600
 org.gnome.desktop.session session-name 'ubuntu'
InstallationDate: Installed on 2012-06-13 (172 days ago)
InstallationMedia: Ubuntu 12.04 LTS "Precise Pangolin" - Release amd64 (20120425)
MarkForUpload: True
Package: gnome-screensaver 3.6.0-0ubuntu2
PackageArchitecture: amd64
ProcEnviron:
 TERM=xterm
 PATH=(custom, no user)
 XDG_RUNTIME_DIR=<set>
 LANG=en_US.UTF-8
 SHELL=/bin/bash
ProcVersionSignature: Ubuntu 3.5.0-19.30-generic 3.5.7
Tags: quantal running-unity
Uname: Linux 3.5.0-19-generic x86_64
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups: adm cdrom dip lpadmin plugdev sambashare sudo

[Thomas Hood (jdthood)]

apport information

[Thomas Hood (jdthood)]

apport information

[Thomas Hood (jdthood)]

apport information

[Thomas Hood (jdthood)]

apport information

[Thomas Hood (jdthood)]

apport information

[Thomas Hood (jdthood)]

apport information

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[tekstr1der (tekstr1der)]

Seeing this on Debian Wheezy as well.

Have you filed a bug upstream with Gnome yet?

[Thomas Hood (jdthood)]

> Have you filed a bug upstream with Gnome yet?

Nope.

[Georg Peters (georgpeters)]

Anything new on this?

[Georg Peters (georgpeters)]

I'm on Linux Mint 14 - having the same issue

[Thaddaeus Tintenfisch (thad-fisch-deactivatedaccount)]

xscreensaver: pam_ecryptfs: seteuid error

XScreenSaver is affected too.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Tormod Volden (tormodvolden)]

I belive this is due to pam_ecryptfs and nothing in the screensaver packages.

[Adam Funk (a-funk)]

I'm getting this with xscreensaver too.

[Harry P (hjwp2)]

+1

[hammarlind (mikael-hammarlind-gmail)]

Den 28 apr 2013 13:31 skrev "Thaddäus Tintenfisch" <email address hidden>:

> ** Project changed: gnome-screensaver => ecryptfs
>
> ** Tags added: raring
>
> --
> You received this bug notification because you are subscribed to gnome-
> screensaver in Ubuntu.
> https://bugs.launchpad.net/bugs/1085706
>
> Title:
> gnome-screensaver-dialog: pam_ecryptfs: seteuid error
>
> Status in eCryptfs:
> New
> Status in “ecryptfs-utils” package in Ubuntu:
> Confirmed
> Status in “gnome-screensaver” package in Ubuntu:
> Confirmed
>
> Bug description:
> I get this error message in the syslog when I authenticate succesfully
> in the screensaver.
>
> ---
> ApportVersion: 2.6.1-0ubuntu6
> Architecture: amd64
> DistroRelease: Ubuntu 12.10
> EcryptfsInUse: Yes
> GnomeSessionIdleInhibited: No
> GnomeSessionInhibitors: None
> GsettingsGnomeSession:
> org.gnome.desktop.session idle-delay uint32 600
> org.gnome.desktop.session session-name 'ubuntu'
> InstallationDate: Installed on 2012-06-13 (172 days ago)
> InstallationMedia: Ubuntu 12.04 LTS "Precise Pangolin" - Release amd64
> (20120425)
> MarkForUpload: True
> Package: gnome-screensaver 3.6.0-0ubuntu2
> PackageArchitecture: amd64
> ProcEnviron:
> TERM=xterm
> PATH=(custom, no user)
> XDG_RUNTIME_DIR=<set>
> LANG=en_US.UTF-8
> SHELL=/bin/bash
> ProcVersionSignature: Ubuntu 3.5.0-19.30-generic 3.5.7
> Tags: quantal running-unity
> Uname: Linux 3.5.0-19-generic x86_64
> UpgradeStatus: No upgrade log present (probably fresh install)
> UserGroups: adm cdrom dip lpadmin plugdev sambashare sudo
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/ecryptfs/+bug/1085706/+subscriptions
>

[Alberto Salvia Novella (es20490446e)]

Please, can anyone please report this bug upstream? (https://wiki.ubuntu.com/Bugs/HowToTriage#Forwarding_upstream)

[tekstr1der (tekstr1der)]

pam_ecryptfs: seteuid error occurs when authenticating various screen lockers.

i3lock on arch linux and xscreensaver on debian are affected as well in addition to the many reports agains gnome-screensaver.

[Josh Hill (ingenium)]

I can confirm this is still happening on Ubuntu 14.04

[Alberto Salvia Novella (es20490446e)]

@Josh Hill:

For confirming that a bug is affecting a new release, just add its name in the tags list under the bug description.

Thank you.

[Guy (guy-b)]

On Bodhi linux 3 to (ubuntu 14.04.2 based), but in distro tag the distribution is not listed. The reason why this post.

[Laurent Bonnaud (laurent-bonnaud)]

Here is the error message I see in Kubuntu 15.10:

kcheckpass[20111]: pam_ecryptfs: seteuid error

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[dusoft (dusoft-staznosti)]

I confirm for Kubuntu / KDE:
Distributor ID: Ubuntu
Description: Ubuntu 14.04.3 LTS
Release: 14.04
Codename: trusty

Nov 24 15:01:13 xxxxx kcheckpass[10401]: pam_ecryptfs: seteuid error
Nov 24 15:01:13 xxxxx unix_chkpwd[10402]: check pass; user unknown
Nov 24 15:01:13 xxxxx unix_chkpwd[10403]: check pass; user unknown
Nov 24 15:01:13 xxxxx unix_chkpwd[10403]: password check failed for user (xxxxx)
Nov 24 15:01:13 xxxxx kcheckpass[10401]: pam_unix(kdm:auth): authentication failure; logname=xxxxx uid=1000 euid=1000 tty=:0 ruser= rhost= user=xxxxx
Nov 24 15:01:13 xxxxx kcheckpass[10401]: pam_winbind(kdm:auth): getting password (0x00000388)
Nov 24 15:01:13 xxxxx kcheckpass[10401]: pam_winbind(kdm:auth): pam_get_item returned a password
Nov 24 15:01:13 xxxxx kcheckpass[10401]: pam_winbind(kdm:auth): request wbcLogonUser failed: WBC_ERR_AUTH_ERROR, PAM error: PAM_USER_UNKNOWN (10), NTSTATUS: NT_STATUS_NO_SUCH_USER, Error message was: No such user
Nov 24 15:01:13 xxxxx kcheckpass[10401]: Authentication failure for xxxxx (invoked by uid 1000)
Nov 24 15:01:19 xxxxx login[1915]: pam_ecryptfs: pam_sm_authenticate: /home/xxxxx is already mounted
Nov 24 15:01:20 xxxxx login[1915]: pam_unix(login:session): session opened for user xxxxx by LOGIN(uid=0)
Nov 24 15:01:20 xxxxx systemd-logind[925]: New session c4 of user xxxxx.
Nov 24 15:02:12 xxxxx kcheckpass[10535]: pam_ecryptfs: seteuid error
Nov 24 15:02:12 xxxxx unix_chkpwd[10536]: check pass; user unknown
Nov 24 15:02:12 xxxxx unix_chkpwd[10537]: check pass; user unknown
Nov 24 15:02:12 xxxxx unix_chkpwd[10537]: password check failed for user (xxxxx)
Nov 24 15:02:12 xxxxx kcheckpass[10535]: pam_unix(kdm:auth): authentication failure; logname=xxxxx uid=1000 euid=1000 tty=:0 ruser= rhost= user=xxxxx
Nov 24 15:02:12 xxxxx kcheckpass[10535]: pam_winbind(kdm:auth): getting password (0x00000388)
Nov 24 15:02:12 xxxxx kcheckpass[10535]: pam_winbind(kdm:auth): pam_get_item returned a password
Nov 24 15:02:12 xxxxx kcheckpass[10535]: pam_winbind(kdm:auth): request wbcLogonUser failed: WBC_ERR_AUTH_ERROR, PAM error: PAM_USER_UNKNOWN (10), NTSTATUS: NT_STATUS_NO_SUCH_USER, Error message was: No such user
Nov 24 15:02:12 xxxxx kcheckpass[10535]: Authentication failure for xxxxx (invoked by uid 1000)
Nov 24 15:02:18 xxxxx kcheckpass[10543]: pam_ecryptfs: seteuid error
Nov 24 15:02:18 xxxxx unix_chkpwd[10544]: check pass; user unknown
Nov 24 15:02:18 xxxxx unix_chkpwd[10545]: check pass; user unknown
Nov 24 15:02:18 xxxxx unix_chkpwd[10545]: password check failed for user (xxxxx)
Nov 24 15:02:18 xxxxx kcheckpass[10543]: pam_unix(kdm:auth): authentication failure; logname=xxxxx uid=1000 euid=1000 tty=:0 ruser= rhost= user=xxxxx
Nov 24 15:02:18 xxxxx kcheckpass[10543]: pam_winbind(kdm:auth): getting password (0x00000388)
Nov 24 15:02:18 xxxxx kcheckpass[10543]: pam_winbind(kdm:auth): pam_get_item returned a password
Nov 24 15:02:18 xxxxx kcheckpass[10543]: pam_winbind(kdm:auth): request wbcLogonUser failed: WBC_ERR_AUTH_ERROR, PAM error: PAM_USER_UNKNOWN (10), NTSTATUS: NT_STATUS_NO_SUCH_USER, Error message was: No such user
Nov 24 15:02:18 xxxxx kcheckpass[10543]: Authentication failure for xxxxx (in...

[dusoft (dusoft-staznosti)]

This gets solved on Kubuntu 14.04 / KDE by doing:

$ sudo chown root:root /usr/lib/kde4/libexec/kcheckpass
$ sudo chmod 4755 /usr/lib/kde4/libexec/kcheckpass

This bug reappears after every (system?) upgrade (!!!)

See: https://bugs.kde.org/show_bug.cgi?id=300017

[Stuart (stuart-ward)]

when blueproximity issues a gnome-screensaver-command -d to unlock the screen

Mar 10 12:54:55 T420 blueproximity[10821]: screen is unlocked
Mar 10 12:54:55 T420 compiz: pam_ecryptfs: seteuid error

[Rob Moore (roborative)]

lsb-release:
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=16.04
DISTRIB_CODENAME=xenial
DISTRIB_DESCRIPTION="Ubuntu 16.04 LTS"

syslog:
compiz: pam_ecryptfs: seteuid error

[Rob Moore (roborative)]

I meant to note that when this occurs I can no longer access my applications in the Unity bar but can alt-tab and select them to access them. Otherwise, the only means I've found to address this is to log out and back in.

[Phil Clifford (philip-clifford)]

Just noticed this in syslog and found this bug. Seems to be benign on mate for me at any rate.

lsb-release:
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=15.10
DISTRIB_CODENAME=wily
DISTRIB_DESCRIPTION="Ubuntu 15.10"

syslog:
mate-screensaver-dialog: pam_ecryptfs: seteuid error

[ls (litos)]

I've some problem with ecryptfs, after setup this with issue when I unlock my PC

unix_chkpwd[2596]: check pass; user unknown

I've fixed this

# ls -l /etc/shadow
-rw-r----- 1 root root 1096 июля 5 09:49 /etc/shadow

# chgrp shadow /etc/shadow

# ls -l /etc/shadow
-rw-r----- 1 root shadow 1096 июля 5 09:49 /etc/shadow

[Laurent Bonnaud (laurent-bonnaud)]

> -rw-r----- 1 root shadow 1096 июля 5 09:49 /etc/shadow

This is the standard GID on Debian/Ubuntu system.

> -rw-r----- 1 root root 1096 июля 5 09:49 /etc/shadow

That was an anomaly on your system.

[Alexey (alukardd)]

This bug is still affected me in Debian Sid (currently 9.0).
I affected with i3lock.

Sometimes, if wait about 3-4minutes, i3lock allow me to reenter passphrase, but sometimes I have to reboot my laptop...

[PJO (lexicographer)]

Also present in Linux Mint 18.1

[Laurent Bonnaud (laurent-bonnaud)]

This error message is still logged in Ubuntu 16.10 with KDE/plasma:

Mar 01 12:05:16 vougeot kcheckpass[23318]: pam_ecryptfs: seteuid error

and with MATE:

Mar 01 18:32:09 xeelee mate-screensaver-dialog[10367]: pam_ecryptfs: seteuid error

[Massimo Simonini (massiws)]

I get this error in Linux Mint 18.1 with Cinnamon 3.2.7:

May 1 18:58:55 dev-mint18 cinnamon-screensaver-pam-helper: pam_ecryptfs: seteuid error

[Pablo Hörtner (redtux2000)]

BTW: This bug also affects KDE systems, not just Gnome/GTK. When the screen is locked, it always takes some seconds until I am logged in after typing my password.

lsb_release -a
No LSB modules are available.
Distributor ID: neon
Description: KDE neon LTS User Edition 5.8
Release: 16.04
Codename: xenial

apt-cache policy sddm
sddm:
  Installed: 0.14.0-1~2.gbpf70012+16.04+xenial+build2
  Candidate: 0.14.0-1~2.gbpf70012+16.04+xenial+build2
  Version table:
 *** 0.14.0-1~2.gbpf70012+16.04+xenial+build2 500
        500 http://archive.neon.kde.org/user/lts xenial/main amd64 Packages
        100 /var/lib/dpkg/status
     0.14.0-1~2.gbpf70012+16.04+build1 500
        500 http://archive.neon.kde.org/user/lts xenial/main amd64 Packages
     0.13.0-1ubuntu5 500
        500 http://archive.ubuntu.com/ubuntu xenial/universe amd64 Packages

apt-cache policy ecryptfs-utils
ecryptfs-utils:
  Installed: 111-0ubuntu1.1
  Candidate: 111-0ubuntu1.1
  Version table:
 *** 111-0ubuntu1.1 500
        500 http://archive.ubuntu.com/ubuntu xenial-updates/main amd64 Packages
        500 http://security.ubuntu.com/ubuntu xenial-security/main amd64 Packages
        100 /var/lib/dpkg/status
     111-0ubuntu1 500
        500 http://archive.ubuntu.com/ubuntu xenial/main amd64 Packages

apt-cache policy kde-cli-tools
kde-cli-tools:
  Installed: 4:5.8.7-0neon+16.04+xenial+build6
  Candidate: 4:5.8.7-0neon+16.04+xenial+build6
  Version table:
 *** 4:5.8.7-0neon+16.04+xenial+build6 500
        500 http://archive.neon.kde.org/user/lts xenial/main amd64 Packages
        100 /var/lib/dpkg/status
     4:5.8.6-0neon+16.04+build5 500
        500 http://archive.neon.kde.org/user/lts xenial/main amd64 Packages
     4:5.5.5-0ubuntu1.1 500
        500 http://archive.ubuntu.com/ubuntu xenial-updates/universe amd64 Packages
        500 http://security.ubuntu.com/ubuntu xenial-security/universe amd64 Packages
     4:5.5.5-0ubuntu1 500
        500 http://archive.ubuntu.com/ubuntu xenial/universe amd64 Packages

apt-cache policy kde-config-screenlocker
kde-config-screenlocker:
  Installed: 5.8.7-0neon+16.04+xenial+build7
  Candidate: 5.8.7-0neon+16.04+xenial+build7
  Version table:
 *** 5.8.7-0neon+16.04+xenial+build7 500
        500 http://archive.neon.kde.org/user/lts xenial/main amd64 Packages
        100 /var/lib/dpkg/status
     5.8.6-0neon+16.04+build6 500
        500 http://archive.neon.kde.org/user/lts xenial/main amd64 Packages
     5.5.5-0ubuntu1 500
        500 http://archive.ubuntu.com/ubuntu xenial/universe amd64 Packages

[Yuriy Rodak (uriinf)]

It just freeze randomly during trying to unlock session.
What I do then:
0. switch to tty0 -> Ctrl + Alt + F1
1. killall gnome-screensaver
2. switch to X -> Ctrl + Alt + F7
3. start gnome-screensaver again -> Alt + F2 -> gnome-screensaver

Gnome 3.x
$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 16.04.2 LTS
Release: 16.04
Codename: xenial

jul 25 11:17:38 yuriis-desktop gnome-session[2695]: Gjs-Message: JS LOG: pushModal: invocation of begin_modal failed
jul 25 11:17:44 yuriis-desktop gnome-screensaver-dialog[23353]: pam_ecryptfs: seteuid error
jul 25 11:17:44 yuriis-desktop gnome-screensaver-dialog[23353]: gkr-pam: unlocked login keyring

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[madmangunradio (madmangunradio)]

i3lock on Ubuntu 17.10 effected
Oct 21 11:17:25 Nebula i3lock[4390]: pam_ecryptfs: seteuid error

[GB (querty)]

xscreenserver on Ubuntu 16.10 affected
nov. 16 14:10:13 clevo.gigi.edu xscreensaver[24025]: pam_ecryptfs: seteuid error

[Taddeo Manzi (sinistristradali)]

affected on ubuntu cosmic

[laluz (laluz)]

affected on Ubuntu bionic

lsb_release -a
LSB Version: core-9.20170808ubuntu1-noarch:security-9.20170808ubuntu1-noarch
Distributor ID: Ubuntu
Description: Ubuntu 18.04.1 LTS
Release: 18.04
Codename:

[ALinuxUser (buntulongername-new)]

Affected on Mint 19.1, which is based on Ubuntu bionic.

[Alexander McColl (thatcherskryptonite)]

Affected on Mint 19.1 running i3lock
locks and unlocks fine, but systemd reports:

"pam_ecryptfs: seteuid error"

[Laurent Bonnaud (laurent-bonnaud)]

The bug is still there in cosmic:

# journalctl | grep pam_ecryptfs
Apr 09 20:27:24 vougeot kcheckpass[757]: pam_ecryptfs: seteuid error

[Anton (anton-sobolev)]

Same here on Mint 19.2, syslog:
cinnamon-screensaver-pam-helper: pam_ecryptfs: seteuid error

And password field freeze on typing.

[Sam (sa-ma)]

I'm seeing this currently on one of my two Linux Mint 19.3 installations (both are on the same system).

I usually use a keyboard shortcut to lock the desktop and blank the screen, the command it runs is the following:
bash -c "cinnamon-screensaver-command -l; sleep 8s; xset dpms force off; "

This has always worked, but now on one of the installations it blanks the screen but after a while wakes up again without me doing anything. The only thing out of the ordinary I see in the journal (that I don't see on the secondary installation) is that every time I locked the screen this happens:

Sender: cinnamon-screen
Message: pam_ecryptfs: seteuid error

So I guess this could be related to what causes the screen to wake, and I have no idea why. So I'm in the process now of making a fresh reinstall and then gradually install/test the stuff I use to try and narrow down what causes this.

[ALinuxUser (buntulongername-new)]

The (purely cosmetic?) problem - 'pam_ecryptfs: seteuid error' persists into Mint version 20, based on Ubuntu 20.

[cjspizz (f1xx0rz)]

How does a seemingly minor bug persist for 8+ years?

[Lionel (lionel-broche)]

Still present in Ubuntu 20.04, it spams my OSSEC alert system

[Ariel Faigon (ariel.faigon)]

Confirming issue exists on Kubuntu 20.04.4 LTS.

Every attempt to login from the graphical login screen makes this error appear in authlog:

    /var/log/auth.log:Apr 27 13:56:16 <hostname> kcheckpass[3516]: pam_ecryptfs: seteuid error

Quick "fix" of the symptom, i.e. make the error go away is to add the seteuid-bit permission to kcheckpass (owned by root):

    sudo chmod u+s /usr/lib/x86_64-linux-gnu/libexec/kcheckpass

However, this seems like a too broad privilege grant so I'm not sure it is a good idea.
Personally, I prefer to have the spurious error in the log over this broad privilege grant.

Note that login succeeds despite the error appearing in authlog.

[Scarlett Gately Moore (scarlettmoore)]

I am not seeing this in kscreenlocker on 24.04. Unless someone else can confirm it I am closing kscreenlocker from this bug.