[plasmashell] [Bug 518755] Wayland lock screen fails to authenticate (pam_unix “user unknown”) with no user feedback; SDDM login works
https://bugs.kde.org/show_bug.cgi?id=518755 --- Comment #9 from ariasuni --- I had the problem, and my `unix_chkpwd` and `su` executables have the correct SUID: ``` >>> stat /usr/bin/unix_chkpwd […] Access: (6755/-rwsr-sr-x) Uid: (0/root) Gid: (0/root) […] >>> stat /usr/bin/su […] Access: (4755/-rwsr-xr-x) Uid: (0/root) Gid: (0/root) […] ``` Tho I didn’t have the problem happen again personally, so… -- You are receiving this mail because: You are watching all bug changes.
[plasmashell] [Bug 518755] Wayland lock screen fails to authenticate (pam_unix “user unknown”) with no user feedback; SDDM login works
https://bugs.kde.org/show_bug.cgi?id=518755 [email protected] changed: What|Removed |Added Status|REPORTED|RESOLVED Resolution|--- |NOT A BUG --- Comment #8 from [email protected] --- Ended up poking around on this system some more and fixed it for myself Root Cause: A hardening step removed required SUID permissions from PAM/authentication helper binaries, specifically: /usr/bin/unix_chkpwd /usr/bin/su This broke PAM password verification used by KDE screen locking and su. Observed incorrect permissions: -rwxr-xr-x /usr/bin/unix_chkpwd -rwxr-xr-x /usr/bin/su Expected permissions: -rwsr-xr-x Additional complication: The running system environment would not allow restoring SUID bits in-place (chmod 4755 returned Operation not permitted), so repair had to be performed offline from an Arch ISO/chroot environment. Resolution: Booted Arch ISO Mounted BTRFS root subvolume Entered system with arch-chroot Reinstalled affected packages: pam shadow sudo util-linux Restored correct SUID permissions: chmod 4755 /usr/bin/unix_chkpwd chmod 4755 /usr/bin/su Verified integrity with: pacman -Qkk pam shadow sudo Rebooted system Result: KDE unlock/login functioning normally su - functioning normally PAM authentication restored Lessons Learned: Avoid blanket SUID/SGID stripping on desktop Linux systems. PAM and desktop authentication rely on several privileged helper binaries. -- You are receiving this mail because: You are watching all bug changes.
[plasmashell] [Bug 518755] Wayland lock screen fails to authenticate (pam_unix “user unknown”) with no user feedback; SDDM login works
https://bugs.kde.org/show_bug.cgi?id=518755 TraceyC changed: What|Removed |Added Resolution|WAITINGFORINFO |--- Status|NEEDSINFO |REPORTED --- Comment #7 from TraceyC --- Thanks for the detailed logs, those are helpful! These are the related logs from the system journal showing the failure to authenticate. I see the accounts-daemon wasn't able to get homed users. Those more knowledgeable about this will need to take a further look. Apr 16 16:46:26 hostname systemd[1330]: Started Konsole - Terminal. Apr 16 16:46:26 hostname systemd[1330]: Started app-org.kde.konsole-65787.scope. Apr 16 16:46:36 hostname accounts-daemon[1921]: Unable to open /etc/tcb: No such file or directory Apr 16 16:46:36 hostname accounts-daemon[1921]: couldn't list homed users: GDBus.Error:org.freedesktop.DBus.Error.NameHasNoOwner: Could not activate remote peer 'org.freedesktop.home1': activation request failed: unknown unit Apr 16 16:46:38 hostname openrgb-profile-switch.sh[1389]: 2026-04-16 16:46:38 State changed to locked Apr 16 16:46:38 hostname openrgb-profile-switch.sh[65831]: Connected to server Apr 16 16:46:38 hostname openrgb-profile-switch.sh[65831]: Network client listener started Apr 16 16:46:38 hostname openrgb-profile-switch.sh[65831]: Client: Received controller count from server: 3 Apr 16 16:46:38 hostname openrgb-profile-switch.sh[65831]: Client: Requesting controller 0 Apr 16 16:46:38 hostname openrgb-profile-switch.sh[65831]: Client: Requesting controller 1 Apr 16 16:46:38 hostname openrgb-profile-switch.sh[65831]: Client: Requesting controller 2 Apr 16 16:46:38 hostname openrgb-profile-switch.sh[65831]: Client: All controllers received, adding them to master list Apr 16 16:46:38 hostname openrgb-profile-switch.sh[65831]: Profile loaded successfully Apr 16 16:46:38 hostname unix_chkpwd[65851]: check pass; user unknown Apr 16 16:46:39 hostname openrgb[1829]: [NetworkServer] recv_select failed receiving magic, closing listener Apr 16 16:46:39 hostname unix_chkpwd[65859]: check pass; user unknown Apr 16 16:46:39 hostname unix_chkpwd[65859]: password check failed for user (USER) Apr 16 16:46:39 hostname kscreenlocker_greet[65809]: pam_unix(kde:auth): authentication failure; logname=USER uid=1000 euid=1000 tty= ruser= rhost= user=USER -- You are receiving this mail because: You are watching all bug changes.
[plasmashell] [Bug 518755] Wayland lock screen fails to authenticate (pam_unix “user unknown”) with no user feedback; SDDM login works
https://bugs.kde.org/show_bug.cgi?id=518755 --- Comment #6 from [email protected] --- (In reply to TraceyC from comment #2) > Thanks for the bug report. In order to start investigating, we'll need some > logs from your system from the session where you experienced this bug with > the lock screen. You can run this and copy and paste into this report > > journalctl --boot 0 --no-pager > > For details, see > https://community.kde.org/ > Troubleshooting#Are_there_any_errors_in_the_log_files? > > Thanks. Hi Tracey! I've attached the journal to this bug report as it's a bit long. I also went ahead and grabbed the journal for -u ssdm and my user id in case they are relevant. Thanks for the help! -- You are receiving this mail because: You are watching all bug changes.
[plasmashell] [Bug 518755] Wayland lock screen fails to authenticate (pam_unix “user unknown”) with no user feedback; SDDM login works
https://bugs.kde.org/show_bug.cgi?id=518755 --- Comment #5 from [email protected] --- Created attachment 191559 --> https://bugs.kde.org/attachment.cgi?id=191559&action=edit user_journal user journal if relevant. -- You are receiving this mail because: You are watching all bug changes.
[plasmashell] [Bug 518755] Wayland lock screen fails to authenticate (pam_unix “user unknown”) with no user feedback; SDDM login works
https://bugs.kde.org/show_bug.cgi?id=518755 --- Comment #4 from [email protected] --- Created attachment 191558 --> https://bugs.kde.org/attachment.cgi?id=191558&action=edit sddm_journal sddm journal that shows the bug. -- You are receiving this mail because: You are watching all bug changes.
[plasmashell] [Bug 518755] Wayland lock screen fails to authenticate (pam_unix “user unknown”) with no user feedback; SDDM login works
https://bugs.kde.org/show_bug.cgi?id=518755 --- Comment #3 from [email protected] --- Created attachment 191557 --> https://bugs.kde.org/attachment.cgi?id=191557&action=edit boot_journal boot journal requested by tracey c. -- You are receiving this mail because: You are watching all bug changes.
[plasmashell] [Bug 518755] Wayland lock screen fails to authenticate (pam_unix “user unknown”) with no user feedback; SDDM login works
https://bugs.kde.org/show_bug.cgi?id=518755 TraceyC changed: What|Removed |Added Resolution|--- |WAITINGFORINFO Status|REPORTED|NEEDSINFO CC||[email protected] --- Comment #2 from TraceyC --- Thanks for the bug report. In order to start investigating, we'll need some logs from your system from the session where you experienced this bug with the lock screen. You can run this and copy and paste into this report journalctl --boot 0 --no-pager For details, see https://community.kde.org/Troubleshooting#Are_there_any_errors_in_the_log_files? Thanks. -- You are receiving this mail because: You are watching all bug changes.
[plasmashell] [Bug 518755] Wayland lock screen fails to authenticate (pam_unix “user unknown”) with no user feedback; SDDM login works
https://bugs.kde.org/show_bug.cgi?id=518755 ariasuni changed: What|Removed |Added CC||[email protected] --- Comment #1 from ariasuni --- I have exactly the same bug, the same workarounds work. However it only happens sometimes under unknown conditions, and I don’t have the «user unknown» error in my logs. IIRC, when the bug happens, the eye icon doesn’t re-appear in the password field when I type letters. -- You are receiving this mail because: You are watching all bug changes.
