> For me, /etc/dconf/profile/gdm doesn't exist and never has (at least since 2020, which is where etckeeper's records for this system begin). Adsys isn't installed.
That seems to be a different bug then and should be tracked separately, this issue is about the bug caused by adsys. ** Description changed: - ======================================================================== - DESCRIPTION: - ======================================================================== + [ Impact ] + + On Ubuntu 26.04 LTS (Resolute), applying ADSys machine policies creates + /etc/dconf/profile/gdm, which takes precedence over GDM's vendor profile. + The released ADSys package does not preserve the vendor profile's sources, + including: + + file-db:/var/lib/gdm3/greeter-dconf-defaults + + Without those defaults, the greeter starts an Ubuntu desktop session + instead of the login screen, preventing graphical login. + + This was fixed in https://github.com/ubuntu/adsys/pull/1507. The fix + preserves vendor sources when generating dconf profiles and repairs + legacy ADSys-generated profiles on the next policy refresh. + Administrator-managed profiles retain their existing sources. + + [ Test Plan ] + + Use a disposable Resolute desktop VM with GDM 50, joined to an AD domain + and configured to receive ADSys policies. + + 1. Reproduce with released adsys 0.16.4ubuntu1.1. + + Configure a machine GPO with a login banner and a user GPO with a + visible, locked dconf setting + (e.g. org.gnome.desktop.interface clock-format set to'12h'). + Apply machine policies: + + sudo adsysctl policy update -m + cat /etc/dconf/profile/gdm + cat /usr/share/dconf/profile/gdm + DCONF_PROFILE=gdm gsettings get org.gnome.desktop.session session-name + + Confirm the local profile omits the vendor file-db source and the + session-name lookup returns 'ubuntu' rather than 'gnome-login'. + + sudo systemctl restart gdm3 + + Confirm a desktop shell appears under the greeter account instead + of the login form. + + 2. Verify an in-place upgrade. + + Install adsys 0.16.4ubuntu1.2 from resolute-proposed without deleting + the existing profile or policy cache. Then run: + + sudo systemctl restart adsysd + sudo adsysctl policy update -m + cat /etc/dconf/profile/gdm + DCONF_PROFILE=gdm gsettings get org.gnome.desktop.session session-name + + Confirm the profile preserves the vendor sources, followed by + system-db:gdm and system-db:machine, and the lookup returns + 'gnome-login'. Refresh again and confirm the profile is unchanged. + + Restart GDM. Confirm the login form and configured banner appear, + and graphical login succeeds with both local and AD accounts. + Confirm the user policy remains applied and locked. + + 3. Check profile ownership and greeter handling. + + In separate VM snapshots, verify that: + - Creating a fresh profile preserves the vendor defaults. + - An administrator-managed profile retains its custom sources after + repeated refreshes, without duplicate ADSys database entries. + - Removing the generated ownership header allows subsequent custom + edits to be preserved. + - Greeter and AD logins still work with SSSD default_domain_suffix + configured, without ADSys ticket lookup failures for the greeter. + + [ Where problems could occur ] + + Profile generation affects user profiles as well as GDM. Incorrect + source ordering or lock handling could change effective settings or + weaken GPO enforcement. Verify both configured values and locks. + + Incorrect ownership detection could overwrite administrator changes. + Exact legacy fallback profiles are intentionally migrated because they + are indistinguishable from profiles generated by older ADSys versions. + + Reading vendor profiles introduces failure paths for unreadable files + or invalid sources, potentially preventing policy application. + + The PAM change skips AD-specific processing for greeter-group members. + Incorrect detection could reject dynamic greeters or skip policy + processing for other users. Verify local and AD logins as well as + greeter startup. + + [ Other Info ] + + Upstream fix: + https://github.com/ubuntu/adsys/pull/1507 + + Resolute backport: + https://github.com/ubuntu/adsys/pull/1555 + + The fix is already shipped in Stonking's adsys 0.17.0. Resolute receives + a targeted backport as 0.16.4ubuntu1.2. + + Manual desktop verification on 3 November 2026 reproduced the failure + with adsys 0.16.4ubuntu1.1 and gdm3 50.1-0ubuntu0.1. An in-place upgrade + to the CI-built candidate + 0.16.4ubuntu1.2+git261103+33+365c39e4~26.04.1 repaired the existing + profile and restored the login screen. Local and AD graphical logins + succeeded; machine and user policies remained applied and locked. + + [ Original Description ] After upgrading gdm3 from 49.2 to 50 on Ubuntu 26.04, the login screen does not appear. Instead the system launches a full GNOME desktop session as the greeter user. This affects all Ubuntu 26.04 systems running gdm3 50~beta-0ubuntu3, regardless of domain membership. Package versions: ----------------- $ dpkg -l gdm3 gnome-session-bin ii gdm3 50~beta-0ubuntu3 amd64 ii gnome-session-bin 50~beta-0ubuntu1 amd64 Environment: ------------ - Ubuntu 26.04 (Resolute) - gdm3 50~beta-0ubuntu3 - Previous working version: gdm3 49.2-1ubuntu4 What is happening: ------------------ The greeter session is defined in: - /usr/share/gdm/greeter/wayland-sessions/gnome-greeter.desktop + /usr/share/gdm/greeter/wayland-sessions/gnome-greeter.desktop This file calls gnome-session with no --session argument: - Exec=gnome-session + Exec=gnome-session gnome-session requires an explicit --session argument to know which session definition to load: - $ gnome-session --help - Application Options: - --session=SESSION_NAME Session to use + $ gnome-session --help + Application Options: + --session=SESSION_NAME Session to use Without it, gnome-session has no session name and falls back to the default "ubuntu" session, causing gnome-shell to launch with --mode=ubuntu instead of --mode=gdm. Confirmed by logs: ------------------ $ journalctl -b | grep "gnome-shell.*mode\|Shell@" systemd: Starting [email protected] - GNOME Shell... gnome-shell: /usr/bin/gnome-shell --mode=ubuntu gnome-shell: Running GNOME Shell (using mutter 50.beta) as a Wayland - display server + display server Instead of the expected: - [email protected] - /usr/bin/gnome-shell --mode=gdm + [email protected] + /usr/bin/gnome-shell --mode=gdm Verified as a packaging bug: ----------------------------- The file was downloaded fresh from the Ubuntu archive and confirmed to ship with the missing argument: - $ apt-get download gdm3=50~beta-0ubuntu3 - $ dpkg-deb -x gdm3_50~beta-0ubuntu3_amd64.deb /tmp/gdm3-50-check - $ cat /tmp/gdm3-50-check/usr/share/gdm/greeter/wayland-sessions/gnome-greeter.desktop - - [Desktop Entry] - Name=GNOME Greeter - Comment=The default GNOME Greeter session - Exec=gnome-session - TryExec=gnome-session - Type=Application - DesktopNames=GNOME-Greeter:GNOME - NoDisplay=true - X-GDM-SessionRegisters=true - X-GDM-CanRunHeadless=true - X-Ubuntu-Gettext-Domain=gdm + $ apt-get download gdm3=50~beta-0ubuntu3 + $ dpkg-deb -x gdm3_50~beta-0ubuntu3_amd64.deb /tmp/gdm3-50-check + $ cat /tmp/gdm3-50-check/usr/share/gdm/greeter/wayland-sessions/gnome-greeter.desktop + + [Desktop Entry] + Name=GNOME Greeter + Comment=The default GNOME Greeter session + Exec=gnome-session + TryExec=gnome-session + Type=Application + DesktopNames=GNOME-Greeter:GNOME + NoDisplay=true + X-GDM-SessionRegisters=true + X-GDM-CanRunHeadless=true + X-Ubuntu-Gettext-Domain=gdm This is not a local modification — the file shipped broken in the package. Why this is a regression from 49.2: ------------------------------------ gdm3 49.2 had no /usr/share/gdm/greeter/wayland-sessions/ directory at all. The greeter was launched differently and did not depend on gnome-session selecting the correct session by name. This is a new code path introduced in gdm3 50 that was not present in 49.2. Fix: ---- The Exec line in gnome-greeter.desktop should be: - Exec=gnome-session --session=gnome-login + Exec=gnome-session --session=gnome-login The corrected file should read: - [Desktop Entry] - Name=GNOME Greeter - Comment=The default GNOME Greeter session - Exec=gnome-session --session=gnome-login - TryExec=gnome-session - Type=Application - DesktopNames=GNOME-Greeter:GNOME - NoDisplay=true - X-GDM-SessionRegisters=true - X-GDM-CanRunHeadless=true - X-Ubuntu-Gettext-Domain=gdm + [Desktop Entry] + Name=GNOME Greeter + Comment=The default GNOME Greeter session + Exec=gnome-session --session=gnome-login + TryExec=gnome-session + Type=Application + DesktopNames=GNOME-Greeter:GNOME + NoDisplay=true + X-GDM-SessionRegisters=true + X-GDM-CanRunHeadless=true + X-Ubuntu-Gettext-Domain=gdm This fix was verified to resolve the issue. After applying the change and restarting gdm3, gnome-shell correctly launched with --mode=gdm and the login screen appeared as expected. Workaround: ----------- Edit /usr/share/gdm/greeter/wayland-sessions/gnome-greeter.desktop and change: - Exec=gnome-session + Exec=gnome-session to: - Exec=gnome-session --session=gnome-login + Exec=gnome-session --session=gnome-login Then restart gdm3: - sudo systemctl restart gdm3 + sudo systemctl restart gdm3 Note: this file is owned by the gdm3 package and will be overwritten on the next gdm3 package upgrade. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2143268 Title: gnome-shell launches in desktop mode instead of greeter mode To manage notifications about this bug go to: https://bugs.launchpad.net/adsys/+bug/2143268/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
