turns out an rpm update added a fingerprint reader requirement to pam