attempting to enable fingerprint with pam-auth-update breaks gdm

[Jonathan Kamens]

I ran sudo pam-auth-update, enabled "Fingerprint authentication", selected "OK", and then rebooted.

GDM wouldn't start after the reboot:

Feb 27 06:29:41 jik-x1 /usr/lib/gdm3/gdm-wayland-session[1551]: dbus-daemon[1553]: [session uid=121 pid=1553] Activating service name='org.freedesktop.systemd1' requested by ':1.0' (uid=121 pid=1551 comm="/usr/lib/gdm3/gdm-wayland-session gnome-session --" label="unconfined")
Feb 27 06:29:41 jik-x1 /usr/lib/gdm3/gdm-wayland-session[1551]: dbus-daemon[1553]: [session uid=121 pid=1553] Activated service 'org.freedesktop.systemd1' failed: Process org.freedesktop.systemd1 exited with status 1
Feb 27 06:29:41 jik-x1 /usr/lib/gdm3/gdm-wayland-session[1551]: Unable to register display with display manager

I logged in on a VT and ran pam-auth-update again. I observed that "Register user sessions in the systemd control group" was not selected, even though my recollection was that it had been selected before I enabled fingerprint authentication, and I didn't disable it.

I unselected fingerprint authentication and selected "Register user sessions in the systemd control group" and rebooted again. GDM started working again.

ProblemType: Bug
DistroRelease: Ubuntu 19.04
Package: libpam-runtime 1.3.1-5ubuntu1
ProcVersionSignature: Ubuntu 4.19.0-13.14-generic 4.19.20
Uname: Linux 4.19.0-13-generic x86_64
ApportVersion: 2.20.10-0ubuntu21
Architecture: amd64
CurrentDesktop: ubuntu:GNOME
Date: Wed Feb 27 06:31:32 2019
InstallationDate: Installed on 2019-02-26 (0 days ago)
InstallationMedia: Ubuntu 18.04.2 LTS "Bionic Beaver" - Release amd64 (20190210)
PackageArchitecture: all
SourcePackage: pam
UpgradeStatus: Upgraded to disco on 2019-02-26 (0 days ago)

[Jonathan Kamens (jik)]

Actually, it's even weirder than that.

I went through all this several times while trying to narrow down the repro steps, and it's all very bizarre. Somehow I managed to get gdm working again, and then in a logged in gdm session, I enabled fingerprint, and exited from pam-auth-update, then ran pam-auth-update again and disabled fingerprint and re-enabled register user sessions which had once again somehow magically gotten disabled, but then I ran pam-auth-update a third time and register user sessions was STILL disabled even though I'd just enabled it, and then when I rebooted GDM wouldn't work again. So at that point I logged in on a VT and ran pam-auth-update again and selected register user sessions again, and then just out of curiosity ran pam-auth-update again and this time register user sessions was still selected, so I exited and rebooted and GDM worked again.

There is something very bizarre going on here.

[Sebastien Bacher (seb128)]

Thanks for your bug report, what do you need pam-auth-update? What are you trying to configure? Enabling log-in with fingerprint shouldn't requiring having to fiddle with pam tools on a command line if that's what you are trying to enable

[Jonathan Kamens (jik)]

So, whether or not I needed to run pam-auth-update, doing so and enabling fingerprint authentication there should not cause GDM to break, nor should the other weird behavior I described above be happening.

Having said that, yes, I was trying to enable login with fingerprint. I googled how to do that on Ubuntu and found this page, https://help.ubuntu.com/stable/ubuntu-help/session-fingerprint.html.en. But when I followed the instructions there and opened the Users panel, there was nothing there about fingerprint login. So I googled more and found this page, https://askubuntu.com/questions/1049526/fingerprint-activation-on-ubuntu-18-04, which mentioned using pam-auth-update to ensure that fingerprint authentication was enabled. So I ran pam-auth-update and found that it wasn't enabled and enabled it, which led to the problems described above.

If I shouldn't have had to do any of that to be able to configure fingerprint login, then something else is wrong and I don't even know where to start looking to figure out what, but regardless of that, the issues that I encountered with pam-auth-update behaving poorly are still real.

[Sebastien Bacher (seb128)]

You are right that pam shouldn't lead to gdm not working in any case. Knowing the context help to define the priority of the issue though.

The initial report/tools indicate that you are on 19.04, fingerprint authentification should work out of the box there (if you have a supported reader, which might be the issue, what device do you have?). That's probably worth another report (unless it's known/the device not being handled under linux)

[Jonathan Kamens (jik)]

I have a new Thinkpad X1 Carbon 6th generation. I can see the fingerprint reader right next to the trackpad, and the specs say that it has one, but I don't see it showing up in the output of lspci or lsusb. Maybe I'm missing it? Maybe it's not supported? Or maybe there's a hardware issue? I'm not sure how to tell.

lsusb output:

Bus 004 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 003 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 002 Device 002: ID 0bda:0328 Realtek Semiconductor Corp.
Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 001 Device 006: ID 06cb:009a Synaptics, Inc.
Bus 001 Device 005: ID 04f2:b614 Chicony Electronics Co., Ltd
Bus 001 Device 004: ID 8087:0a2b Intel Corp.
Bus 001 Device 003: ID 04f2:b615 Chicony Electronics Co., Ltd
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

[Jonathan Kamens (jik)]

As far as I can tell, the BIOS is able to see the fingerprint reader -- I just booted into the BIOS and told it to reset the fingerprint data, and it said that it had done so successfully -- so this appears to be a Linux-specific issue.

[Jonathan Kamens (jik)]

I called Lenovo and asked and the support rep I spoke with said that the X1 Carbon's fingerprint reader isn't supported in Linux yet.

I don't know whether to trust that information as accurate, but that's what he said.

I don't know whether that's worthy of a separate bug report or not. I mean, there's lots of unsupported hardware out there, right, does the fact that a particular device is not supported by Ubuntu deserve a bug report?

[Steve Langasek (vorlon)]

I don't have an explanation of the behavior of pam-auth-update, but Debian bug #923362 has also just been filed regarding pam_systemd inexplicably getting disabled, and may be related.

[Sebastien Bacher (seb128)]

https://forums.lenovo.com/t5/Linux-Discussion/X1-Carbon-2018-X1C6-FingerPrint-Reader-under-Linux-Ubuntu-18-04/td-p/4255423 seems to discuss that topic as well

There are no Chicony devices listed in the upstream list of supported hardware on https://fprint.freedesktop.org/supported-devices.html