FreeBSD 15.1 : Running Plasma Wayland without SDDM

Problem

After upgrading to FreeBSD 15.1-BETA3 and getting DRM 6.12 working see:freebsd-15.1-drm-i915-runbook.md, Plasma Wayland would not start through SDDM. Logging in via SDDM’s greeter bounced back to the login screen with no error output. wayland-session.log was empty. XFCE (X11) worked fine through SDDM.

Root Cause

Session activation failed in this configuration. ck-list-sessions showed:

$ ck-list-sessions | grep active
        active = FALSE

When a session is not marked active, kwin_wayland cannot acquire DRM device access : /dev/dri/* access fails, libseat/seatd integration may not work, and the Wayland compositor exits immediately, often with no log output. This matches the symptom exactly.

The deeper issue is architectural: ConsoleKit2 is effectively legacy infrastructure for modern Wayland desktops. Wayland compositors like kwin_wayland are designed around systemd-logind, elogind, or seatd/libseat as the seat manager. FreeBSD lacks native systemd-logind, so desktop environments rely on compatibility layers and ports glue and the seams show when session activation doesn’t come together correctly.

In this specific setup (FreeBSD 15.1-BETA3, current ports), SDDM could not produce a session that kwin_wayland would accept. The failure could be in the interaction between any of: PAM configuration, ConsoleKit PAM hooks, SDDM’s startup method, the seat management backend, dbus activation, or mismatched port versions. Diagnosing which layer exactly was the failure point eludes me, getting Plasma Wayland was the goal.

Launching Plasma manually from a real tty via ck-launch-session works because ConsoleKit correctly associates the controlling tty, setting active = TRUE and granting DRM access.

We also tried DisplayServer=wayland in sddm.conf, which crashed because SDDM defaults to Weston as the Wayland greeter compositor, and Weston was not available via pkg.

Work-Around “Solution”

Bypass SDDM entirely. Log in at the console and launch Plasma Wayland directly.

1. Disable SDDM

doas sysrc sddm_enable=NO

2. Auto-launch Plasma from ~/.zlogin

Add to ~/.zlogin:

if [ "$(tty)" = "/dev/ttyv0" ] && [ -z "$DISPLAY" ] && [ -z "$WAYLAND_DISPLAY" ]; then
    exec /usr/local/lib/libexec/plasma-dbus-run-session-if-needed ck-launch-session startplasma-wayland
fi

This checks three conditions before launching:

• On the main console ttyv0 (not SSH, not another tty)
• X11 is not already running
• Wayland is not already running

The exec replaces the shell, so logging out of Plasma returns to the getty login prompt.

3. Auto-unlock KWallet via PAM

Without SDDM, KWallet does not auto-unlock because pam_kwallet5 is only configured in SDDM’s PAM stack. Add it to the console login PAM config.

Edit /etc/pam.d/login:

#
# PAM configuration for the "login" service
#

# auth
auth        sufficient  pam_self.so     no_warn
auth        include     system
auth        optional    /usr/local/lib/pam_kwallet5.so

# account
account     requisite   pam_securetty.so
account     required    pam_nologin.so
account     include     system

# session
session     include     system
session     optional    /usr/local/lib/pam_kwallet5.so auto_start force_run kwalletd=/usr/local/bin/ksecretd

# password
password    include     system

Key details:

• The auth optional line captures the login password for KWallet
• The session optional line unlocks KWallet when the session starts
• force_run is required, without it, pam_kwallet5 detects a non-graphical (tty) session and silently skips itself
• kwalletd=/usr/local/bin/ksecretd points to the correct KDE6 wallet daemon
• Both lines are optional so failures will not block login

4. Ensure seatd is running

kwin_wayland needs seatd for DRM device access:

doas sysrc seatd_enable=YES
doas service seatd start

5. Verify video group membership

grep video /etc/group

Your user and the sddm user should both be in the video group (though sddm is no longer needed):

video:*:44:matuzalem,sddm,lightdm

Login Flow

1. System boots to getty console login on ttyv0
2. Type username and password
3. PAM captures password and prepares KWallet unlock
4. zsh sources ~/.zlogin
5. Condition check passes > exec launches Plasma Wayland via ConsoleKit
6. ConsoleKit detects ttyv0 > active = TRUE > kwin_wayland gets DRM access
7. KWallet auto-unlocks from the captured PAM password
8. Full Plasma Wayland desktop with working GPU, wallet, and session management

Why Not Fix SDDM Instead?

I don’t know how to. Getting it working requires the right combination of port versions, PAM configuration, ConsoleKit hooks, and seat manager setup and something in that stack misfires, the failure is nearly silent (active = FALSE, compositor exits, no logs).

The tty login approach sidesteps all of that. By launching Plasma directly from a real tty via ck-launch-session, the session activation path is simpler and more it works: ConsoleKit sees the controlling tty, marks the session active, and kwin_wayland gets DRM access. A polkit rule handles the one remaining consequence of running under ConsoleKit (power management: shutdown/suspend were greyed out without it).

The DisplayServer=wayland option in SDDM requires Weston as the greeter compositor, which was not available via pkg.

Longer term, the underlying gap is a logind-compatible interface on FreeBSD. The modern desktop stack: SDDM, GDM, gvfs, desktop sessions, lock screens, session managers, is built around org.freedesktop.login1. ConsoleKit2 is actively maintained but speaks a different interface. elogind is not a realistic FreeBSD port; it is effectively extracted from systemd and carries too many Linux-isms to adapt cleanly. Until FreeBSD has something that implements the logind D-Bus API natively, the friction between display managers and Wayland compositors will remain.

Related Files