[BUG] PAM failure with home-manager + non-nixOS

[yao-yun]

Note: this issue was originally submitted here: caelestia-dots/caelestia#233

Step 1. Before you submit

• I have read the above instructions and am sure that this is supposed to be posted here.
• I've successfully updated to the latest versions following the updating guide.
• I've successfully updated the system packages to the latest.
• I've ticked the checkboxes without reading their contents

Step 2. Version info

Version info

Note: this is quite possibly inaccurate, as caelestia(-shell/-cli) are installed through home-manager

caelestia -v
Packages:
    caelestia-shell not installed
    caelestia-cli not installed
    caelestia-meta not installed


fatal: not a git repository: '/home/yaoyun/.config/.git'
Caelestia: not installed

Shell: version helper not available

Quickshell: not in PATH

So in addition, here are the relevant parts in my flake.lock:

    "caelestia-cli": {
      "inputs": {
        "caelestia-shell": [
          "caelestia-shell"
        ],
        "nixpkgs": [
          "caelestia-shell",
          "nixpkgs"
        ]
      },
      "locked": {
        "lastModified": 1761392494,
        "narHash": "sha256-Xabw0gwVYKY158DyhNlKopAhjAw54wu7Ws0SmVVrjVA=",
        "owner": "caelestia-dots",
        "repo": "cli",
        "rev": "cc458bf8598c0beab27b5dc4331b0cf2ee654165",
        "type": "github"
      },
      "original": {
        "owner": "caelestia-dots",
        "repo": "cli",
        "type": "github"
      }
    },
    "caelestia-shell": {
      "inputs": {
        "caelestia-cli": "caelestia-cli",
        "nixpkgs": [
          "nixpkgs"
        ],
        "quickshell": "quickshell"
      },
      "locked": {
        "lastModified": 1761746637,
        "narHash": "sha256-t0mId8j2uvwiBM+SGVDv58CwbqXtebaHFX1D9+hdB08=",
        "owner": "caelestia-dots",
        "repo": "shell",
        "rev": "bfd149b256d1364ec320c8a0307966b5d4fde826",
        "type": "github"
      },
      "original": {
        "owner": "caelestia-dots",
        "repo": "shell",
        "type": "github"
      }
    },    
    "quickshell": {
      "inputs": {
        "nixpkgs": [
          "caelestia-shell",
          "nixpkgs"
        ]
      },
      "locked": {
        "lastModified": 1760822546,
        "narHash": "sha256-cy3wJQQzQbZ/EYUfTDuMiP/haPOjkqGgWOPPl7K9oiM=",
        "ref": "refs/heads/master",
        "rev": "3e2ce40b18af943f9ba370ed73565e9f487663ef",
        "revCount": 697,
        "type": "git",
        "url": "https://git.outfoxxed.me/outfoxxed/quickshell"
      },
      "original": {
        "type": "git",
        "url": "https://git.outfoxxed.me/outfoxxed/quickshell"
      }
    },

Step 3. Describe the issue

The lockscreen fails to unlock even with the correct password, if caelestia is installed through home-manager + non-NixOS (Arch, in my case), possibly related to pam. The GUI gives "PW ERROR:", and the logs are as follows.

This might be more about quickshell, but the caelestia flake ships with a bundled and patched version of it, already including a patch about the pam, so I decided to go here first. Sorry in advance if you think this issue is misplaced.

caelestia's logs

Nov 09 18:34:12 yaoyunz16-arch caelestia-shell[57699]:   WARN: CachingImageManager::createCache: failed to read "/home/yaoyun/.face"
Nov 09 18:34:12 yaoyunz16-arch caelestia-shell[57699]:   WARN: CachingImageManager::createCache: failed to read "/home/yaoyun/.face"
Nov 09 18:34:12 yaoyunz16-arch caelestia-shell[57699]:   WARN scene: QML CachingImage at @modules/lock/Center.qml[104:9]: Cannot open: file:///home/yaoyun/.face
Nov 09 18:34:12 yaoyunz16-arch caelestia-shell[57699]:   WARN scene: QML CachingImage at @modules/lock/Center.qml[104:9]: Cannot open: file:///home/yaoyun/.face
Nov 09 18:34:15 yaoyunz16-arch caelestia-shell[58367]: quickshell.service.pam.subprocess: Waiting for parent confirmation...
Nov 09 18:34:15 yaoyunz16-arch caelestia-shell[58367]: quickshell.service.pam.subprocess: Starting pam session for user "yaoyun" with config "passwd" in dir "/nix/store/2d99y80lyjji7dr0s9ij53bzdqwbc9c8-caelestia-shell-1.0.0/share/caelestia-shell/assets/pam.d"
Nov 09 18:34:15 yaoyunz16-arch quickshell[58367]: PAM _pam_init_handlers: no default config other
Nov 09 18:34:15 yaoyunz16-arch caelestia-shell[58367]: quickshell.service.pam.subprocess: Relaying pam message: "Password: " echo: 0 error: 0 responseRequired: 1
Nov 09 18:34:15 yaoyunz16-arch quickshell[58367]: pam_unix(passwd:auth): authentication failure; logname=yaoyun uid=1000 euid=1000 tty= ruser= rhost=  user=yaoyun
Nov 09 18:34:17 yaoyunz16-arch caelestia-shell[58367]: quickshell.service.pam.subprocess: Got response for request.quickshell.service.pam.subprocess: Error while authenticating: "Authentication service cannot retrieve authentication info" (code 9)

---

I found a relevant bug report of home-manager in nix-community/home-manager#7027 , where a few workarounds can be found, though mostly for nixpkg's packages. I've tried https://github.com/Cu3PO42/pam_shim as follows:

imports = [
    inputs.pam_shim.homeModules.default
]
pamShim.enable = true;
programs.caelestia.package = config.lib.pamShim.replacePam inputs.caelestia-shell.packages.${system}.with-cli;

But quickshell fails to start, with

/nix/store/4fhxb1lmcvxpklhrrgjf3dsjdnq98vmj-quickshell-wrapped-0.2.0/bin/quickshell: symbol lookup error: /nix/store/4fhxb1lmcvxpklhrrgjf3dsjdnq98vmj-quickshell-wrapped-0.2.0/bin/quickshell: undefined symbol: pam_strerror, version LIBPAM_1.0

Reminder

• I agree that it's usually impossible for others to help me without my logs.

[Cu3PO42]

This limitation applies to all applications built with Nix running on non-NixOS, it's not specific to Caelestia, nor Quickshell. The bug report you have found describes the various problems.

But quickshell fails to start, with

/nix/store/4fhxb1lmcvxpklhrrgjf3dsjdnq98vmj-quickshell-wrapped-0.2.0/bin/quickshell: symbol lookup error: /nix/store/4fhxb1lmcvxpklhrrgjf3dsjdnq98vmj-quickshell-wrapped-0.2.0/bin/quickshell: undefined symbol: pam_strerror, version LIBPAM_1.0

As described in the README of pam_shim, it doesn't implement the whole API surface of PAM, Quickshell using one of the unsupported functions. Please try the next branch, I have implemented support for any missing symbols from libpam.so.0 there (but only performed light testing so far).

[yao-yun]

@Cu3PO42 Thank you for your prompt reply. I can confirm that with the next branch of pam_shim, the pam_strerror symbol error in quickshell is gone, and caelestia's lock-screen is working. Not sure if there's anything further to test though, will report issues in pam_shim if any encountered.

I'll leave this issue open to track the need for the pam workaround. If the nix-community/home-manager#7027 is resolved with a standard packaging solution for non-NixOS, caelestia's flake might need to be updated.

[Khush-dev]

Hi, thanks @Cu3PO42, password authentication works well for me too
do you have plans to add fingerprint authentication?

[Cu3PO42]

do you have plans to add fingerprint authentication?

pam_shim has no influence on the authentication method used, it supports passwords as well as fingerprints. You simply need to make sure PAM is configured appropriately, specifically for the configuration used by Caelestia.

[Khush-dev]

You are correct, thanks! i checked caelestia logs and found

Nov 24 00:31:19 dell caelestia-shell[57450]: quickshell.service.pam.subprocess: Starting pam session for user "khush" with config "fprint" in dir "/nix/store/cbymckjn6qaw3ncvmsx89b7bxak43vsh-caelestia-shell-1.0.0/share/caelestia-shell/assets/pam.d"
Nov 24 00:31:19 dell pam_shim_server[57451]: PAM unable to dlopen(/run/current-system/sw/lib/security/pam_fprintd.so): /run/current-system/sw/lib/security/pam_fprintd.so: cannot open shared object file: No such file or directory
Nov 24 00:31:19 dell pam_shim_server[57451]: PAM adding faulty module: /run/current-system/sw/lib/security/pam_fprintd.so
Nov 24 00:31:19 dell caelestia-shell[57450]: quickshell.service.pam.subprocess: Error while authenticating: "Module is unknown" (code 28)
Nov 24 00:31:19 dell pam_shim_server[57451]: PAM _pam_init_handlers: no default config other

which is because caelestia hardcodes the location of pam_fprintd.so to /run/current-system/sw/lib/security/pam_fprintd.so
fixed it by simply removing the corresponding line

programs.caelestia.package = config.lib.pamShim.replacePam (
  inputs.caelestia-shell.packages.${pkgs.stdenv.hostPlatform.system}.with-cli.overrideAttrs (
    finalAttrs: previousAttrs: {
      prePatch = ''
        substituteInPlace shell.qml \
          --replace-fail 'ShellRoot {' 'ShellRoot {  settings.watchFiles: false'
      '';
    }
  )
);

not sure how to add this to caelestia without breaking other stuff. but this works for me, for now

[Markus328]

I think that hardcoding is not needed anyway, any system should be able to look for libraries (in this case, PAM module). I will test this in NixOS, and maybe make an PR, but I'm very sure removing wont break anything

[soramanew]

The hardcoding was needed unfortunately, I tested this on a nix system a while back and it couldn't find the .so file at all.