In my experience this is required to get Plasma 6 Wayland to work on
my GTX 1080 with the proprietary driver. Otherwise, I get errors in my
`journalctl --user` about "MESA-LOADER: failed to open simpledrm" (among
many other things) and Plasma just presents a black screen with a cursor
and nothing else.
I discovered this by searching the aforementioned error and found
[this Arch Linux forum post][0] and some further clicking around led
me to [this section on the ArchWiki][1], which is where I got the
`versionAtLeast` value from.
Tested with `nvidia-x11-555.58-6.9.7`.
[0]: https://bbs.archlinux.org/viewtopic.php?id=293741
[1]: https://wiki.archlinux.org/title/NVIDIA#DRM_kernel_mode_setting
We introduced the gdm-fingerprint.pam in 9d41fe6fcc.
We used the [upstream Arch config] as a template, which contains an extended control field that jumps over **one** immediately-following `auth` rule unless `pam_gdm.so` succeeds.
But we decided to not include `pam_gnome_keyring.so` so there was no rule to skip over, resulting in a broken control flow and the PAM module failing with “PAM bad jump in stack”, breaking the fingerprint authentication in GDM.
Let’s actually add `pam_gnome_keyring.so`, like the Arch config does. Because we are creating the PAM file using the `text` option, `security.pam.services.gdm-fingerprint.enableGnomeKeyring` does not do anything so we need to do it manually.
For the case where gnome-keyring is not enabled, we could add a no-op rule like `optional pam_permit.so` after `pam_gdm.so` so that the branching always has something to jump over but it will be simpler to just make the both conditional. There are no further `auth` rules that could benefit from `pam_gdm.so` doing something so it should be fine.
Unlike in Arch, we are not going to invoke `pam_gnome_keyring.so` in a `session` rule since that is already done by the included `login` module.
[upstream Arch config]: 81ee658c11/data/pam-arch/gdm-fingerprint.pam
The `optional pam_permit.so` comes from the [upstream Arch config] we used as a template in 9d41fe6fcc. But I do not think it does anything in this position – see also the discussion at https://bbs.archlinux.org/viewtopic.php?id=245892 – so let’s just remove it.
Let’s also add a comment about disabling `fprintAuth` and a blank line for clarity.
[upstream Arch config]: 81ee658c11/data/pam-arch/gdm-fingerprint.pam
`gdm-autologin` and `gdm-password` PAM modules are defined using the `text` option, so the option here is a no-op.
Furthermore, `gdm-password` already includes `login` for all module types,
and that invokes `pam_gnome_keyring.so` in the same way Arch’s `gdm-password` module would:
81ee658c11/data/pam-arch/gdm-password.pam
This reverts commit c24c7933ba.
