Public bug reported: # gdm-greeter dynamic user rejected by pam_unix account check, causes black screen / stuck login on 26.04
## Summary After upgrading to Ubuntu 26.04.1 LTS (GNOME 50), GDM's login screen either never appears (black screen, session torn down repeatedly) or appears with no login form (grey background and clock only, no user list or password field). Root cause traced to two separate PAM configuration files that were not updated for GDM 50's new dynamic `gdm-greeter` account model. ## System info - Ubuntu 26.04.1 LTS "Resolute Raccoon", upgraded from 24.04 via `do-release-upgrade -d` - gdm3 50.1-0ubuntu0.1 - gnome-session 50.1-0ubuntu0.1 - Kernel 7.0.0-31-generic - NVIDIA RTX 4070 Ti Super, driver 595.91.07 (open kernel module) - (Please attach the output of `ubuntu-bug gdm3` or `apt-cache policy gdm3 gnome-session systemd libpam-runtime` for exact versions on your system) ## Steps to reproduce Not confirmed as 100% deterministic on every 26.04 install; encountered reliably on this machine after a 24.04 → 26.04 upgrade. Unconfirmed whether a fresh 26.04 ISO install hits the same failure. 1. Boot into Ubuntu 26.04 with GDM as the display manager 2. Observe GDM's greeter attempting to start ## Expected behavior GDM shows a normal login screen with the user list and password prompt. ## Actual behavior One of two failure modes, both traced to the same root cause: **Mode A: black screen, greeter never renders** `journalctl -u gdm` shows the greeter's PAM session being torn down immediately after authentication: ``` GdmSessionWorker: state AUTHENTICATED GdmSessionWorker: attempting to change state to AUTHORIZED GdmSessionWorker: determining if authenticated user (password required:0) is authorized to session GdmSessionWorker: user is not authorized to log in: Authentication failure ``` GDM retries a fixed number of times, then gives up: ``` GdmLocalDisplayFactory: maximum number of display failures reached. Giving up. ``` **Mode B: grey background with clock, no login form** Occurs once Mode A is worked around (see Root cause below). `gnome-shell --mode=gdm` starts and stays running (confirmed via `ps aux` and a real `seat0` session in `loginctl list-sessions`), but the actual login dialog never builds. This mode traced to a separate, unrelated packaging issue (a stale `libgdk-pixbuf2.0-bin` left behind by an interrupted upgrade) rather than the PAM issue below, and is not the focus of this report. ## Root cause GDM 50 replaced its long-standing static `gdm` system account with a fresh systemd `DynamicUser` account (`gdm-greeter`, allocated a new UID from the dynamic range on every single greeter launch), consistent with `GdmDynUserStore: Allocated dynamic user 'gdm-greeter'` messages in the journal. This account has no real entry in `/etc/passwd` or `/etc/shadow`. Two PAM service files that this account's session passes through were never updated to account for that: **1. `/etc/pam.d/gdm-launch-environment`** Ships with: ``` @include common-account ``` `common-account` chains through `pam_unix.so` for the account phase. `pam_unix`'s account check has no real shadow entry to evaluate for a DynamicUser account, control falls through to the unconditional `account requisite pam_deny.so` line further down in `common-account`, and the whole account phase fails, tearing down the greeter session. This exact failure signature (`account gdm has expired` / `user is not authorized to log in`) has been hit independently on other distributions during GDM's transition away from a static account (see References), but their upstream `gdm-launch-environment.pamd` templates use a direct `account required pam_permit.so` and were never exposed to it. Debian/Ubuntu's convention of chaining every service through the shared `common-account` file for consistency is what creates the exposure here. **2. `/etc/pam.d/systemd-user`** This file does not exist by default on Ubuntu. `systemd`'s per-user manager (`user@<uid>.service`) requests PAM service name `systemd-user` (confirmed via `grep -i pamname /usr/lib/systemd/system/[email protected]`), and since no matching file exists, PAM falls back to `/etc/pam.d/other`, which also chains through `common-account` and hits the identical rejection, this time inside the user manager itself: ``` unix_chkpwd: could not obtain user info (gdm-greeter) (systemd): user@<uid>.service: PAM failed: Authentication service cannot retrieve authentication info (systemd): user@<uid>.service: Failed to set up PAM session: Operation not permitted systemd: user@<uid>.service: Main process exited, code=exited, status=224/PAM ``` This is what's actually failing once (1) above is worked around, so both need fixing together for a working login. ## Workaround **File 1**, replace the `common-account` include with an unconditional permit, matching upstream's own template for this service: ``` sudo sed -i 's/^@include common-account/account\t\trequired\t\tpam_permit.so/' /etc/pam.d/gdm-launch-environment ``` **File 2**, create it, since it doesn't exist: ``` sudo bash -c 'printf "account required pam_permit.so\nsession required pam_unix.so\nsession required pam_loginuid.so\nsession optional pam_keyinit.so force revoke\nsession required pam_systemd.so\n" > /etc/pam.d/systemd-user' ``` After both changes, `sudo systemctl restart gdm` (or a reboot) produces a working greeter session. ## References - Debian bug #1059245, gdm3 fails to start on Wayland (different specific trigger, same category of systemd-user-bus/account-phase fragility): https://bugs.debian.org/1059245 - Arch Linux forum thread on gdm-greeter dynamic user + [email protected] PAM failures during the GNOME 49 transition: https://bbs.archlinux.org/viewtopic.php?id=308372 - openSUSE's packaged `gdm-launch-environment.pamd`, using `account required pam_permit.so` directly rather than chaining through the shared account policy: https://build.opensuse.org/projects/openSUSE:Leap:15.4/packages/gdm.22242/files/gdm-launch-environment.pamd ProblemType: Bug DistroRelease: Ubuntu 26.04 Package: gdm3 50.1-0ubuntu0.1 ProcVersionSignature: Ubuntu 7.0.0-31.31-generic 7.0.14 Uname: Linux 7.0.0-31-generic x86_64 ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 CasperMD5CheckResult: pass CurrentDesktop: ubuntu:GNOME Date: Wed Sep 16 18:52:07 2026 InstallationDate: Installed on 2026-04-04 (165 days ago) InstallationMedia: Ubuntu 24.04.4 LTS "Noble Numbat" - Release amd64 (20260210) ProcEnviron: LANG=en_US.UTF-8 PATH=(custom, no user) SHELL=/bin/bash TERM=xterm-256color XDG_RUNTIME_DIR=<set> SourcePackage: gdm3 UpgradeStatus: Upgraded to resolute on 2026-09-15 (1 days ago) mtime.conffile..etc.gdm3.custom.conf: 2026-09-15T22:01:29.192794 mtime.conffile..etc.pam.d.gdm-launch-environment: 2026-09-15T22:12:38.477592 ** Affects: gdm3 (Ubuntu) Importance: Undecided Status: New ** Tags: amd64 apport-bug resolute third-party-packages wayland-session ** Attachment added: "gdm3-pam-dynamic-user-bug-report.md" https://bugs.launchpad.net/bugs/2167510/+attachment/6000650/+files/gdm3-pam-dynamic-user-bug-report.md -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2167510 Title: GDM login screen never appears after upgrading to 26.04, gdm-greeter dynamic user rejected by pam_unix account check To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/gdm3/+bug/2167510/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
