Sudo fails with access denied (thinks that is remote)

[ACR36940]

Which version of pam_usb are you running?

issue-416

Which distribution are you using?

Linux Mint zena 22.3 x86_64

Which login manager and desktop environment are you using?

Cinnamon 6.6.7

What happened?

After installing the libpam package from issue-416 dropbox link worked perfectly until today that
a sudo bash in a terminal drop a access denied
Checking the logs after putting a debug in pam_usb.conf

	<defaults>
		<option name="debug">true</option>

		<!-- Example:
						<option name="debug">true</option>
						<option name="deny_remote">true</option>
				-->
	</defaults>

This shows in the log

2026-05-27T17:54:30.291434+02:00 blade pam_usb[2267372]: Authentication request for user "ant" (sudo)
2026-05-27T17:54:30.291534+02:00 blade pam_usb[2267372]: Checking whether the caller (sudo) is local or not...
2026-05-27T17:54:30.291576+02:00 blade pam_usb[2267372]: Checking for active remote desktop services...
2026-05-27T17:54:30.291610+02:00 blade pam_usb[2267372]: #011Checking for known remote desktop processes...
2026-05-27T17:54:30.304040+02:00 blade pam_usb[2267372]: #011Checking for virtual input devices...
2026-05-27T17:54:30.304130+02:00 blade pam_usb[2267372]: #011evdev: event12 bustype=0x00 phys=ALSA virtual=0
2026-05-27T17:54:30.322398+02:00 blade pam_usb[2267372]: #011evdev: event11 bustype=0x00 phys=ALSA virtual=0
2026-05-27T17:54:30.339486+02:00 blade pam_usb[2267372]: #011evdev: event10 bustype=0x00 phys=ALSA virtual=0
2026-05-27T17:54:30.357538+02:00 blade pam_usb[2267372]: #011evdev: event9 bustype=0x00 phys=ALSA virtual=0
2026-05-27T17:54:30.369440+02:00 blade pam_usb[2267372]: #011evdev: event8 bustype=0x00 phys=ALSA virtual=0
2026-05-27T17:54:30.389440+02:00 blade pam_usb[2267372]: #011evdev: event7 bustype=0x00 phys=ALSA virtual=0
2026-05-27T17:54:30.413434+02:00 blade pam_usb[2267372]: #011evdev: event6 bustype=0x19 phys=LNXVIDEO/video/input0 virtual=0
2026-05-27T17:54:30.421406+02:00 blade pam_usb[2267372]: #011evdev: event5 bustype=0x03 phys=usb-0000:00:1d.0-1.6/input1 virtual=0
2026-05-27T17:54:30.437417+02:00 blade pam_usb[2267372]: #011evdev: event4 bustype=0x03 phys=usb-0000:00:1d.0-1.6/input1 virtual=0
2026-05-27T17:54:30.446394+02:00 blade pam_usb[2267372]: #011evdev: event3 bustype=0x03 phys=usb-0000:00:1d.0-1.6/input1 virtual=0
2026-05-27T17:54:30.454386+02:00 blade pam_usb[2267372]: #011evdev: event2 bustype=0x03 phys=usb-0000:00:1d.0-1.6/input0 virtual=0
2026-05-27T17:54:30.463395+02:00 blade pam_usb[2267372]: #011evdev: event1 bustype=0x19 phys=LNXPWRBN/button/input0 virtual=0
2026-05-27T17:54:30.471399+02:00 blade pam_usb[2267372]: #011evdev: event0 bustype=0x19 phys=PNP0C0C/button/input0 virtual=0
2026-05-27T17:54:30.482416+02:00 blade pam_usb[2267372]: #011Checking pid 2267372 (sudo)...
2026-05-27T17:54:30.482504+02:00 blade pam_usb[2267372]: #011Checking pid 2267357 (bash)...
2026-05-27T17:54:30.482546+02:00 blade pam_usb[2267372]: #011Checking pid 2262723 (/usr/libexec/gnome-terminal-server)...
2026-05-27T17:54:30.482597+02:00 blade pam_usb[2267372]: #011Checking pid   1515 (/usr/lib/systemd/systemd)...
2026-05-27T17:54:30.482637+02:00 blade pam_usb[2267372]: #011Checking pid      1 (/sbin/init)...
2026-05-27T17:54:30.482674+02:00 blade pam_usb[2267372]: #011Trying to check for remote access by loginctl
2026-05-27T17:54:30.511052+02:00 blade pam_usb[2267372]: #011#011loginctl considers this session to be remote: yes
2026-05-27T17:54:30.511263+02:00 blade pam_usb[2267372]: #011loginctl says this session is remote
2026-05-27T17:54:30.511315+02:00 blade pam_usb[2267372]: Access denied.

Putting in pam_usb.conf

        <service id="sudo">
			<option name="deny_remote">false</option>
        </service>

"solves" the issue.

Output of "pamusb-check --debug whoami"

* Authentication request for user "ant" (pamusb-check)
[src/local.c:358] Checking whether the caller (pamusb-check) is local or not...
[src/local.c:373] Checking for active remote desktop services...
[src/rmsvc.c:222] 	Checking for known remote desktop processes...
[src/evdev.c:032] 	Checking for virtual input devices...
* Cannot check for virtual input devices (permission denied on /dev/input). Run pamusb-check as root or add user to the 'input' group for reliable remote desktop detection. If using AppArmor/SELinux, check policy.
[src/local.c:392] 	Checking pid 2271028 (pamusb-check)...
[src/local.c:392] 	Checking pid 2268687 (bash)...
[src/local.c:392] 	Checking pid 2262723 (/usr/libexec/gnome-terminal-server)...
[src/local.c:392] 	Checking pid   1515 (/usr/lib/systemd/systemd)...
[src/local.c:392] 	Checking pid      1 (/sbin/init)...
[src/local.c:438] 	Using DISPLAY :0 for utmp search
[src/local.c:094] 	No utmp entry found for tty ":0"
[src/local.c:451] 	Trying to get tty from display server
[src/local.c:172] 	Determining tty by display server failed on /proc/9374/fd (running 'pamusb-check' as user?)
[src/local.c:462] 		Failed, no result while trying to get TTY from display server
[src/local.c:467] 	Trying to get tty by DISPLAY
[src/local.c:472] 	Retrying with tty tty7, obtained by DISPLAY, for utmp search
[src/local.c:097] 		utmp entry for tty "tty7" found
[src/local.c:098] 			utmp->ut_pid: 9572
[src/local.c:099] 			utmp->ut_user: ant
[src/local.c:125] 	utmp check successful, request originates from a local source!
[src/local.c:540] No remote access detected, seems to be local request - allowing.
* Searching for "authdev" in the hardware database...
* Authentication device "authdev" is connected.
* Performing one time pad verification...
[src/volume.c:106] Searching for volume with uuid 8d4d8d3a-1614-4f81-970a-386720bb8aca.
[src/volume.c:133] Found mount points: /mnt/backup
[src/volume.c:150] Found volume 8d4d8d3a-1614-4f81-970a-386720bb8aca.
[src/volume.c:177] Volume 8d4d8d3a-1614-4f81-970a-386720bb8aca is already mounted.
[src/pad.c:591] Loading device pad...
[src/pad.c:602] Loading system pad...
[src/pad.c:616] Pad match.
[src/pad.c:325] Checking whether pads are expired or not...
[src/pad.c:353] Pads were generated 2766 seconds ago, not updating.
* Access granted.

Output of "w"

USUARIO  TTY      DESDE            LOGIN@   IDLE   JCPU   PCPU  WHAT
ant               192.168.1.178    08:36   56:27   0.00s  0.03s sshd: ant [priv]
ant      tty7     -                jue19    5dias  1:14m  0.02s lightdm --session-child 13 20

Output of "loginctl"

SESSION  UID USER SEAT  TTY   STATE   IDLE SINCE 
   2808 1000 ant  -     pts/1 active  yes  9h ago
     c2 1000 ant  seat0 tty7  closing no   -     
     c6 1000 ant  seat0 tty7  active  no   -

[ACR36940]

After a reboot all works (with the deny_remote removed)
¿Can be the hanged sshd session ?
Yes. If i have a ssh session open loginctl returns the ssh session and opps access denied.in a local graphical terminal

[mcdope]

After a reboot all works (with the deny_remote removed) ¿Can be the hanged sshd session ? Yes. If i have a ssh session open loginctl returns the ssh session and opps access denied.in a local graphical terminal

You lost me, can't follow you. So does is work or not? :D

If you were logged in via SSH that denial is intentional. However, if you were local it should have granted - even if you are also logged in via ssh with the same user (would be another session).

[ACR36940]

Well i was lost too. The problem was caused by a ssh session opened by the same user. While the ssh session was open pamusb returned #011loginctl says this session is remote and logically access denied. Using <option name="deny_remote">false</option> in the sudo servioce seccion mask the problem. If i close the ssh session the problem dissapears. Something in the code is seleccting the ssh session and not the local session. El mié, 27 may 2026 a las 18:30, McDope ***@***.***>) escribió:

…

*mcdope* left a comment (mcdope/pam_usb#430) <#430 (comment)> After a reboot all works (with the deny_remote removed) ¿Can be the hanged sshd session ? Yes. If i have a ssh session open loginctl returns the ssh session and opps access denied.in a local graphical terminal You lost me, can't follow you. So does is work or not? :D If you were logged in via SSH that denial is intentional. However, if you were local it should have granted - even if you are also logged in via ssh with the same user (would be another session). — Reply to this email directly, view it on GitHub <#430?email_source=notifications&email_token=AKCC5YYMU3PYVEEZBBX3RWT444JZ5A5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTINJVGY2TCMRUG44KM4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KYZTPN52GK4S7MNWGSY3L#issuecomment-4556512478>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AKCC5YYUF5SVUIL5JEQ7GST444JZ5AVCNFSM6AAAAACZPO5XNGVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHM2DKNJWGUYTENBXHA> . Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS <https://github.com/notifications/mobile/ios/AKCC5YYDKKXE4NRMNXJGBFT444JZ5A5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTINJVGY2TCMRUG44KM4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KUZTPN52GK4S7NFXXG> and Android <https://github.com/notifications/mobile/android/AKCC5Y6XXLNGC2XNOCIYU7T444JZ5A5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTINJVGY2TCMRUG44KM4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2K4ZTPN52GK4S7MFXGI4TPNFSA>. Download it today! You are receiving this because you authored the thread.Message ID: ***@***.***>

-- Att. *Antonio Calvo Rodríguez* ***@***.*** ***@***.***>*

[mcdope]

Thank you, that's for sure a bug caused by the recent security fixes. I will check it.

Could take a while though because of the testing involved. Also I will be on a one-week trip soon.

[ACR36940]

Don't worry. Thanks for your work. Att. *Antonio Calvo Rodríguez* ***@***.*** ***@***.***>* El mié, 27 may 2026, 23:19, McDope ***@***.***> escribió:

…

*mcdope* left a comment (mcdope/pam_usb#430) <#430 (comment)> Thank you, that's for sure a bug caused by the recent security fixes. I will check it. Could take a while though because of the testing involved. Also I will be on a one-week trip soon. — Reply to this email directly, view it on GitHub <#430?email_source=notifications&email_token=AKCC5Y2SRHJOEYPJUMP2ZGD445LX7A5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTINJVHA3TKOJVGE42M4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KYZTPN52GK4S7MNWGSY3L#issuecomment-4558759519>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AKCC5Y32ES6LFTBVNCSFI4L445LX7AVCNFSM6AAAAACZPO5XNGVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHM2DKNJYG42TSNJRHE> . Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS <https://github.com/notifications/mobile/ios/AKCC5Y6JH4O3DIMOED3KJXD445LX7A5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTINJVHA3TKOJVGE42M4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KUZTPN52GK4S7NFXXG> and Android <https://github.com/notifications/mobile/android/AKCC5Y7GWTZJYSV3QMSDGYD445LX7A5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTINJVHA3TKOJVGE42M4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2K4ZTPN52GK4S7MFXGI4TPNFSA>. Download it today! You are receiving this because you authored the thread.Message ID: ***@***.***>