Greeter auth toggles do nothing when greetd's PAM file is only in /usr/lib/pam.d

Compositor

Niri

Distribution

Fedora

Select your Installation Method

Distro Packaging

Version

2.1.0

Description

On Fedora 45 and openSUSE Tumbleweed, greetd ships its PAM stack only as a vendor file in /usr/lib/pam.d/greetd. The greeter auth sync only works on /etc/pam.d/greetd: when that file is missing, it logs a line and returns, so the fingerprint and security key toggles do nothing.

dux-greeter/core/internal/pam/pam.go

Lines 141 to 147 in 2b1ee65

    
           if _, err := deps.stat(deps.greetdPath); err != nil { 
        
           	if os.IsNotExist(err) { 
        
           		logFunc("ℹ /etc/pam.d/greetd not found. Skipping greeter PAM sync.") 
        
           		return nil 
        
           	} 
        
           	return fmt.Errorf("failed to inspect %s: %w", deps.greetdPath, err) 
        
           }

Right now this is hidden by the packaging, because the dux-greeter %post writes its own minimal /etc/pam.d/greetd whenever the file is missing (duxlabs-dev/dux-repo#15). Once %post stops shadowing greetd's vendor file, the toggles will skip on every distro that uses /usr/lib/pam.d.

Suggested fix: when /etc/pam.d/greetd is missing but /usr/lib/pam.d/greetd exists, copy the vendor file to /etc/pam.d/greetd and insert the managed block into that copy. This is the usual way to override a vendor PAM file. It keeps greetd's full stack (pam_oo7, pam_gnome_keyring, pam_sepermit, pam_namespace), which the minimal template does not. RemoveManagedGreeterPamBlock could then delete /etc/pam.d/greetd if, after stripping the block, it matches the vendor file again, so turning the toggles off hands control back to greetd's package.

Expected Behavior

Turning on the greeter fingerprint or security key toggle adds the auth block on top of greetd's own PAM stack, also when that stack lives in /usr/lib/pam.d.

Steps to Reproduce

On Fedora 45, install greetd and dux-greeter, then rm /etc/pam.d/greetd (or fix the %post as in the dux-repo issue), so only /usr/lib/pam.d/greetd remains
Turn on the greeter fingerprint toggle in Dux Shell settings
Run dms greeter sync

Error Messages/Logs

ℹ /etc/pam.d/greetd not found. Skipping greeter PAM sync.

The greeter UI has the same blind spot. It reads only /etc/pam.d/greetd to work out which external auth the stack offers:

dux-greeter/quickshell/Modules/Greetd/GreeterContent.qml

Lines 376 to 389 in 2b1ee65

    
           FileView { 
        
               id: greetdPamWatcher 
        
               path: "/etc/pam.d/greetd" 
        
               printErrors: false 
        
               onLoaded: { 
        
                   root.greetdPamText = text(); 
        
                   root.refreshPasswordAttemptPolicyHint(); 
        
                   root.maybeAutoStartExternalAuth(); 
        
               } 
        
               onLoadFailed: { 
        
                   root.greetdPamText = ""; 
        
                   root.refreshPasswordAttemptPolicyHint(); 
        
               } 
        
           }

With only /usr/lib/pam.d/greetd present, greetdPamText stays empty and greeterPamStackHasModule() never follows the system-auth include. So on Fedora 45 with authselect with-fingerprint, the greeter does not offer or auto-start fingerprint auth, although pam_fprintd runs as part of the stack (auth substack system-auth).

PAM looks up a service in /etc/pam.d first and falls back to /usr/lib/pam.d. Using the same fallback for the greetd watcher, and for the included stacks next to it, would cover this. Until then, we copy /usr/lib/pam.d/greetd to /etc/pam.d/greetd in our image.

Thanks for the report, I hadn't updated to F45 yet since we pushed DMS 2.1 today. I'll check these out to get fixed up.

@purian23

Thank you @purian23. Yes, it is GA since yesterday :) It happens I stumbled across this issue working on my own OS upgrade for F45.

I received popup for DMS2.1 today, exited to check what new is there as always. Great work!

pam: fall back to greetd's /usr/lib/pam.d file when /etc has none

greeter: stop shadowing greetd's /usr/lib/pam.d/greetd in %post

This should be good to go on dux-greeter-git and likely tomorrow on the stable version, thanks for the report!

pam: fall back to greetd's /usr/lib/pam.d file when /etc has none

Navigation Menu

Repository navigation

Greeter auth toggles do nothing when greetd's PAM file is only in /usr/lib/pam.d #49

Compositor

Distribution

Select your Installation Method

Version

Description

Expected Behavior

Steps to Reproduce

Error Messages/Logs

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

	if _, err := deps.stat(deps.greetdPath); err != nil {
	if os.IsNotExist(err) {
	logFunc("ℹ /etc/pam.d/greetd not found. Skipping greeter PAM sync.")
	return nil
	}
	return fmt.Errorf("failed to inspect %s: %w", deps.greetdPath, err)
	}

	FileView {
	id: greetdPamWatcher
	path: "/etc/pam.d/greetd"
	printErrors: false
	onLoaded: {
	root.greetdPamText = text();
	root.refreshPasswordAttemptPolicyHint();
	root.maybeAutoStartExternalAuth();
	}
	onLoadFailed: {
	root.greetdPamText = "";
	root.refreshPasswordAttemptPolicyHint();
	}
	}

Greeter auth toggles do nothing when greetd's PAM file is only in /usr/lib/pam.d #49

Description

Compositor

Distribution

Select your Installation Method

Version

Description

Expected Behavior

Steps to Reproduce

Error Messages/Logs

Activity

maciej-lech commented on Nov 4, 2026

purian23 commented on Nov 4, 2026

maciej-lech commented on Nov 4, 2026

purian23 commented on Nov 6, 2026

Metadata

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

Issue actions