Getting the lock screen to work properly when resuming from Suspend-to-RAM with multiple sessions in Lubuntu 17.10

Introduction

What is it with Linux and lock screens?! There are umpteen posts on the Web by Linux users having trouble with lock screens, particularly the LightDM session locker Light Locker. Well, here is my contribution.

Lubuntu 17.10 is installed on my family’s desktop PC (single seat, multiple users). Lubuntu 17.10 uses systemd-logind, LightDM, Light Locker and Xfce Power Manager, and they do not work properly holistically in my experience. To confuse matters further, Lubuntu 17.10 also has XScreenSaver installed, which also has lock-screen capabilities.

In Lubuntu 17.10 on my family’s desktop PC, Light Locker displays the LightDM GTK+ Greeter screen when anyone wakes/resumes the PC from suspension by pressing a key on the USB keyboard, and users should then be able to log in by selecting their username from the pull-down list on the LightDM GTK+ Greeter screen and entering their password. However, if only a single user session existed when the PC suspended automatically (i.e. by timeout), upon resuming from suspension a black screen with a white padlock icon and the following message in white/grey text from light-locker would appear:

This session is locked
You’ll be redirected to the unlock
dialog automatically in a few seconds

But then nothing else happened; the above-mentioned message remained on display. I could press Ctrl+Alt+F1, login on TTY1 and enter the command ‘loginctl unlock-sessions‘ to get back to the Desktop, but that is not something the rest of my family would know how to do or be comfortable doing. In any case, I have only given sudo rights to one other member of the family.

Another problem would occur if the PC was left to suspend automatically with more than one user still logged in (i.e. more than one session). Although Light Locker would display the LightDM GTK+ Greeter screen upon resuming from suspension, and users could select their username from the pull-down list and enter their password, the LightDM GTK+ Greeter screen would remain on display and it would no longer be possible to re-enter a password (although it was still possible to select users from the pull-down list of users, and to select ‘Suspend’, ‘Restart…’ and ‘Shutdown…’ from the pull-down power menu). However, if users suspended the PC manually by selecting ‘Logout’ > ‘Lock Screen’ from the Lubuntu Menu, upon waking/resuming it was possible to enter their password on the LightDM GTK+ Greeter screen to return to their Desktop.

In this article I explain what I did to try and rectify these problems.

By the way, note that hibernation is disabled by default in Lubuntu 17.10 and you may need to make further changes if you want to enable hibernation as well. For example, does the PC have a swap partition, and is it large enough to enable hibernation? Also see the article: How to Enable Hibernate in Ubuntu 17.10 for possible help.

Modifications

The package light-locker-settings was not installed in Lubuntu 17.10. Do not install it. If it happens to be installed do not use ‘Preferences’ > ‘Light Locker Settings’, as it makes the Exec entry in the user’s light-locker.desktop file just ‘Exec=‘ or ‘Exec=light-locker‘. In fact, having installed light-locker-settings manually to check what could be configured via its GUI, I uninstalled it in order to stop anyone using it. (Under ‘Screensaver’, the Light Locker Settings GUI displays the following message: ‘Your screensaver settings are managed by Xfce Power Manager.’ and there is a button ‘Open’ to click on to launch the Xfce Power Manager settings GUI.) Presumably this was why it was not included when Lubuntu 17.10 was first installed to the HDD.

1.  I removed any light-locker.desktop files of individual users, leaving only the system-wide file:

$ sudo rm /home/*/.config/autostart/light-locker.desktop
$ sudo updatedb
$ locate light-locker.desktop
/etc/xdg/autostart/light-locker.desktop

2.  I edited the system-wide light-locker.desktop file to contain the following command to execute Light Locker:

$ grep Exec /etc/xdg/autostart/light-locker.desktop
Exec=light-locker --lock-after-screensaver=0 --no-lock-on-suspend --no-lock-on-lid --no-idle-hint

3.  I created the Bash script file /lib/systemd/system-sleep/hang-fix for systemd to run when suspending and resuming from suspension, with the permissions shown:

#!/bin/sh
case "$1" in
    pre|suspend|hibernate)
        date | tr -d '\n' >> /home/fitzcarraldo/sleep.log
        echo " going to sleep." >> /home/fitzcarraldo/sleep.log
        chvt 1
        loginctl unlock-sessions
    ;;
    post|resume|thaw)
        date | tr -d '\n' >> /home/fitzcarraldo/sleep.log
        echo " waking from sleep." >> /home/fitzcarraldo/sleep.log
        loginctl lock-sessions
        chvt 7
    ;;
    *)
        exit $NA
    ;;
esac
exit 0

$ sudo chmod 755 /lib/systemd/system-sleep/hang-fix
$ ls -la /lib/systemd/system-sleep/hang-fix
-rwxr-xr-x 1 root root 581 Apr 14 08:09 /lib/systemd/system-sleep/hang-fix

The above script is a hack to get around the problem of Light Locker resuming and apparently not knowing which session to unlock. I used the loginctl commands in this script rather than the Xfce Power Manager suspend options and Light Locker options such as ‘--late-locking‘ and ‘--lock-on-suspend‘ because I found that the Light Locker options and the Xfce Power Manager options did not fix the problem.

4.  I created two files for Polkit (to cover all Polkit versions to date) with the permissions as shown below.

4.1  The file /etc/polkit-1/rules.d/85-suspend.rules with the following contents:

polkit.addRule(function(action, subject) {
    if (action.id == "org.freedesktop.login1.suspend" ||
        action.id == "org.freedesktop.login1.suspend-multiple-sessions" ||
        action.id == "org.freedesktop.login1.hibernate" ||
        action.id == "org.freedesktop.login1.hibernate-multiple-sessions")
    {
        return polkit.Result.YES;
    }
});

If you do not have a swap partition large enough to enable hibernation, or you do not want to allow the PC to hibernate, use the following instead of the above:

polkit.addRule(function(action, subject) {
    if (action.id == "org.freedesktop.login1.suspend" ||
        action.id == "org.freedesktop.login1.suspend-multiple-sessions")
    {
        return polkit.Result.YES;
    }
});

$ sudo chmod 755 /etc/polkit-1/rules.d
$ sudo chmod 644 /etc/polkit-1/rules.d/85-suspend.rules
$ ls -la /etc/polkit-1/rules.d/85-suspend.rules
-rw-r--r-- 1 root root 359 Apr 19 22:14 /etc/polkit-1/rules.d/85-suspend.rules

4.2  The file /var/lib/polkit-1/localauthority/50-local.d/50-enable-suspend-on-lockscreen.pkla with the following contents:

[Allow suspending with lock screen]
Identity=unix-user:*
Action=org.freedesktop.login1.suspend;org.freedesktop.login1.suspend-multiple-sessions;org.freedesktop.login1.hibernate;org.freedesktop.login1.hibernate-multiple-sessions
ResultAny=yes
ResultInactive=yes
ResultActive=yes

If you do not have a swap partition large enough to enable hibernation, or you do not want to allow the PC to hibernate, use the following instead of the above:

[Allow suspending with lock screen]
Identity=unix-user:*
Action=org.freedesktop.login1.suspend;org.freedesktop.login1.suspend-multiple-sessions
ResultAny=yes
ResultInactive=yes
ResultActive=yes

$ sudo chmod 644 /var/lib/polkit-1/localauthority/50-local.d/50-enable-suspend-on-lockscreen.pkla
$ sudo ls -la /var/lib/polkit-1/localauthority/50-local.d/50-enable-suspend-on-lockscreen.pkla
-rw-r--r-- 1 root root 191 Apr 20 10:01 /var/lib/polkit-1/localauthority/50-local.d/50-enable-suspend-on-lockscreen.pkla

The above files are intended to get rid of the following error messages in a pop-up window and pop-up notification ballon, respectively, that prevent the OS from suspending automatically:

Authentication
Authentication is required for suspending
the system while other users are logged in.

Power Manager
GDBus.Error:org.freedesktop.DBus.Error.NoReply:
Method call timed out

By the way, the version of Polkit installed currently is 0.105:

$ pkaction --version
pkaction version 0.105

5.  I added all users to the users group (although I do not think this is essential):

$ sudo usermod -a -G users fitzcarraldo
$ sudo usermod -a -G users molly
$ sudo usermod -a -G users aquilino
$ sudo usermod -a -G users cholo
$ sudo usermod -a -G users paul

6.  I made sure the XScreenSaver settings for each user are as follows:

XScreenSaver (‘Preferences’ > ‘Screensaver’)

The ‘Display Modes’ tab has:

  • ‘Mode: Disable Screen Saver’

The ‘Advanced’ tab has everything unticked on it except for:

7.  I made sure the Xfce Power Manager settings for each user are as follows:

Xfce Power Manager (‘Preferences’ > ‘Power Manager’)

The ‘General’ tab has:
Buttons

  • When power button is pressed: Ask
  • When sleep button is pressed: Do nothing
  • When hibernate button is pressed: Do nothing

Appearance

  • Show notifications is ticked
  • Show system tray icon is ticked

The ‘System’ tab has:
System power saving

  • System sleep mode: Suspend
  • When inactive for 15 Minutes (You can make the number of minutes different for each user, if you want.)

The ‘Display’ tab has:
Display power management settings

  • ‘Handle display power management’ is ticked
  • Blank after: 5 Minutes
  • Put to sleep after: Never
  • Switch off after: Never

The ‘Security’ tab has:
Light Locker

  • Automatically lock the session: Never
  • Delay locking after screensaver for: ‘1 Seconds’ is greyed out
  • ‘Lock screen when system is going for sleep’ is not ticked

8.  I made sure the ‘Default Applications for LXSession’ settings for each user are as follows:

Select ‘Preferences’ > ‘Default Applications for LXSession’, click on ‘Autostart’ and untick ‘XScreenSaver’ if it is ticked. ‘Power Manager’ and ‘Screen Locker’ should already be ticked, so tick them if they are not. I left ‘PolicyKit Handler’ and ‘PolicyKit Authentication Agent’ unticked (Lubuntu 17.10 uses Polkit, the successor to PolicyKit).

9.  Although Lubuntu 17.10 does not use GNOME, I found that gsettings is installed. I did the following just in case, although I believe it is irrelevant in this particular case:

$ gsettings --version
2.54.1
$ gsettings set org.gnome.desktop.screensaver ubuntu-lock-on-suspend 'false'
$ gsettings get org.gnome.desktop.screensaver ubuntu-lock-on-suspend
false
$ gsettings set org.gnome.desktop.screensaver lock-enabled 'false'
$ gsettings get org.gnome.desktop.screensaver lock-enabled
false

Conclusion

After doing all the above, upon resuming from Suspend-to-RAM on most, but not all, occasions it is now possible to select any username on the LightDM GTK+ Greeter screen, enter that user’s password and successfully display the user’s Desktop. The LightDM GTK+ Greeter screen no longer hangs/freezes every time.

When more than one user is logged in (i.e. there is more than one session), the PC will suspend automatically if there is no user activity in a particular session during the configured timeout period for that session. Pressing a key on the USB keyboard will then wake the PC and display the LightDM GTK+ Greeter screen. The desired username can then be selected and the corresponding password entered. The following is an example of the sort of thing that can happen:

  • User fitzcarraldo (timeout configured as 30 minutes) logs in to his account at 09:00 and uses the PC until he locks his session manually (Ctrl+Alt+L) at 09:11.
  • User paul (timeout configured as 15 minutes) logs in to his account at 09:15 and uses the PC until he locks his session manually at 09:23.
  • User molly (timeout configured as 45 minutes) logs in to her account at 09:25 and uses the PC for several hours.
  • At 09:38, while user molly is using the PC, the PC automatically suspends to RAM (15 minutes after user paul stopped using his session). User molly has to wake the PC from suspension. Nothing is lost.
  • At 09:41, while user molly is using the PC, the PC automatically suspends to RAM (30 minutes after user fitzcarraldo stopped using his session). User molly has to wake the PC from suspension. Nothing is lost.

To avoid scenarios such as the above, if a user does not need the session any longer it is better to log out rather than leave the session in existence.

Advertisements

Sharing a folder between a Linux host and Sabayon Linux as the guest OS in a VirtualBox VM

You probably know that you need to install the VirtualBox Guest Additions in the guest OS in order share a folder between a host OS and a guest OS in a VirtualBox VM. However, of late I have found that shared folders do not work when the guest OS is any of the Sabayon Linux spins, even though I had installed the Entropy package app-emulation/virtualbox-guest-additions and ensured the user in the guest OS is a member of the vboxsf group. Fortunately, it is not difficult to fix this, and below is the procedure I use to get a Sabayon Linux guest to share folders with a Linux host.

Let us say that your username in the host OS is ‘brian‘ and you have created a directory named /home/brian/Shared-brian/ that you want to share with the guest OS (Sabayon Linux), and the username in the guest OS is ‘fitzcarraldo‘.

1. In the VM VirtualBox Manager window, select ‘Settings’ > ‘Shared Folders’ for the VM. Click on ‘Machine Folders’ in the Folders List and then on the ‘Add New Shared Folder’ icon. Specify the folder path /home/brian/Shared-brian, and tick ‘Auto-mount’ and ‘Make Permanent’.

2. Start the VM, login as user fitzcarraldo and open a terminal window. If /boot is on a separate partition, make sure it is mounted.

3. Use the usual Entropy package manager commands to bring the guest OS installation up to date and to install the latest Sabayon Linux kernel image (see one of my earlier posts), then reboot the VM. If /boot is on a separate partition, make sure it is mounted.

4. If the VirtualBox Guest Additions package from the Sabayon Linux Entropy repository is currently installed in the guest OS, uninstall it. If the package has not yet been installed, install it and then uninstall it.

fitzcarraldo@sabayon ~ $ sudo equo remove virtualbox-guest-additions

5. Check if you are in the ‘vboxsf’ and ‘vboxguest’ groups:

fitzcarraldo@sabayon ~ $ groups

If you are not, add the user to the two groups:

fitzcarraldo@sabayon ~ $ sudo usermod -a -G vboxsf,vboxguest fitzcarraldo

6. Check if the latest GNU compiler collection and kernel sources have been installed. If not, install them:

fitzcarraldo@sabayon ~ $ sudo equo install sabayon-sources gcc

7. Check if the Linux kernel headers have been installed. If not, install that package too:

fitzcarraldo@sabayon ~ $ sudo install linux-headers

8. In the menu bar of the VM’s window, select ‘Devices’ > ‘Insert Guest Additions CD Image…’. If you are asked if you want to download the disk image file from the Internet, click on ‘Download’.

9. Use the guest OS’s File Manager to check that the Guest Additions virtual CD is mounted. If it is not, use the File Manager to mount it.

10. Install the VirtualBox Guest Additions from the virtual CD:

fitzcarraldo@sabayon ~ $ sudo /run/media/fitzcarraldo/VBOXADDITIONS_5.1.34_121010/VBoxLinuxAdditions.run

Ignore any warning message about the remnants of an existing version of the Guest Addtions still being installed. Answer ‘yes‘ to the prompt ‘Do you wish to continue [yes or no]‘. There should be no error messages in the terminal output if the GCC, kernel sources and linux kernel headers have already been installed (see the earlier steps above).

11. Reboot the VM and login.

12. In the directory /media/sf_Shared-brian/ in the guest OS you should now see the files that are in the shared folder /home/brian/Shared-brian/ in the host OS. VirtualBox automatically adds the ‘sf_‘ suffix to the directory name in the guest OS, and it stands for ‘shared folder’.

13. In file managers such as GNOME’s Nautilus, MATE’s Caja, LXDE/LXQt’s PCManFM and Xfce’s Thunar you should see the folder /media/sf_Shared-brian listed in the left panel. In KDE’s Dolphin you can right-click in the left panel and add an entry for /media/sf_Shared-brian or, optionally, right-click in the main window and select ‘Create New’ > ‘Basic link to file or directory…’ and create a link in your home directory to /media/sf_Shared-brian/.

I have used the above procedure with recent spins of Sabayon Linux (KDE, GNOME, MATE, Xfce and LXQt), and it works consistently.