attempting to enable fingerprint with pam-auth-update breaks gdm

Bug #1817897 reported by Jonathan Kamens on 2019-02-27
This bug affects 1 person
Affects Status Importance Assigned to Milestone
pam (Debian)
Fix Released
pam (Ubuntu)

Bug Description

I ran sudo pam-auth-update, enabled "Fingerprint authentication", selected "OK", and then rebooted.

GDM wouldn't start after the reboot:

Feb 27 06:29:41 jik-x1 /usr/lib/gdm3/gdm-wayland-session[1551]: dbus-daemon[1553]: [session uid=121 pid=1553] Activating service name='org.freedesktop.systemd1' requested by ':1.0' (uid=121 pid=1551 comm="/usr/lib/gdm3/gdm-wayland-session gnome-session --" label="unconfined")
Feb 27 06:29:41 jik-x1 /usr/lib/gdm3/gdm-wayland-session[1551]: dbus-daemon[1553]: [session uid=121 pid=1553] Activated service 'org.freedesktop.systemd1' failed: Process org.freedesktop.systemd1 exited with status 1
Feb 27 06:29:41 jik-x1 /usr/lib/gdm3/gdm-wayland-session[1551]: Unable to register display with display manager

I logged in on a VT and ran pam-auth-update again. I observed that "Register user sessions in the systemd control group" was not selected, even though my recollection was that it had been selected before I enabled fingerprint authentication, and I didn't disable it.

I unselected fingerprint authentication and selected "Register user sessions in the systemd control group" and rebooted again. GDM started working again.

ProblemType: Bug
DistroRelease: Ubuntu 19.04
Package: libpam-runtime 1.3.1-5ubuntu1
ProcVersionSignature: Ubuntu 4.19.0-13.14-generic 4.19.20
Uname: Linux 4.19.0-13-generic x86_64
ApportVersion: 2.20.10-0ubuntu21
Architecture: amd64
CurrentDesktop: ubuntu:GNOME
Date: Wed Feb 27 06:31:32 2019
InstallationDate: Installed on 2019-02-26 (0 days ago)
InstallationMedia: Ubuntu 18.04.2 LTS "Bionic Beaver" - Release amd64 (20190210)
PackageArchitecture: all
SourcePackage: pam
UpgradeStatus: Upgraded to disco on 2019-02-26 (0 days ago)

Jonathan Kamens (jik) wrote :
Jonathan Kamens (jik) wrote :

Actually, it's even weirder than that.

I went through all this several times while trying to narrow down the repro steps, and it's all very bizarre. Somehow I managed to get gdm working again, and then in a logged in gdm session, I enabled fingerprint, and exited from pam-auth-update, then ran pam-auth-update again and disabled fingerprint and re-enabled register user sessions which had once again somehow magically gotten disabled, but then I ran pam-auth-update a third time and register user sessions was STILL disabled even though I'd just enabled it, and then when I rebooted GDM wouldn't work again. So at that point I logged in on a VT and ran pam-auth-update again and selected register user sessions again, and then just out of curiosity ran pam-auth-update again and this time register user sessions was still selected, so I exited and rebooted and GDM worked again.

There is something very bizarre going on here.

Sebastien Bacher (seb128) wrote :

Thanks for your bug report, what do you need pam-auth-update? What are you trying to configure? Enabling log-in with fingerprint shouldn't requiring having to fiddle with pam tools on a command line if that's what you are trying to enable

Jonathan Kamens (jik) wrote :

So, whether or not I needed to run pam-auth-update, doing so and enabling fingerprint authentication there should not cause GDM to break, nor should the other weird behavior I described above be happening.

Having said that, yes, I was trying to enable login with fingerprint. I googled how to do that on Ubuntu and found this page, But when I followed the instructions there and opened the Users panel, there was nothing there about fingerprint login. So I googled more and found this page,, which mentioned using pam-auth-update to ensure that fingerprint authentication was enabled. So I ran pam-auth-update and found that it wasn't enabled and enabled it, which led to the problems described above.

If I shouldn't have had to do any of that to be able to configure fingerprint login, then something else is wrong and I don't even know where to start looking to figure out what, but regardless of that, the issues that I encountered with pam-auth-update behaving poorly are still real.

Sebastien Bacher (seb128) wrote :

You are right that pam shouldn't lead to gdm not working in any case. Knowing the context help to define the priority of the issue though.

The initial report/tools indicate that you are on 19.04, fingerprint authentification should work out of the box there (if you have a supported reader, which might be the issue, what device do you have?). That's probably worth another report (unless it's known/the device not being handled under linux)

Jonathan Kamens (jik) wrote :

I have a new Thinkpad X1 Carbon 6th generation. I can see the fingerprint reader right next to the trackpad, and the specs say that it has one, but I don't see it showing up in the output of lspci or lsusb. Maybe I'm missing it? Maybe it's not supported? Or maybe there's a hardware issue? I'm not sure how to tell.

lsusb output:

Bus 004 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 003 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 002 Device 002: ID 0bda:0328 Realtek Semiconductor Corp.
Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 001 Device 006: ID 06cb:009a Synaptics, Inc.
Bus 001 Device 005: ID 04f2:b614 Chicony Electronics Co., Ltd
Bus 001 Device 004: ID 8087:0a2b Intel Corp.
Bus 001 Device 003: ID 04f2:b615 Chicony Electronics Co., Ltd
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

Jonathan Kamens (jik) wrote :

As far as I can tell, the BIOS is able to see the fingerprint reader -- I just booted into the BIOS and told it to reset the fingerprint data, and it said that it had done so successfully -- so this appears to be a Linux-specific issue.

Jonathan Kamens (jik) wrote :

I called Lenovo and asked and the support rep I spoke with said that the X1 Carbon's fingerprint reader isn't supported in Linux yet.

I don't know whether to trust that information as accurate, but that's what he said.

I don't know whether that's worthy of a separate bug report or not. I mean, there's lots of unsupported hardware out there, right, does the fact that a particular device is not supported by Ubuntu deserve a bug report?

Steve Langasek (vorlon) wrote :

I don't have an explanation of the behavior of pam-auth-update, but Debian bug #923362 has also just been filed regarding pam_systemd inexplicably getting disabled, and may be related.

Sebastien Bacher (seb128) wrote : seems to discuss that topic as well

There are no Chicony devices listed in the upstream list of supported hardware on

Changed in pam (Debian):
status: Unknown → Incomplete
Changed in pam (Debian):
status: Incomplete → Fix Released
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.