#%PAM-1.0
# SPDX-License-Identifier: GPL-3.0-only
# SPDX-FileCopyrightText: Copyright (C) 2026 Catcrafts®
#
# The second service kscreenlocker names and Alpine does not provide.
#
# /etc/pam.d/kde-fingerprint is written for a Fedora/authselect layout. Its
# auth stack is:
#
#     auth  substack  fingerprint-auth
#     auth  include   postlogin
#
# Neither file exists on Alpine. With only the first supplied, a fingerprint
# that MATCHED still came back as "Permission denied", because the include of
# a missing service fails after the match has already succeeded -- which is a
# confusing way to be told a file is absent.
#
# On Fedora postlogin does lastlog and umask bookkeeping. Nothing here needs
# that. What is needed is that the seam exists and contributes nothing, so the
# result of the stack stays the one the fingerprint substack produced.
#
# Vendor directory, so an administrator can still override it in /etc/pam.d.
# Shipped here for the same reason as fingerprint-auth: this package is what
# makes the fingerprint half of that stack mean anything.
auth      optional  pam_permit.so
account   optional  pam_permit.so
password  optional  pam_permit.so
session   optional  pam_permit.so