Howdy: Module not being called in mate lockscreen

[arifeinberg]

I'm running ubuntu-mate and I have howdy working normally when I sudo or login through lightdm, but when I lock my screen, I can only unlock with my password. The webcam never turns on when I get back to the lockscreen. My last computer (also ubuntu-mate) had a fingerprint reader with a similarly configured common-auth file, and the lock screen on that computer did take a fingerprint before asking for a password.

[boltgolt]

You seem to have a talent for discovering rare bugs ;)

I'm quite lost on this one, it might be handling sessions incorrectly? Does sudo -i work?

[boltgolt]

Also, could you take a look at the last lines in /var/log/auth.log?

[arifeinberg]

sudo -i works fine, but here's auth.log when I log in from the screensaver:
Apr 26 17:58:11 bartlet /lib/security/howdy/pam.py[16770]: Can not open module: Permission denied

Fascinating - I wonder if my user is trying to call the module?

[arifeinberg]

Changed permissions on pam.py to 750, but then when I went to unlock from screensaver saw this in auth.log:Apr 26 18:01:16 bartlet /lib/security/howdy/pam.py[17152]: File "/lib/security/howdy/pam.py", line 53, in pam_sm_authenticate
Apr 26 18:01:16 bartlet /lib/security/howdy/pam.py[17152]: return doAuth(pamh)
Apr 26 18:01:16 bartlet /lib/security/howdy/pam.py[17152]: File "/lib/security/howdy/pam.py", line 19, in doAuth
Apr 26 18:01:16 bartlet /lib/security/howdy/pam.py[17152]: if config.get("core", "disabled") == "true":
Apr 26 18:01:16 bartlet /lib/security/howdy/pam.py[17152]: File "/usr/lib/python2.7/ConfigParser.py", line 607, in get
Apr 26 18:01:16 bartlet /lib/security/howdy/pam.py[17152]: raise NoSectionError(section)
Apr 26 18:01:16 bartlet /lib/security/howdy/pam.py[17152]: NoSectionError: No section: 'core'

[boltgolt]

Both should be impossible, what does your config.ini look like?

[arifeinberg]

https://pastebin.com/ziYiQZbF

[arifeinberg]

So I changed the permissions of the howdy directory to 755, then tried again. Now howdy runs, and the login window says I've been identified, but then it still won't let me in without a password. auth.log:
Apr 26 18:18:09 bartlet /lib/security/howdy/pam.py[19603]: Traceback (most recent call last):
Apr 26 18:18:09 bartlet /lib/security/howdy/pam.py[19603]: File "/lib/security/howdy/pam.py", line 53, in pam_sm_authenticate
Apr 26 18:18:09 bartlet /lib/security/howdy/pam.py[19603]: return doAuth(pamh)
Apr 26 18:18:09 bartlet /lib/security/howdy/pam.py[19603]: File "/lib/security/howdy/pam.py", line 38, in doAuth
Apr 26 18:18:09 bartlet /lib/security/howdy/pam.py[19603]: pamh.conversation(pamh.Message(pamh.PAM_TEXT_INFO, "Identified face as " + pamh.get_user()))
Apr 26 18:18:09 bartlet /lib/security/howdy/pam.py[19603]: PamException: Conversation error

[boltgolt]

For anyone having the same issue: @arifeinberg has opened a ticked in the PAM library here.

[sd65]

So I have a workaround. Please note I'm using Cinnamon Screensaver (should work on Mate too).

First as you said:
sudo chmod -R 755 /lib/security/howdy/

Then:
sudo howdy config
And set no_confirmation to true.

It's crashing when sending the confirmation message, so disabling it makes the trick. :)

[boltgolt]

Thanks so much for figuring this out! I'll add it to the FAQ if i ever get around to writing it.

[Tatsh]

I ran into this issue. The models directory and the files inside must be world-readable.

[papermache]

So I have a workaround. Please note I'm using Cinnamon Screensaver (should work on Mate too).

First as you said:
sudo chmod -R 755 /lib/security/howdy/

Then:
sudo howdy config
And set no_confirmation to true.

It's crashing when sending the confirmation message, so disabling it makes the trick. :)

Can confirm this works on Cinnamon.

[djshaji]

This does not work on Fedora release 32 (Rawhide) Mate 1.22.3

sudo works, LightDM works, but not the mate lockscreen. I tried making /lib64/security/howdy 0775, but it doesn't work. I've got no /var/log/auth either. Any other ideas?

[exander77]

Is this secure, to have these files world readable?

[boltgolt]

Readable shouldn't be a big issue, but don't make it writable

[kamushadenes]

Can confirm making /lib/security/howdy/ world-readable solved an issue I was facing with swaylock.

Can this be the default?

[bananasmoothii]

Hi, I got this issue with clearing all faces (sudo howdy clear) and creating models with the -U flag (sudo howdy -U <username> add)