Fix stig over hardening of kiosk account

files/kiosk/kiosk.pam

@@ -0,0 +1,23 @@
+# PAM stack for the autologin kiosk session — installed to /etc/pam.d/kiosk and
+# referenced by kiosk.service (PAMName=kiosk). Replaces the previous
+# PAMName=login, which pulled in the STIG-hardened login/system-auth stacks
+# (pam_faillock account phase + password aging/inactivity). The kiosk user is
+# unprivileged and PASSWORDLESS, so that hardened *account* phase rejected it and
+# the session never opened (getty kept tty1).
+#
+# systemd runs only the ACCOUNT and SESSION phases for PAMName (never auth), so:
+#   - account: permissive (the kiosk user has no password to age/lock; this is an
+#     intentional appliance-account deviation — see docs/stig-deviations.md).
+#   - session: a full-enough stack that logind/pam_systemd registers the session
+#     on seat0/vt1 (weston needs a seat for DRM master + libinput). pam_loginuid
+#     keeps the audit trail; pam_limits applies ulimits.
+# A custom service name means STIG/authselect (which only regenerate
+# system-auth/password-auth/login) never touch this file.
+auth        required    pam_permit.so
+account     required    pam_permit.so
+password    required    pam_deny.so
+session     required    pam_loginuid.so
+session     optional    pam_keyinit.so force revoke
+session     required    pam_limits.so
+session     optional    pam_systemd.so
+session     required    pam_unix.so

files/kiosk/kiosk.service

@@ -10,13 +10,17 @@ Conflicts=getty@tty1.service
 [Service]
 Type=simple
 User=kiosk
-# A real PAM login session on tty1 so logind assigns seat0 — weston needs a seat
-# for DRM master + libinput. (PAMName runs account/session, not auth, so the
-# passwordless kiosk user is fine.) XDG_SEAT/XDG_VTNR are set into the PAM
-# environment before pam_open_session, so pam_systemd registers the session on
+# A real PAM session on tty1 so logind assigns seat0 — weston needs a seat for
+# DRM master + libinput. Uses a DEDICATED PAM stack (/etc/pam.d/kiosk, see
+# files/kiosk/kiosk.pam) instead of "login": under STIG the login/system-auth
+# account phase (pam_faillock + password aging) rejects the passwordless kiosk
+# user, so the session never opened and getty kept tty1. The kiosk stack keeps a
+# full session (pam_systemd seat registration) but a permissive account phase.
+# (PAMName runs account/session, not auth.) XDG_SEAT/XDG_VTNR are set into the
+# PAM environment before pam_open_session so pam_systemd registers the session on
 # seat0/vt1 — WITHOUT them logind's auto-derivation failed and weston died with
 # "logind: failed to get session seat" -> "failed to create compositor backend".
-PAMName=login
+PAMName=kiosk
 Environment=XDG_SEAT=seat0
 Environment=XDG_VTNR=1
 TTYPath=/dev/tty1