Screensaver / sleep mode password protection does not work

Question

Hello,
I am running 10.6.4 and have enabled screen saver and sleep mode password protection from System Preferences / Security / General / Require password immediately after sleep or screen saver begins.
I have also selected some screen saver - Cosmos. Now, from terminal when I check the settings:
MINE:~ ent$ defaults -currentHost read com.apple.screensaver
CleanExit = YES;
PrefsVersion = 100;
mainScreenOnly = 0;
moduleDict = {
iLifeMediaGroupType = 0;
moduleName = Cosmos;
path = "/System/Library/Screen Savers/Cosmos.slideSaver";
type = 4;
showClock = 1;
tokenRemovalAction = 0;
MINE:~ ent$ defaults read com.apple.screensaver {
askForPassword = 1;
askForPasswordDelay = 0;
tokenRemovalAction = 0;
So the settings get applied correctly.
The problem is - after screen saver kicks in or when MacBook goes into sleep mode and I want to continue work - no password prompt appears and I go back to desktop without any authorization!
I see this behaviour on admin user account, but when I login in as root - prompt appears and asks for password to unlock desktop.
Can you help me troubleshoot the problem? How can I log /see what is happeining after screen saver is terminated by mouse move or key stroke?
Regards,
Krzysztof

Answer 1

Gals, Gents,
I actually figured out the root cause of the problem. I am using EncFS to encrypt my home folder and each time the user logs in a script is being executed:
MINE:~ ent$ cat /Library/Management/loginhook.sh
#!/bin/bash
# $1 = logged in usernam
# try to mount /e using encfs entry in keychain
PASS=$(security find-generic-password -ga EncFS 2>&1 >/dev/null | cut -d'"' -f2)
RAW="/Users/.$1"
MOUNTPOINT="/Users/$1"
echo $PASS | sudo -u $1 /usr/local/bin/encfs -S $RAW $MOUNTPOINT
It is executed as a login hook, so:
MINE:~ ent$ sudo defaults read com.apple.loginwindow
LoginHook = "/Library/Management/loginhook.sh";
LogoutHook = "/Library/Management/logouthook.sh";
The problem with that is that most probably all the Library settings are first read and only after that is the login hook executed. What it actually does is decrypting the EncFS volume and mounting it to the /Users/enc.
So... Library folder get's substituted and I can work on Library preferences files from my account, but they are not visible during the login process.
Anybody know how I can change this process to enable login script before Library is ever read?
I managed to work around with screen saver protection by adding it globally to /Library/Preferences/com.apple.screensaver.plist instead of local ~/Library/Pref..
But obiously that is not how it should be dealt with...
Thanks,
Krzysztof