Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
Adjust max passwords attempts behavior
Reported by ryanrhughes · filed Jul 14, 2025Closed upstream on 2025-07-23 by dhh. GitHub close reason: completed. No closing PR or commit is recorded — "completed" alone is not evidence of a fix.
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- Not yet mapped to any requirement or component.
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Our staff decide whether the report is valid. Where this project allows it, agents decide whether it duplicates another report or a known issue. No decision has been recorded yet.
Original report
I've noticed occasionally that I'll find myself unable to login from Hyprlock but I can after rebooting. After doing a bit of investigating, it's because the default pam_faillock policy is that 3 failures results in a 10min lockout but that's not reflected in Hyprlock at all.
Generally, I burn at least one attempt impatiently waiting for my display to kick back on so that only leaves 2.
I'd recommend potentially a combination of adjusting the pam_faillock policy to be a little more relaxed, as well as displaying that feedback in Hyprlock (assuming it's an option).
Before going down the path of making any adjustments, I'd like some input on what we'd consider reasonable.
On MacOS, a sliding scale is utilized but I'm not sure if we have that option. Interestingly, there is no limit if you've successfully logged in, which I confirmed by attempting 50x on my MBP and can confirm it did not care.
The way I confirmed my lockout situation was via logs after running into it again.
Jul 13 20:53:55 x1 hyprlock[250259]: pam_unix(hyprlock:auth): authentication failure; logname=ryan uid=1000 euid=1000 tty= ruser= rhost= user=ryan
Jul 13 20:54:04 x1 hyprlock[250259]: pam_unix(hyprlock:auth): authentication failure; logname=ryan uid=1000 euid=1000 tty= ruser= rhost= user=ryan
Jul 13 20:54:07 x1 hyprlock[250259]: pam_unix(hyprlock:auth): authentication failure; logname=ryan uid=1000 euid=1000 tty= ruser= rhost= user=ryan
Jul 13 20:54:07 x1 hyprlock[250259]: pam_faillock(hyprlock:auth): Error sending audit message: Operation not permitted
Jul 13 20:54:07 x1 hyprlock[250259]: pam_faillock(hyprlock:auth): Error sending audit message: Operation not permitted
Jul 13 20:54:07 x1 hyprlock[250259]: pam_faillock(hyprlock:auth): Consecutive login failures for user ryan account temporarily lockedView raw text
I've noticed occasionally that I'll find myself unable to login from Hyprlock but I can after rebooting. After doing a bit of investigating, it's because the default pam_faillock policy is that 3 failures results in a 10min lockout but that's not reflected in Hyprlock at all. Generally, I burn at least one attempt impatiently waiting for my display to kick back on so that only leaves 2. I'd recommend potentially a combination of adjusting the pam_faillock policy to be a little more relaxed, as well as displaying that feedback in Hyprlock (assuming it's an option). Before going down the path of making any adjustments, I'd like some input on what we'd consider reasonable. On MacOS, a [sliding scale is utilized](https://support.apple.com/guide/security/passcodes-and-passwords-sec20230a10d/web) but I'm not sure if we have that option. Interestingly, there is **no limit** if you've successfully logged in, which I confirmed by attempting 50x on my MBP and can confirm it did not care. The way I confirmed my lockout situation was via logs after running into it again. ``` Jul 13 20:53:55 x1 hyprlock[250259]: pam_unix(hyprlock:auth): authentication failure; logname=ryan uid=1000 euid=1000 tty= ruser= rhost= user=ryan Jul 13 20:54:04 x1 hyprlock[250259]: pam_unix(hyprlock:auth): authentication failure; logname=ryan uid=1000 euid=1000 tty= ruser= rhost= user=ryan Jul 13 20:54:07 x1 hyprlock[250259]: pam_unix(hyprlock:auth): authentication failure; logname=ryan uid=1000 euid=1000 tty= ruser= rhost= user=ryan Jul 13 20:54:07 x1 hyprlock[250259]: pam_faillock(hyprlock:auth): Error sending audit message: Operation not permitted Jul 13 20:54:07 x1 hyprlock[250259]: pam_faillock(hyprlock:auth): Error sending audit message: Operation not permitted Jul 13 20:54:07 x1 hyprlock[250259]: pam_faillock(hyprlock:auth): Consecutive login failures for user ryan account temporarily locked ```
Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
Not linked to any known issue, other report or change yet.
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
No decision has been recorded yet.