Ensure screen lock on suspend

Ubuntu Mate 18.04 has a bug in which suspending your computer does not lock your screen in every case. If closing your laptop's lid or clicking the suspend menu option in your top right menu already locks the screen, you're not affected and don't need to do anything.

Step 1

To make sure screen lock is engaged when you suspend your computer, please create the following file, as root:

/etc/systemd/system/lock.service

Copy[Unit]
Description="Make extra sure to lock the screen when suspending"

[Service]
Type=oneshot
User=root
ExecStart=/bin/loginctl lock-sessions

[Install]
WantedBy=suspend.target

Afterwards, type

Copysudo systemctl daemon-reload
sudo systemctl enable lock.service

to update your systemd configuration.

Step 2

Please open a terminal window and type

Copy/bin/loginctl lock-session

If screen lock engages immediately, you're all set and don't have to proceed with the next steps.

If nothing happens, there's another issue with mate-screensaver that prohibits screenlock.

Please create another file as root in /usr/local/bin/lock.sh:

Copy#!/bin/bash
/usr/bin/mate-screensaver-command --lock

Also please install a package:

Copysudo apt install xss-lock

and create a new file as your regular user (not root!) under $HOME/.config/autostart/screenlock.desktop:

Copy[Desktop Entry]
Type=Application
Exec=/usr/bin/xss-lock /usr/local/bin/lock.sh
Hidden=false
X-GNOME-Autostart-enable=true
Comment=Screenlock-workaround

In case you're using xscreensaver and MATE 20.04 use this autostart configuration:

Copy[Desktop Entry]
Type=Application
Exec=/usr/bin/xss-lock -- /usr/bin/xscreensaver-command -lock
Hidden=false
X-MATE-Autostart-enabled=true
Name=Screenlock-workaround
Comment=Screenlock-workaround
X-MATE-Autostart-Delay=0

After logging out of your current session and back in, screen locking should work after entering loginctl lock-session on the command line and, finally, also when you suspend your computer.

Why

If you're interested in why we do this: There appears to be a multi component bug in ubuntu mate 18.04 sessions:

1. Reaching the suspend-target of systemd may happen before screen lock can engage propery, leaving the system unlocked. By making screenlock a dependency of the suspend-target we basically force this to happen in the correct order.
2. The proper way to lock a screen session is not so easy: there are many condition on which screen lock makes a lot of sense, suspending the computer is one of them. Only a few of those events are triggered within the user context though, most others are triggered within the root context, e.g. the ACPI event for "lid has been closed". Now, it's not trivial for root to lock users' screen sessions since X11/wayland are a little complicated. The current solution is to send a global DBUS message that the screen should be locked and all screensavers in all user sessions, including mate-screensaver are supposed to listen to that message and lock the screen. This is where the bug comes in. In Ubuntu Mate 18.04, mate-screensaver will not listen to those messages over dbus in certain circumstances. As a fix, we have xss-lock listen to the event and trigger the screen lock explicitly by calling the --lock command.