cinnamon-screensaver-pam-helper ships without its setuid bit — lock screen hangs/fails on every unlock #513

Package: cinnamon-screensaver 6.6.1+gigi
Distro: LMDE 7 (gigi), kernel 6.12.101+deb13-amd64 / 6.12.105+deb13-amd64
Reinstall tested: sudo apt install --reinstall cinnamon-screensaver — issue persists after reinstall

Problem

/usr/libexec/cinnamon-screensaver/cinnamon-screensaver-pam-helper is installed as mode 0755 (-rwxr-xr-x) instead of the setuid-root 4755 (-rwsr-xr-x) it needs to perform PAM auth/account checks. Without the setuid bit, every privileged operation it attempts fails with EPERM, logged on essentially every single lock/unlock cycle:

cinnamon-screensaver-pam-helper: pam_ecryptfs: seteuid error
cinnamon-screensaver-pam-helper: pam_unix(cinnamon-screensaver:account): setuid failed: Operation not permitted
org.cinnamon.ScreenSaver: Error in sys.excepthook: (x3)

In practice this manifests as the lock screen becoming unresponsive/stalling, especially noticeable when a fingerprint-unlock attempt is also in flight (fprintd.service running concurrently) — it looks like a full GUI freeze from the user's side, confirmed via journalctl/syslog correlation that the kernel and other system services kept running normally throughout, so it's isolated to the screensaver/PAM helper, not a system-wide hang.

This is likely the same underlying issue as #289, which never got a root cause.

Root cause (traced in packaging)

debian/rules builds with debhelper-compat (= 13). Modern dh_fixperms strips setuid/setgid bits from all installed files by default; the standard debhelper opt-back-in mechanism is a debian/permissions file declaring exceptions. This repo has no debian/permissions file, and the existing execute_after_dh_fixperms override in debian/rules only fixes permissions on two unrelated files (CScreensaver-1.0.typelib and libcscreensaver.so) — it never restores cinnamon-screensaver-pam-helper to 4755. So dh_fixperms silently strips the bit at build time on every build, and it ships broken in the .deb itself.

Reproduction

ls -l /usr/libexec/cinnamon-screensaver/cinnamon-screensaver-pam-helper
# -rwxr-xr-x  (should be -rwsr-xr-x)

Workaround

sudo chmod u+s /usr/libexec/cinnamon-screensaver/cinnamon-screensaver-pam-helper
sudo dpkg-statoverride --add root root 4755 /usr/libexec/cinnamon-screensaver/cinnamon-screensaver-pam-helper

(the statoverride is needed because a plain chmod gets wiped by the next package upgrade, which will re-ship the same broken permission)

Suggested real fix

Add a debian/permissions file (or equivalent debhelper-13 mechanism) declaring:

usr/libexec/cinnamon-screensaver/cinnamon-screensaver-pam-helper 4755 root

so dh_fixperms restores the setuid bit correctly for every build/upgrade.