1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
|
From 521d3702ac5569c370a5a453b87133d688e1c87d Mon Sep 17 00:00:00 2001
From: "Jan Alexander Steffens (heftig)" <jan.steffens@gmail.com>
Date: Tue, 30 Jul 2013 22:42:27 +0600
Subject: [PATCH] Add Arch Linux PAM config files
---
configure.ac | 6 ++++--
data/Makefile.am | 12 ++++++++++++
data/pam-arch/gdm-autologin.pam | 10 ++++++++++
data/pam-arch/gdm-fingerprint.pam | 14 ++++++++++++++
data/pam-arch/gdm-launch-environment.pam | 13 +++++++++++++
data/pam-arch/gdm-password.pam | 11 +++++++++++
data/pam-arch/gdm-pin.pam | 13 +++++++++++++
data/pam-arch/gdm-smartcard.pam | 14 ++++++++++++++
8 files changed, 91 insertions(+), 2 deletions(-)
create mode 100644 data/pam-arch/gdm-autologin.pam
create mode 100644 data/pam-arch/gdm-fingerprint.pam
create mode 100644 data/pam-arch/gdm-launch-environment.pam
create mode 100644 data/pam-arch/gdm-password.pam
create mode 100644 data/pam-arch/gdm-pin.pam
create mode 100644 data/pam-arch/gdm-smartcard.pam
diff --git a/configure.ac b/configure.ac
index 242a969..a368029 100644
--- a/configure.ac
+++ b/configure.ac
@@ -189,12 +189,13 @@ if test x$enable_split_authentication = xyes; then
fi
AC_ARG_WITH(default-pam-config,
- AS_HELP_STRING([--with-default-pam-config: One of redhat, openembedded, exherbo, lfs, none @<:@default=auto@:>@]))
+ AS_HELP_STRING([--with-default-pam-config: One of redhat, openembedded, exherbo, lfs, arch, none @<:@default=auto@:>@]))
dnl If not given, try autodetecting from release files (see NetworkManager source)
if test x$with_default_pam_config = x; then
AC_CHECK_FILE(/etc/redhat-release,with_default_pam_config="redhat")
AC_CHECK_FILE(/etc/fedora-release,with_default_pam_config="redhat")
AC_CHECK_FILE(/etc/exherbo-release,with_default_pam_config="exherbo")
+ AC_CHECK_FILE(/etc/arch-release,with_default_pam_config="arch")
AC_CHECK_FILE(/etc/lfs-release,with_default_pam_config="lfs")
dnl If not autodetected, default to none
if test x$with_default_pam_config = x; then
@@ -202,7 +203,7 @@ if test x$with_default_pam_config = x; then
fi
fi
case x$with_default_pam_config in
- xredhat|xopenembedded|xexherbo|xlfs|xnone) ;;
+ xredhat|xopenembedded|xexherbo|xlfs|xarch|xnone) ;;
*)
AC_MSG_ERROR([Invalid --with-default-pam-config ${with_default_pam_config}])
exit 1
@@ -212,6 +213,7 @@ AM_CONDITIONAL(ENABLE_REDHAT_PAM_CONFIG, test x$with_default_pam_config = xredha
AM_CONDITIONAL(ENABLE_OPENEMBEDDED_PAM_CONFIG, test x$with_default_pam_config = xopenembedded)
AM_CONDITIONAL(ENABLE_EXHERBO_PAM_CONFIG, test x$with_default_pam_config = xexherbo)
AM_CONDITIONAL(ENABLE_LFS_PAM_CONFIG, test x$with_default_pam_config = xlfs)
+AM_CONDITIONAL(ENABLE_ARCH_PAM_CONFIG, test x$with_default_pam_config = xarch)
AC_ARG_ENABLE(console-helper,
AS_HELP_STRING([--enable-console-helper],
diff --git a/data/Makefile.am b/data/Makefile.am
index 1b79bc3..341b779 100644
--- a/data/Makefile.am
+++ b/data/Makefile.am
@@ -140,6 +140,15 @@ pam_lfs_files = pam-lfs/gdm.pam \
$(NULL)
EXTRA_DIST += $(pam_lfs_files)
+pam_arch_files = pam-arch/gdm-autologin.pam \
+ pam-arch/gdm-launch-environment.pam \
+ pam-arch/gdm-fingerprint.pam \
+ pam-arch/gdm-smartcard.pam \
+ pam-arch/gdm-password.pam \
+ pam-arch/gdm-pin.pam \
+ $(NULL)
+EXTRA_DIST += $(pam_arch_files)
+
if ENABLE_REDHAT_PAM_CONFIG
pam_files = $(pam_redhat_files)
endif
@@ -152,6 +161,9 @@ endif
if ENABLE_LFS_PAM_CONFIG
pam_files = $(pam_lfs_files)
endif
+if ENABLE_ARCH_PAM_CONFIG
+pam_files = $(pam_arch_files)
+endif
EXTRA_DIST += \
$(dconf_db_files) \
diff --git a/data/pam-arch/gdm-autologin.pam b/data/pam-arch/gdm-autologin.pam
new file mode 100644
index 0000000..9f45c65
--- /dev/null
+++ b/data/pam-arch/gdm-autologin.pam
@@ -0,0 +1,10 @@
+auth requisite pam_nologin.so
+auth required pam_env.so
+auth optional pam_permit.so
+
+account include system-local-login
+
+password include system-local-login
+
+session optional pam_keyinit.so force revoke
+session include system-local-login
diff --git a/data/pam-arch/gdm-fingerprint.pam b/data/pam-arch/gdm-fingerprint.pam
new file mode 100644
index 0000000..a480861
--- /dev/null
+++ b/data/pam-arch/gdm-fingerprint.pam
@@ -0,0 +1,14 @@
+auth required pam_tally.so onerr=succeed file=/var/log/faillog
+auth required pam_shells.so
+auth requisite pam_nologin.so
+auth required pam_env.so
+auth required pam_fprintd.so
+auth optional pam_permit.so
+
+account include system-local-login
+
+password required pam_fprintd.so
+password optional pam_permit.so
+
+session optional pam_keyinit.so force revoke
+session include system-local-login
diff --git a/data/pam-arch/gdm-launch-environment.pam b/data/pam-arch/gdm-launch-environment.pam
new file mode 100644
index 0000000..2981326
--- /dev/null
+++ b/data/pam-arch/gdm-launch-environment.pam
@@ -0,0 +1,13 @@
+auth required pam_succeed_if.so audit quiet_success user = gdm
+auth required pam_env.so
+auth optional pam_permit.so
+
+account required pam_succeed_if.so audit quiet_success user = gdm
+account include system-local-login
+
+password required pam_deny.so
+
+session optional pam_keyinit.so force revoke
+session required pam_succeed_if.so audit quiet_success user = gdm
+session required pam_systemd.so
+session optional pam_permit.so
diff --git a/data/pam-arch/gdm-password.pam b/data/pam-arch/gdm-password.pam
new file mode 100644
index 0000000..8d34794
--- /dev/null
+++ b/data/pam-arch/gdm-password.pam
@@ -0,0 +1,11 @@
+auth include system-local-login
+auth optional pam_gnome_keyring.so
+
+account include system-local-login
+
+password include system-local-login
+password optional pam_gnome_keyring.so use_authtok
+
+session optional pam_keyinit.so force revoke
+session include system-local-login
+session optional pam_gnome_keyring.so auto_start
diff --git a/data/pam-arch/gdm-pin.pam b/data/pam-arch/gdm-pin.pam
new file mode 100644
index 0000000..135e205
--- /dev/null
+++ b/data/pam-arch/gdm-pin.pam
@@ -0,0 +1,13 @@
+auth requisite pam_pin.so
+auth include system-local-login
+auth optional pam_gnome_keyring.so
+
+account include system-local-login
+
+password include system-local-login
+password optional pam_pin.so
+password optional pam_gnome_keyring.so use_authtok
+
+session optional pam_keyinit.so force revoke
+session include system-local-login
+session optional pam_gnome_keyring.so auto_start
diff --git a/data/pam-arch/gdm-smartcard.pam b/data/pam-arch/gdm-smartcard.pam
new file mode 100644
index 0000000..ec6f75d
--- /dev/null
+++ b/data/pam-arch/gdm-smartcard.pam
@@ -0,0 +1,14 @@
+auth required pam_tally.so onerr=succeed file=/var/log/faillog
+auth required pam_shells.so
+auth requisite pam_nologin.so
+auth required pam_env.so
+auth required pam_pkcs11.so wait_for_card card_only
+auth optional pam_permit.so
+
+account include system-local-login
+
+password required pam_pkcs11.so
+password optional pam_permit.so
+
+session optional pam_keyinit.so force revoke
+session include system-local-login
--
1.9.2
|
