32 lines
1.5 KiB
Text
32 lines
1.5 KiB
Text
|
#%PAM-1.0
|
||
|
|
# SPDX-License-Identifier: GPL-3.0-only
|
||
|
|
# SPDX-FileCopyrightText: Copyright (C) 2026 Catcrafts®
|
||
|
|
#
|
||
|
|
# The service kscreenlocker's /etc/pam.d/kde-fingerprint substacks, and which
|
||
|
|
# nothing on Alpine provides -- so on a stock pmOS image every fingerprint
|
||
|
|
# unlock fails before it reaches any daemon, with PAM unable to open the
|
||
|
|
# substack rather than anything about fingerprints. kscreenlocker ships
|
||
|
|
# kde-fingerprint (auth/account/password/session all `include fingerprint-auth`)
|
||
|
|
# and Alpine ships pam_fprintd, and the file joining them is simply absent.
|
||
|
|
#
|
||
|
|
# It lives in the vendor directory /usr/lib/pam.d, next to Alpine's own
|
||
|
|
# base-auth, so an administrator can still override it in /etc/pam.d.
|
||
|
|
#
|
||
|
|
# fingerprintd ships it because fingerprintd is what makes it mean anything:
|
||
|
|
# this package provides fprintd, so it owns the bus name pam_fprintd talks to.
|
||
|
|
|
||
|
|
# pam_fprintd asks the daemon to verify, prompting through the PAM
|
||
|
|
# conversation; sufficient, so a match ends the stack successfully and a
|
||
|
|
# failure falls through to pam_deny rather than to a password -- the caller
|
||
|
|
# (kde-fingerprint) is the one that decides whether to offer a password next.
|
||
|
|
auth required pam_env.so
|
||
|
|
auth sufficient pam_fprintd.so
|
||
|
|
auth required pam_deny.so
|
||
|
|
|
||
|
|
account include base-account
|
||
|
|
|
||
|
|
# A fingerprint cannot set a password, and kde-fingerprint includes this
|
||
|
|
# service for `password` as well.
|
||
|
|
password required pam_deny.so
|
||
|
|
|
||
|
|
session include base-session
|