Fix stig over hardening of kiosk account

files/kiosk/kiosk.pam

@@ -0,0 +1,23 @@
+# PAM stack for the autologin kiosk session — installed to /etc/pam.d/kiosk and
+# referenced by kiosk.service (PAMName=kiosk). Replaces the previous
+# PAMName=login, which pulled in the STIG-hardened login/system-auth stacks
+# (pam_faillock account phase + password aging/inactivity). The kiosk user is
+# unprivileged and PASSWORDLESS, so that hardened *account* phase rejected it and
+# the session never opened (getty kept tty1).
+#
+# systemd runs only the ACCOUNT and SESSION phases for PAMName (never auth), so:
+#   - account: permissive (the kiosk user has no password to age/lock; this is an
+#     intentional appliance-account deviation — see docs/stig-deviations.md).
+#   - session: a full-enough stack that logind/pam_systemd registers the session
+#     on seat0/vt1 (weston needs a seat for DRM master + libinput). pam_loginuid
+#     keeps the audit trail; pam_limits applies ulimits.
+# A custom service name means STIG/authselect (which only regenerate
+# system-auth/password-auth/login) never touch this file.
+auth        required    pam_permit.so
+account     required    pam_permit.so
+password    required    pam_deny.so
+session     required    pam_loginuid.so
+session     optional    pam_keyinit.so force revoke
+session     required    pam_limits.so
+session     optional    pam_systemd.so
+session     required    pam_unix.so