#%PAM-1.0
# SPDX-License-Identifier: GPL-3.0-only
# SPDX-FileCopyrightText: Copyright (C) 2026 Catcrafts®
#
# The service kscreenlocker's /etc/pam.d/kde-fingerprint substacks, and which
# nothing on Alpine provides -- so on a stock pmOS image every fingerprint
# unlock fails before it reaches any daemon, with PAM unable to open the
# substack rather than anything about fingerprints. kscreenlocker ships
# kde-fingerprint (auth/account/password/session all `include fingerprint-auth`)
# and Alpine ships pam_fprintd, and the file joining them is simply absent.
#
# It lives in the vendor directory /usr/lib/pam.d, next to Alpine's own
# base-auth, so an administrator can still override it in /etc/pam.d.
#
# fingerprintd ships it because fingerprintd is what makes it mean anything:
# this package provides fprintd, so it owns the bus name pam_fprintd talks to.

# pam_fprintd asks the daemon to verify, prompting through the PAM
# conversation; sufficient, so a match ends the stack successfully and a
# failure falls through to pam_deny rather than to a password -- the caller
# (kde-fingerprint) is the one that decides whether to offer a password next.
auth       required    pam_env.so
auth       sufficient  pam_fprintd.so
auth       required    pam_deny.so

account    include     base-account

# A fingerprint cannot set a password, and kde-fingerprint includes this
# service for `password` as well.
password   required    pam_deny.so

session    include     base-session