Introduction
What is it with Linux and lock screens?! There are umpteen posts on the Web by Linux users having trouble with lock screens, particularly the LightDM session locker Light Locker. Well, here is my contribution.
Lubuntu 17.10 is installed on my family’s desktop PC (single seat, multiple users). Lubuntu 17.10 uses systemd-logind, LightDM, Light Locker and Xfce Power Manager, and they do not work properly holistically in my experience. To confuse matters further, Lubuntu 17.10 also has XScreenSaver installed, which also has lock-screen capabilities.
In Lubuntu 17.10 on my family’s desktop PC, Light Locker displays the LightDM GTK+ Greeter screen when anyone wakes/resumes the PC from suspension by pressing a key on the USB keyboard, and users should then be able to log in by selecting their username from the pull-down list on the LightDM GTK+ Greeter screen and entering their password. However, if only a single user session existed when the PC suspended automatically (i.e. by timeout), upon resuming from suspension a black screen with a white padlock icon and the following message in white/grey text from light-locker would appear:
This session is locked
You’ll be redirected to the unlock
dialog automatically in a few seconds
But then nothing else happened; the above-mentioned message remained on display. I could press Ctrl+Alt+F1, login on TTY1 and enter the command ‘loginctl unlock-sessions‘ to get back to the Desktop, but that is not something the rest of my family would know how to do or be comfortable doing. In any case, I have only given sudo rights to one other member of the family.
Another problem would occur if the PC was left to suspend automatically with more than one user still logged in (i.e. more than one session). Although Light Locker would display the LightDM GTK+ Greeter screen upon resuming from suspension, and users could select their username from the pull-down list and enter their password, the LightDM GTK+ Greeter screen would remain on display and it would no longer be possible to re-enter a password (although it was still possible to select users from the pull-down list of users, and to select ‘Suspend’, ‘Restart…’ and ‘Shutdown…’ from the pull-down power menu). However, if users suspended the PC manually by selecting ‘Logout’ > ‘Lock Screen’ from the Lubuntu Menu, upon waking/resuming it was possible to enter their password on the LightDM GTK+ Greeter screen to return to their Desktop.
In this article I explain what I did to try and rectify these problems.
By the way, note that hibernation is disabled by default in Lubuntu 17.10 and you may need to make further changes if you want to enable hibernation as well. For example, does the PC have a swap partition, and is it large enough to enable hibernation? Also see the article: How to Enable Hibernate in Ubuntu 17.10 for possible help.
Modifications
The package light-locker-settings was not installed in Lubuntu 17.10. Do not install it. If it happens to be installed do not use ‘Preferences’ > ‘Light Locker Settings’, as it makes the Exec entry in the user’s light-locker.desktop file just ‘Exec=‘ or ‘Exec=light-locker‘. In fact, having installed light-locker-settings manually to check what could be configured via its GUI, I uninstalled it in order to stop anyone using it. (Under ‘Screensaver’, the Light Locker Settings GUI displays the following message: ‘Your screensaver settings are managed by Xfce Power Manager.’ and there is a button ‘Open’ to click on to launch the Xfce Power Manager settings GUI.) Presumably this was why it was not included when Lubuntu 17.10 was first installed to the HDD.
1. I removed any light-locker.desktop files of individual users, leaving only the system-wide file:
$ sudo rm /home/*/.config/autostart/light-locker.desktop
$ sudo updatedb
$ locate light-locker.desktop
/etc/xdg/autostart/light-locker.desktop
2. I edited the system-wide light-locker.desktop file to contain the following command to execute Light Locker:
$ grep Exec /etc/xdg/autostart/light-locker.desktop
Exec=light-locker --lock-after-screensaver=0 --no-lock-on-suspend --no-lock-on-lid --no-idle-hint
3. I created the Bash script file /lib/systemd/system-sleep/hang-fix for systemd to run when suspending and resuming from suspension, with the permissions shown:
#!/bin/sh
case "$1" in
pre|suspend|hibernate)
date | tr -d '\n' >> /home/fitzcarraldo/sleep.log
echo " going to sleep." >> /home/fitzcarraldo/sleep.log
chvt 1
loginctl unlock-sessions
;;
post|resume|thaw)
date | tr -d '\n' >> /home/fitzcarraldo/sleep.log
echo " waking from sleep." >> /home/fitzcarraldo/sleep.log
loginctl lock-sessions
chvt 7
;;
*)
exit $NA
;;
esac
exit 0
$ sudo chmod 755 /lib/systemd/system-sleep/hang-fix
$ ls -la /lib/systemd/system-sleep/hang-fix
-rwxr-xr-x 1 root root 581 Apr 14 08:09 /lib/systemd/system-sleep/hang-fix
The above script is a hack to get around the problem of Light Locker resuming and apparently not knowing which session to unlock. I used the loginctl commands in this script rather than the Xfce Power Manager suspend options and Light Locker options such as ‘--late-locking‘ and ‘--lock-on-suspend‘ because I found that the Light Locker options and the Xfce Power Manager options did not fix the problem.
4. I created two files for Polkit (to cover all Polkit versions to date) with the permissions as shown below.
4.1 The file /etc/polkit-1/rules.d/85-suspend.rules with the following contents:
polkit.addRule(function(action, subject) {
if (action.id == "org.freedesktop.login1.suspend" ||
action.id == "org.freedesktop.login1.suspend-multiple-sessions" ||
action.id == "org.freedesktop.login1.hibernate" ||
action.id == "org.freedesktop.login1.hibernate-multiple-sessions")
{
return polkit.Result.YES;
}
});
If you do not have a swap partition large enough to enable hibernation, or you do not want to allow the PC to hibernate, use the following instead of the above:
polkit.addRule(function(action, subject) {
if (action.id == "org.freedesktop.login1.suspend" ||
action.id == "org.freedesktop.login1.suspend-multiple-sessions")
{
return polkit.Result.YES;
}
});
$ sudo chmod 755 /etc/polkit-1/rules.d
$ sudo chmod 644 /etc/polkit-1/rules.d/85-suspend.rules
$ ls -la /etc/polkit-1/rules.d/85-suspend.rules
-rw-r--r-- 1 root root 359 Apr 19 22:14 /etc/polkit-1/rules.d/85-suspend.rules
4.2 The file /var/lib/polkit-1/localauthority/50-local.d/50-enable-suspend-on-lockscreen.pkla with the following contents:
[Allow suspending with lock screen]
Identity=unix-user:*
Action=org.freedesktop.login1.suspend;org.freedesktop.login1.suspend-multiple-sessions;org.freedesktop.login1.hibernate;org.freedesktop.login1.hibernate-multiple-sessions
ResultAny=yes
ResultInactive=yes
ResultActive=yes
If you do not have a swap partition large enough to enable hibernation, or you do not want to allow the PC to hibernate, use the following instead of the above:
[Allow suspending with lock screen]
Identity=unix-user:*
Action=org.freedesktop.login1.suspend;org.freedesktop.login1.suspend-multiple-sessions
ResultAny=yes
ResultInactive=yes
ResultActive=yes
$ sudo chmod 644 /var/lib/polkit-1/localauthority/50-local.d/50-enable-suspend-on-lockscreen.pkla
$ sudo ls -la /var/lib/polkit-1/localauthority/50-local.d/50-enable-suspend-on-lockscreen.pkla
-rw-r--r-- 1 root root 191 Apr 20 10:01 /var/lib/polkit-1/localauthority/50-local.d/50-enable-suspend-on-lockscreen.pkla
The above files are intended to get rid of the following error messages in a pop-up window and pop-up notification ballon, respectively, that prevent the OS from suspending automatically:
Authentication
Authentication is required for suspending
the system while other users are logged in.
Power Manager
GDBus.Error:org.freedesktop.DBus.Error.NoReply:
Method call timed out
By the way, the version of Polkit installed currently is 0.105:
$ pkaction --version
pkaction version 0.105
5. I added all users to the users group (although I do not think this is essential):
$ sudo usermod -a -G users fitzcarraldo
$ sudo usermod -a -G users molly
$ sudo usermod -a -G users aquilino
$ sudo usermod -a -G users cholo
$ sudo usermod -a -G users paul
6. I made sure the XScreenSaver settings for each user are as follows:
XScreenSaver (‘Preferences’ > ‘Screensaver’)
The ‘Display Modes’ tab has:
- ‘Mode: Disable Screen Saver’
The ‘Advanced’ tab has everything unticked on it except for:
7. I made sure the Xfce Power Manager settings for each user are as follows:
Xfce Power Manager (‘Preferences’ > ‘Power Manager’)
The ‘General’ tab has:
Buttons
- When power button is pressed: Ask
- When sleep button is pressed: Do nothing
- When hibernate button is pressed: Do nothing
Appearance
- Show notifications is ticked
- Show system tray icon is ticked
The ‘System’ tab has:
System power saving
- System sleep mode: Suspend
- When inactive for 15 Minutes (You can make the number of minutes different for each user, if you want.)
The ‘Display’ tab has:
Display power management settings
- ‘Handle display power management’ is ticked
- Blank after: 5 Minutes
- Put to sleep after: Never
- Switch off after: Never
The ‘Security’ tab has:
Light Locker
- Automatically lock the session: Never
- Delay locking after screensaver for: ‘1 Seconds’ is greyed out
- ‘Lock screen when system is going for sleep’ is not ticked
8. I made sure the ‘Default Applications for LXSession’ settings for each user are as follows:
Select ‘Preferences’ > ‘Default Applications for LXSession’, click on ‘Autostart’ and untick ‘XScreenSaver’ if it is ticked. ‘Power Manager’ and ‘Screen Locker’ should already be ticked, so tick them if they are not. I left ‘PolicyKit Handler’ and ‘PolicyKit Authentication Agent’ unticked (Lubuntu 17.10 uses Polkit, the successor to PolicyKit).
9. Although Lubuntu 17.10 does not use GNOME, I found that gsettings is installed. I did the following just in case, although I believe it is irrelevant in this particular case:
$ gsettings --version
2.54.1
$ gsettings set org.gnome.desktop.screensaver ubuntu-lock-on-suspend 'false'
$ gsettings get org.gnome.desktop.screensaver ubuntu-lock-on-suspend
false
$ gsettings set org.gnome.desktop.screensaver lock-enabled 'false'
$ gsettings get org.gnome.desktop.screensaver lock-enabled
false
Conclusion
After doing all the above, upon resuming from Suspend-to-RAM on most, but not all, occasions it is now possible to select any username on the LightDM GTK+ Greeter screen, enter that user’s password and successfully display the user’s Desktop. The LightDM GTK+ Greeter screen no longer hangs/freezes every time.
When more than one user is logged in (i.e. there is more than one session), the PC will suspend automatically if there is no user activity in a particular session during the configured timeout period for that session. Pressing a key on the USB keyboard will then wake the PC and display the LightDM GTK+ Greeter screen. The desired username can then be selected and the corresponding password entered. The following is an example of the sort of thing that can happen:
- User
fitzcarraldo (timeout configured as 30 minutes) logs in to his account at 09:00 and uses the PC until he locks his session manually (Ctrl+Alt+L) at 09:11.
- User
paul (timeout configured as 15 minutes) logs in to his account at 09:15 and uses the PC until he locks his session manually at 09:23.
- User
molly (timeout configured as 45 minutes) logs in to her account at 09:25 and uses the PC for several hours.
- At 09:38, while user
molly is using the PC, the PC automatically suspends to RAM (15 minutes after user paul stopped using his session). User molly has to wake the PC from suspension. Nothing is lost.
- At 09:41, while user
molly is using the PC, the PC automatically suspends to RAM (30 minutes after user fitzcarraldo stopped using his session). User molly has to wake the PC from suspension. Nothing is lost.
To avoid scenarios such as the above, if a user does not need the session any longer it is better to log out rather than leave the session in existence.
Fitzcarraldo's Blog 