summaryrefslogtreecommitdiff
path: root/extra/gdm/arch-pam.patch
blob: 1faa2b90b856f594eb82f797fd1c93609de96934 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
diff --git c/configure.ac i/configure.ac
index bda20c6..e118101 100644
--- c/configure.ac
+++ i/configure.ac
@@ -185,12 +185,13 @@ if test x$enable_split_authentication = xyes; then
 fi
 
 AC_ARG_WITH(default-pam-config,
-	    AS_HELP_STRING([--with-default-pam-config: One of redhat, openembedded, exherbo, lfs, none @<:@default=auto@:>@]))
+	    AS_HELP_STRING([--with-default-pam-config: One of redhat, openembedded, exherbo, lfs, arch, none @<:@default=auto@:>@]))
 dnl If not given, try autodetecting from release files (see NetworkManager source) 
 if test x$with_default_pam_config = x; then
 	AC_CHECK_FILE(/etc/redhat-release,with_default_pam_config="redhat")
 	AC_CHECK_FILE(/etc/fedora-release,with_default_pam_config="redhat")
 	AC_CHECK_FILE(/etc/exherbo-release,with_default_pam_config="exherbo")
+	AC_CHECK_FILE(/etc/arch-release,with_default_pam_config="arch")
 	AC_CHECK_FILE(/etc/lfs-release,with_default_pam_config="lfs")
 	dnl If not autodetected, default to none
 	if test x$with_default_pam_config = x; then
@@ -198,7 +199,7 @@ if test x$with_default_pam_config = x; then
 	fi
 fi
 case x$with_default_pam_config in
-     xredhat|xopenembedded|xexherbo|xlfs|xnone) ;;
+     xredhat|xopenembedded|xexherbo|xlfs|xarch|xnone) ;;
      *)
        AC_MSG_ERROR([Invalid --with-default-pam-config ${with_default_pam_config}])
        exit 1
@@ -208,6 +209,7 @@ AM_CONDITIONAL(ENABLE_REDHAT_PAM_CONFIG, test x$with_default_pam_config = xredha
 AM_CONDITIONAL(ENABLE_OPENEMBEDDED_PAM_CONFIG, test x$with_default_pam_config = xopenembedded)
 AM_CONDITIONAL(ENABLE_EXHERBO_PAM_CONFIG, test x$with_default_pam_config = xexherbo)
 AM_CONDITIONAL(ENABLE_LFS_PAM_CONFIG, test x$with_default_pam_config = xlfs)
+AM_CONDITIONAL(ENABLE_ARCH_PAM_CONFIG, test x$with_default_pam_config = xarch)
 
 AC_ARG_ENABLE(console-helper,
 	      AS_HELP_STRING([--enable-console-helper],
diff --git c/data/Makefile.am i/data/Makefile.am
index 81eb8ef..6a67433 100644
--- c/data/Makefile.am
+++ i/data/Makefile.am
@@ -129,6 +129,15 @@ pam_lfs_files = pam-lfs/gdm.pam			\
 	$(NULL)
 EXTRA_DIST += $(pam_lfs_files)
 
+pam_arch_files = pam-arch/gdm-autologin.pam	\
+	pam-arch/gdm-launch-environment.pam	\
+	pam-arch/gdm-fingerprint.pam		\
+	pam-arch/gdm-smartcard.pam		\
+	pam-arch/gdm-password.pam		\
+	pam-arch/gdm-pin.pam			\
+	$(NULL)
+EXTRA_DIST += $(pam_arch_files)
+
 if ENABLE_REDHAT_PAM_CONFIG
 pam_files = $(pam_redhat_files)
 endif
@@ -141,6 +150,9 @@ endif
 if ENABLE_LFS_PAM_CONFIG
 pam_files = $(pam_lfs_files)
 endif
+if ENABLE_ARCH_PAM_CONFIG
+pam_files = $(pam_arch_files)
+endif
 
 EXTRA_DIST +=			\
 	$(schemas_in_files)	\
diff --git c/data/pam-arch/gdm-autologin.pam i/data/pam-arch/gdm-autologin.pam
new file mode 100644
index 0000000..de615ef
--- /dev/null
+++ i/data/pam-arch/gdm-autologin.pam
@@ -0,0 +1,13 @@
+auth     required  pam_tally.so onerr=succeed file=/var/log/faillog
+auth     required  pam_shells.so
+auth     requisite pam_nologin.so
+auth     required  pam_env.so
+auth     optional  pam_permit.so
+auth     optional  pam_gnome_keyring.so
+
+account  include   system-local-login
+
+password include   system-local-login
+
+session  include   system-local-login
+session  optional  pam_gnome_keyring.so auto_start
diff --git c/data/pam-arch/gdm-fingerprint.pam i/data/pam-arch/gdm-fingerprint.pam
new file mode 100644
index 0000000..f296ae0
--- /dev/null
+++ i/data/pam-arch/gdm-fingerprint.pam
@@ -0,0 +1,15 @@
+auth     required  pam_tally.so onerr=succeed file=/var/log/faillog
+auth     required  pam_shells.so
+auth     requisite pam_nologin.so
+auth     required  pam_env.so
+auth     required  pam_fprintd.so
+auth     optional  pam_permit.so
+auth     optional  pam_gnome_keyring.so
+
+account  include   system-local-login
+
+password required  pam_fprintd.so
+password optional  pam_permit.so
+
+session  include   system-local-login
+session  optional  pam_gnome_keyring.so auto_start
diff --git c/data/pam-arch/gdm-launch-environment.pam i/data/pam-arch/gdm-launch-environment.pam
new file mode 100644
index 0000000..6dfbc51
--- /dev/null
+++ i/data/pam-arch/gdm-launch-environment.pam
@@ -0,0 +1,13 @@
+auth     required  pam_succeed_if.so audit quiet_success user = gdm
+auth     required  pam_env.so
+auth     optional  pam_permit.so
+
+account  required  pam_succeed_if.so audit quiet_success user = gdm
+account  include   system-local-login
+
+password required  pam_deny.so
+
+session  required  pam_succeed_if.so audit quiet_success user = gdm
+session  required  pam_systemd.so
+session  optional  pam_keyinit.so force revoke
+session  optional  pam_permit.so
diff --git c/data/pam-arch/gdm-password.pam i/data/pam-arch/gdm-password.pam
new file mode 100644
index 0000000..7411285
--- /dev/null
+++ i/data/pam-arch/gdm-password.pam
@@ -0,0 +1,9 @@
+auth     include   system-local-login
+auth     optional  pam_gnome_keyring.so
+
+account  include   system-local-login
+
+password include   system-local-login
+
+session  include   system-local-login
+session  optional  pam_gnome_keyring.so auto_start
diff --git c/data/pam-arch/gdm-pin.pam i/data/pam-arch/gdm-pin.pam
new file mode 100644
index 0000000..e024244
--- /dev/null
+++ i/data/pam-arch/gdm-pin.pam
@@ -0,0 +1,11 @@
+auth     requisite pam_pin.so
+auth     include   system-local-login
+auth     optional  pam_gnome_keyring.so
+
+account  include   system-local-login
+
+password include   system-local-login
+password optional  pam_pin.so
+
+session  include   system-local-login
+session  optional  pam_gnome_keyring.so auto_start
diff --git c/data/pam-arch/gdm-smartcard.pam i/data/pam-arch/gdm-smartcard.pam
new file mode 100644
index 0000000..7c3d736
--- /dev/null
+++ i/data/pam-arch/gdm-smartcard.pam
@@ -0,0 +1,15 @@
+auth     required  pam_tally.so onerr=succeed file=/var/log/faillog
+auth     required  pam_shells.so
+auth     requisite pam_nologin.so
+auth     required  pam_env.so
+auth     required  pam_pkcs11.so wait_for_card card_only
+auth     optional  pam_permit.so
+auth     optional  pam_gnome_keyring.so
+
+account  include   system-local-login
+
+password required  pam_pkcs11.so
+password optional  pam_permit.so
+
+session  include   system-local-login
+session  optional  pam_gnome_keyring.so auto_start