Skip to content
Blog

Fixing the blank login screen after upgrading Ubuntu 24.04 to 26.04

5 min read

TLDR

TLDR; I upgraded from Ubuntu 24.04 LTS to 26.04 LTS and ended up with a login screen that had no users and no password box. The top bar worked, but there was no way to log in. After spending too much time reinstalling GNOME and GDM packages, I found that an extra AppArmor profile for bwrap was preventing GNOME from loading images. Moving that profile out of the way and rebooting fixed the problem.

If you have the same symptoms, don’t disable AppArmor or delete profiles blindly. Check whether you have a conflicting /etc/apparmor.d/usr.bin.bwrap first.

The problem

After upgrading Ubuntu from 24.04 to 26.04, I was greeted with a mostly blank login screen.

Blank Screen

Interestingly, the entire UI wasn’t broken. The top bar was there. I could see the date in the center and open the menu in the top-right corner. Brightness controls and the power/reboot options worked too.

What was missing was the important part: the list of users and the password input. I couldn’t log in.

The machine uses Intel integrated graphics, and Ubuntu was using Wayland. Since part of GNOME was rendering correctly, I wasn’t convinced this was a graphics driver problem.

Fortunately, I could still get to a terminal with Ctrl+Alt+F3.

Things that didn’t fix it

I tried quite a few things before finding the actual issue:

  1. Disabled Wayland in /etc/gdm3/custom.conf by setting WaylandEnable=false. The problem was exactly the same with X11.
  2. Ran sudo dpkg --configure -a, updated the package lists, and reinstalled ubuntu-desktop, gdm3, and ubuntu-session.
  3. Reinstalled accountsservice, thinking GDM might not be getting the user list.
  4. Cleared GDM’s cache and configuration under /var/lib/gdm3/.
  5. Restarted GDM and eventually rebooted the machine.

None of these made any difference.

The error in the logs

The useful information was in the system journal. From TTY3, I ran:

sudo journalctl -b | grep -iE 'gdm|gnome-shell|greeter'

There was a JavaScript error in GNOME Shell’s login dialog:

JS ERROR: Error: Argument child may not be null
_updateLogoTexture@resource:///org/gnome/shell/gdm/loginDialog.js:1086:27
_updateLogo@resource:///org/gnome/shell/gdm/loginDialog.js:1094:14
_init@resource:///org/gnome/shell/gdm/loginDialog.js:679:14
LoginDialog@resource:///org/gnome/shell/gdm/loginDialog.js:537:4

There were also errors about failing to load a pixbuf, along with AppArmor messages involving bwrap and glycin:

This may indicate that pixbuf loaders or the mime database could not be found.

apparmor="DENIED" ... comm="bwrap" ... capname="setpcap"

The loginDialog.js stack trace was the key. The login dialog was failing while trying to load its logo. Apparently, a missing image was enough to make the entire login dialog disappear!

This is also described in Ubuntu bug #2169691. The bug is about GDM failing completely when its logo cannot be loaded, rather than simply displaying the login screen without the logo.

Why was an image breaking the login screen?

Ubuntu 26.04 uses glycin for loading images. Glycin runs image loaders in a sandbox using Bubblewrap (bwrap). AppArmor controls what these processes are allowed to do.

On my machine, AppArmor was reporting a conflict involving profiles attached to /usr/bin/bwrap. As a result, bwrap wasn’t getting the permissions it needed, the image loader failed, and GNOME couldn’t load the logo for the login dialog.

So the chain of failures was roughly:

  1. Conflicting AppArmor profiles for bwrap.
  2. bwrap fails to create the sandbox needed by glycin.
  3. Glycin fails to load images.
  4. GDM fails to load its logo.
  5. loginDialog.js throws an exception, and the user selection/password UI never appears.

Not exactly where I expected a missing login screen to lead me.

Finding the conflicting AppArmor profile

I checked the AppArmor files related to bwrap:

ls -l /etc/apparmor.d/*bwrap*

On my machine, there were three:

/etc/apparmor.d/bwrap-userns-restrict
/etc/apparmor.d/glycin.bwrap
/etc/apparmor.d/usr.bin.bwrap

The first two were expected. The third one was interesting, so I looked at it:

cat /etc/apparmor.d/usr.bin.bwrap

It was a tiny profile containing this rule (excerpt):

/usr/bin/bwrap flags=(unconfined) {
    userns,
    ...
}

Ubuntu already had bwrap-userns-restrict, which also provides an AppArmor profile for Bubblewrap. The additional usr.bin.bwrap profile was competing for the same executable.

Before changing anything, I checked whether the extra file belonged to an installed package:

dpkg -S /etc/apparmor.d/usr.bin.bwrap

The result was:

dpkg-query: no path found matching pattern

So it wasn’t owned by an installed Debian package. I don’t know what originally created it, but it wasn’t something I needed to keep active alongside Ubuntu’s bwrap profile.

The fix

I moved the conflicting profile to /root instead of deleting it:

sudo mv /etc/apparmor.d/usr.bin.bwrap /root/usr.bin.bwrap.apparmor-backup

Then rebooted:

sudo reboot

That was it. The login screen came back, with the user list and password input working normally.

A reboot matters here because removing a profile file doesn’t necessarily remove the profile already loaded in the kernel. Rebooting ensures AppArmor starts with the remaining configuration.

What about security?

I didn’t disable AppArmor. I only moved one extra, non-package-owned profile that conflicted with the profiles Ubuntu provides.

If you want to check AppArmor on your machine after the fix, run:

sudo aa-status

You can also look for Bubblewrap and glycin profiles:

sudo aa-status | grep -Ei 'bwrap|glycin'

It’s worth checking the output rather than assuming your system has exactly the same configuration as mine. And if dpkg -S says your usr.bin.bwrap belongs to a package, investigate that before moving it.

Conclusion

The actual fix was moving one AppArmor profile and rebooting. Getting to that point took a lot longer because everything initially looked like a broken GDM or GNOME upgrade.

What I hadn’t expected was that GDM could lose its entire login dialog because it couldn’t load a logo, or that the real problem would be a leftover AppArmor profile for an image loader’s sandbox.

If you’re upgrading from Ubuntu 24.04 to 26.04 and end up with a blank login screen but a working top bar, check the loginDialog.js errors and the AppArmor profiles for bwrap before you start reinstalling the desktop.