#1140888 openrc: Userservices need extra pam tweaks to work

Package:
openrc
Source:
openrc
Description:
dependency based service manager (runlevel change mechanism)
Submitter:
Matthias Geiger
Date:
2026-06-28 07:47:02 UTC
Severity:
normal
#1140888#5
Date:
2026-06-27 21:53:34 UTC
From:
To:
Hi,

thanks for maintaining openrc. After talking with the maintainer on IRC,
I think currently, openrc user services do not work. Copying attached
service to /etc/user/init.d and running rc-update --user
gnome-keyring-daemon add errors because it can't find the needed
runlevels in .config/rc/runlevels. This should be created automatically
by pam_openrc according to upstream:

23:15 < navi> werdahias: common-session i'd say
23:15 < navi> gentoo puts it in system-login
23:15 < navi> you also want to put common_session into /etc/pam.d/openrc-run or similar
23:16 < werdahias> navi: thanks!

/etc/pam.d/common-session has pam_elogind in there, but not pam_openrc;
so I believe it should be added there. PAM is not really my area of
expertise, happy to test any changes.

best,

werdahias


- -- System Information:
Debian Release: forky/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 7.0.7+deb14-amd64 (SMP w/16 CPU threads; PREEMPT)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: OpenRC (via /run/openrc), PID 1: init
LSM: AppArmor: enabled

Versions of packages openrc depends on:
ii  insserv      1.27.0-1
ii  libaudit1    1:4.1.2-1+b1
ii  libc6        2.42-17
ii  libcap2      1:2.78-1
ii  libeinfo1    0.63.2-1
ii  libpam0g     1.7.0-6
ii  librc1t64    0.63.2-1
ii  libselinux1  3.10-1
ii  mount        2.42.2-1

openrc recommends no packages.

Versions of packages openrc suggests:
pn  policycoreutils  <none>
ii  sysvinit-core    3.18-1

- -- no debconf information
-----BEGIN PGP SIGNATURE-----

iIsEARYKADMWIQQUWTv/Sl6/b+DpcW7svtu2B7myvgUCakBGWRUcd2VyZGFoaWFz
QGRlYmlhbi5vcmcACgkQ7L7btge5sr40FAEA7K1txql1iqbo/Jx4BDKxhOI9dZi6
qS/EmAgpbwbEWO0A/3FRhoAFjHS62Dftd65cPOhZmnKksv7zJvFS2KMa7pMH
=4549
-----END PGP SIGNATURE-----

#1140888#8
Date:
2026-06-28 07:44:53 UTC
From:
To:
Matthias,

I think this is already in place, but disabled by default. See changelog for
0.63-1:

   * openrc --user: add pam-auth-update(8) config, disabled by default.

If you run

 sudo pam-auth-update

you can enable openrc pam session.

I suppose there is a question if it should be enabled by default.

Best wishes

Mark