i3lock - PAM fingerprint misbehaving when called from service.

[KaniDev]

[X] Bug
[ ] Feature Request
[ ] Other (Please describe in detail)

I have PAM authentication for fingerprint support in /etc/pam.d/i3lock like this:

auth sufficient pam_unix.so try_first_pass likeauth nullok
auth sufficient pam_fprintd.so
auth include system-local-login # For Arch/Gentoo

Current Behavior

When calling i3lock from terminal / i3 shortcut, pressing enter with an empty password and placing my finger on the reader works as expected, and the lock is lifted. Typing the password and pressing enter also works normally.

When it's called from a systemctl service, like the one i have set up on sleep.target:

[Unit]
Description=Lock screen on sleep
Before=sleep.target

[Service]
User=kani
Type=forking
Environment=DISPLAY=:0
ExecStart=/home/kani/.config/i3/scripts/blur-lock

[Install]
WantedBy=sleep.target

the password still works as intended, but the fingerprint method just diplays the wrong-test message, as if my finger was not recognized anymore.
(The script is just a call to i3lock with indicator parameters, I did try calling only the i3lock binary from the service, didn't change anything)

Expected Behavior

The fingerprint gets recognized normally and unlocks, even when i3lock is called from a service.

Reproduction Instructions

• Enable PAM for i3lock in /etc/pam.d/i3lock
• Call i3lock from a systemctl service
• Press enter with an empty / wrong password and authenticate with PAM - fingerprint

Environment

Output of i3lock -v:

i3lock: version 2.13.c.4 © 2010 Michael Stapelberg, © 2015 Cassandra Fox, © 2021 Raymond Li 

[stapelberg]

I don’t know why this happens or how to fix it, but I’d be surprised if this was a bug in i3lock itself.

i3lock only uses PAM, so perhaps you could test with other screen lockers that use PAM to see if the issue is on the PAM side or on the screen locker side, and if the latter, if it’s i3lock-specific or not.

[stapelberg]

Closing this issue; more PAM improvements are tracked in #217