Bug#1119263: libkscreenlocker6: kscreenlocker hangs on sleep/lock due to missing pam_sss.so dependency
Package: libkscreenlocker6
Version: 6.5.0-1
Severity: normal
X-Debbugs-Cc: a.k.debian-bugtracker@proton.me
Dear Maintainer,
I would like to report a behavior that leads to an unresponsive system.
* What led up to the situation?
On every screen lock (including automatic ones), journalctl logs a failure to
load pam_sss.so (see below). If the device is sent to sleep or hibernate
(manually or by a system policy), the system appears to hang: it does not
actually enter a proper sleep/hibernate state, and keyboard input does not
respond (including the Magic SysRq keys or attempts to switch to another TTY).
Battery continues draining on laptops, potentially leading to a hard shutdown
and data loss.
* What exactly did you do (or not do) that was effective (or ineffective)?
After a number of such events, I accidentally discovered that a short press of
the power button acts like a wake-up event, after which the lock screen
functionality is restored and login via password works normally. The use can
then send the system to sleep/hibernation from the lock screen.
I searched through pam configs to see which of them mention the missing file,
with `/usr/lib/pam.d/kde-smartcard` (introduced in a recent commit) being the
culprit:
```
$ grep -R "pam_sss.so" /etc/pam.d /etc/security /etc/sssd* /usr/share/pam-
configs /usr/lib/pam.d 2>/dev/null
/usr/lib/pam.d/kde-smartcard:#auth [success=2 default=ignore] pam_sss.so
allow_missing_name try_cert_auth
/usr/lib/pam.d/kde-smartcard:auth required pam_sss.so
allow_missing_name try_cert_auth
```
Installing `libpam-sss` fixes the issue. However, this package is only listed
as Suggests, not Depends, which is reasonable if the user does not use
smartcards.
* What was the outcome of this action?
- Locking the session alone does not break functionality, but journalctl logs:
```
kscreenlocker_greet[5125]: PAM unable to dlopen(pam_sss.so):
/usr/lib/security/pam_sss.so: cannot open shared object file: No such file or
directory
kscreenlocker_greet[5125]: PAM adding faulty module: pam_sss.so
```
- Sending the system to sleep/hibernate (manually or atumatically) does not
actually enter the low-power state; the system appears hung, keyboard input is
unresponsive, and battery continues draining on laptops, potentially causing a
hard shutdown and data loss. Short power button press restores functionality
and wakes the lock screen, and the user is able to send the system to sleep
manually from the lock screen.
* What outcome did you expect instead?
- Screen locker (called manually or automatically) should not fail if optional
PAM modules like pam_sss.so are not installed.
- Sleep/hibernate (manual or automated) should actually enter low-power state
without hanging, even if smartcards are not used.
- Optional PAM modules should not block normal system operation.
-- System Information:
Debian Release: forky/sid
APT prefers testing
APT policy: (500, 'testing')
Architecture: amd64 (x86_64)
Kernel: Linux 6.16.12+deb14+1-amd64 (SMP w/8 CPU threads; PREEMPT)
Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages libkscreenlocker6 depends on:
ii kio6 6.18.0-1
ii libc6 2.41-12
ii libkf6configcore6 6.18.0-1
ii libkf6configgui6 6.18.0-1
ii libkf6configqml6 6.18.0-1
ii libkf6coreaddons6 6.18.0-2
ii libkf6crash6 6.18.0-1
ii libkf6globalaccel6 6.18.0-1
ii libkf6i18n6 6.18.0-1
ii libkf6i18nqml6 6.18.0-1
ii libkf6idletime6 6.18.0-1
ii libkf6kiocore6 6.18.0-1
ii libkf6notifications6 6.18.0-1
ii libkf6package6 6.18.0-1
ii libkf6screendpms8 4:6.5.0-1
ii libkf6windowsystem6 6.18.0-1
ii libkf6xmlgui6 6.18.0-1
ii liblayershellqtinterface6 6.5.0-1
ii libpam0g 1.7.0-5
ii libplasmaquick6 6.5.0-1
ii libqt6core6t64 6.9.2+dfsg-2
ii libqt6dbus6 6.9.2+dfsg-2
ii libqt6gui6 6.9.2+dfsg-2
ii libqt6network6 6.9.2+dfsg-2
ii libqt6qml6 6.9.2+dfsg-4
ii libqt6quick6 6.9.2+dfsg-4
ii libstdc++6 15.2.0-4
ii libwayland-client0 1.24.0-2+b1
ii libwayland-server0 1.24.0-2+b1
ii libx11-6 2:1.8.12-1
ii libxcb-keysyms1 0.4.1-1
ii libxcb1 1.17.0-2+b1
ii libxi6 2:1.8.2-1
ii psmisc 23.7-2
Versions of packages libkscreenlocker6 recommends:
ii kde-config-screenlocker 6.5.0-1
Versions of packages libkscreenlocker6 suggests:
ii libpam-fprintd 1.94.5-2
ii libpam-kwallet5 6.5.0-1
pn libpam-pkcs11 <none>
pn libpam-sss <none>
-- no debconf information
Reply to: