1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
|
diff --git c/configure.ac i/configure.ac
index bda20c6..e118101 100644
--- c/configure.ac
+++ i/configure.ac
@@ -185,12 +185,13 @@ if test x$enable_split_authentication = xyes; then
fi
AC_ARG_WITH(default-pam-config,
- AS_HELP_STRING([--with-default-pam-config: One of redhat, openembedded, exherbo, lfs, none @<:@default=auto@:>@]))
+ AS_HELP_STRING([--with-default-pam-config: One of redhat, openembedded, exherbo, lfs, arch, none @<:@default=auto@:>@]))
dnl If not given, try autodetecting from release files (see NetworkManager source)
if test x$with_default_pam_config = x; then
AC_CHECK_FILE(/etc/redhat-release,with_default_pam_config="redhat")
AC_CHECK_FILE(/etc/fedora-release,with_default_pam_config="redhat")
AC_CHECK_FILE(/etc/exherbo-release,with_default_pam_config="exherbo")
+ AC_CHECK_FILE(/etc/arch-release,with_default_pam_config="arch")
AC_CHECK_FILE(/etc/lfs-release,with_default_pam_config="lfs")
dnl If not autodetected, default to none
if test x$with_default_pam_config = x; then
@@ -198,7 +199,7 @@ if test x$with_default_pam_config = x; then
fi
fi
case x$with_default_pam_config in
- xredhat|xopenembedded|xexherbo|xlfs|xnone) ;;
+ xredhat|xopenembedded|xexherbo|xlfs|xarch|xnone) ;;
*)
AC_MSG_ERROR([Invalid --with-default-pam-config ${with_default_pam_config}])
exit 1
@@ -208,6 +209,7 @@ AM_CONDITIONAL(ENABLE_REDHAT_PAM_CONFIG, test x$with_default_pam_config = xredha
AM_CONDITIONAL(ENABLE_OPENEMBEDDED_PAM_CONFIG, test x$with_default_pam_config = xopenembedded)
AM_CONDITIONAL(ENABLE_EXHERBO_PAM_CONFIG, test x$with_default_pam_config = xexherbo)
AM_CONDITIONAL(ENABLE_LFS_PAM_CONFIG, test x$with_default_pam_config = xlfs)
+AM_CONDITIONAL(ENABLE_ARCH_PAM_CONFIG, test x$with_default_pam_config = xarch)
AC_ARG_ENABLE(console-helper,
AS_HELP_STRING([--enable-console-helper],
diff --git c/data/Makefile.am i/data/Makefile.am
index 81eb8ef..6a67433 100644
--- c/data/Makefile.am
+++ i/data/Makefile.am
@@ -129,6 +129,15 @@ pam_lfs_files = pam-lfs/gdm.pam \
$(NULL)
EXTRA_DIST += $(pam_lfs_files)
+pam_arch_files = pam-arch/gdm-autologin.pam \
+ pam-arch/gdm-launch-environment.pam \
+ pam-arch/gdm-fingerprint.pam \
+ pam-arch/gdm-smartcard.pam \
+ pam-arch/gdm-password.pam \
+ pam-arch/gdm-pin.pam \
+ $(NULL)
+EXTRA_DIST += $(pam_arch_files)
+
if ENABLE_REDHAT_PAM_CONFIG
pam_files = $(pam_redhat_files)
endif
@@ -141,6 +150,9 @@ endif
if ENABLE_LFS_PAM_CONFIG
pam_files = $(pam_lfs_files)
endif
+if ENABLE_ARCH_PAM_CONFIG
+pam_files = $(pam_arch_files)
+endif
EXTRA_DIST += \
$(schemas_in_files) \
diff --git c/data/pam-arch/gdm-autologin.pam i/data/pam-arch/gdm-autologin.pam
new file mode 100644
index 0000000..de615ef
--- /dev/null
+++ i/data/pam-arch/gdm-autologin.pam
@@ -0,0 +1,13 @@
+auth required pam_tally.so onerr=succeed file=/var/log/faillog
+auth required pam_shells.so
+auth requisite pam_nologin.so
+auth required pam_env.so
+auth optional pam_permit.so
+auth optional pam_gnome_keyring.so
+
+account include system-local-login
+
+password include system-local-login
+
+session include system-local-login
+session optional pam_gnome_keyring.so auto_start
diff --git c/data/pam-arch/gdm-fingerprint.pam i/data/pam-arch/gdm-fingerprint.pam
new file mode 100644
index 0000000..f296ae0
--- /dev/null
+++ i/data/pam-arch/gdm-fingerprint.pam
@@ -0,0 +1,15 @@
+auth required pam_tally.so onerr=succeed file=/var/log/faillog
+auth required pam_shells.so
+auth requisite pam_nologin.so
+auth required pam_env.so
+auth required pam_fprintd.so
+auth optional pam_permit.so
+auth optional pam_gnome_keyring.so
+
+account include system-local-login
+
+password required pam_fprintd.so
+password optional pam_permit.so
+
+session include system-local-login
+session optional pam_gnome_keyring.so auto_start
diff --git c/data/pam-arch/gdm-launch-environment.pam i/data/pam-arch/gdm-launch-environment.pam
new file mode 100644
index 0000000..6dfbc51
--- /dev/null
+++ i/data/pam-arch/gdm-launch-environment.pam
@@ -0,0 +1,13 @@
+auth required pam_succeed_if.so audit quiet_success user = gdm
+auth required pam_env.so
+auth optional pam_permit.so
+
+account required pam_succeed_if.so audit quiet_success user = gdm
+account include system-local-login
+
+password required pam_deny.so
+
+session required pam_succeed_if.so audit quiet_success user = gdm
+session required pam_systemd.so
+session optional pam_keyinit.so force revoke
+session optional pam_permit.so
diff --git c/data/pam-arch/gdm-password.pam i/data/pam-arch/gdm-password.pam
new file mode 100644
index 0000000..7411285
--- /dev/null
+++ i/data/pam-arch/gdm-password.pam
@@ -0,0 +1,9 @@
+auth include system-local-login
+auth optional pam_gnome_keyring.so
+
+account include system-local-login
+
+password include system-local-login
+
+session include system-local-login
+session optional pam_gnome_keyring.so auto_start
diff --git c/data/pam-arch/gdm-pin.pam i/data/pam-arch/gdm-pin.pam
new file mode 100644
index 0000000..e024244
--- /dev/null
+++ i/data/pam-arch/gdm-pin.pam
@@ -0,0 +1,11 @@
+auth requisite pam_pin.so
+auth include system-local-login
+auth optional pam_gnome_keyring.so
+
+account include system-local-login
+
+password include system-local-login
+password optional pam_pin.so
+
+session include system-local-login
+session optional pam_gnome_keyring.so auto_start
diff --git c/data/pam-arch/gdm-smartcard.pam i/data/pam-arch/gdm-smartcard.pam
new file mode 100644
index 0000000..7c3d736
--- /dev/null
+++ i/data/pam-arch/gdm-smartcard.pam
@@ -0,0 +1,15 @@
+auth required pam_tally.so onerr=succeed file=/var/log/faillog
+auth required pam_shells.so
+auth requisite pam_nologin.so
+auth required pam_env.so
+auth required pam_pkcs11.so wait_for_card card_only
+auth optional pam_permit.so
+auth optional pam_gnome_keyring.so
+
+account include system-local-login
+
+password required pam_pkcs11.so
+password optional pam_permit.so
+
+session include system-local-login
+session optional pam_gnome_keyring.so auto_start
|
