sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Fix stig over hardening of kiosk account

Browse Source
This commit is contained in:
Audiobuzz
2026-06-18 13:28:01 +00:00
parent 215b0eb10c
commit 6608818902
5 changed files with 118 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
files/kiosk/kiosk.service
+9 -5
View File
@@ -10,13 +10,17 @@ Conflicts=getty@tty1.service
[Service]
Type=simple
User=kiosk
# A real PAM login session on tty1 so logind assigns seat0 — weston needs a seat
# for DRM master + libinput. (PAMName runs account/session, not auth, so the
# passwordless kiosk user is fine.) XDG_SEAT/XDG_VTNR are set into the PAM
# environment before pam_open_session, so pam_systemd registers the session on
# A real PAM session on tty1 so logind assigns seat0 — weston needs a seat for
# DRM master + libinput. Uses a DEDICATED PAM stack (/etc/pam.d/kiosk, see
# files/kiosk/kiosk.pam) instead of "login": under STIG the login/system-auth
# account phase (pam_faillock + password aging) rejects the passwordless kiosk
# user, so the session never opened and getty kept tty1. The kiosk stack keeps a
# full session (pam_systemd seat registration) but a permissive account phase.
# (PAMName runs account/session, not auth.) XDG_SEAT/XDG_VTNR are set into the
# PAM environment before pam_open_session so pam_systemd registers the session on
# seat0/vt1 — WITHOUT them logind's auto-derivation failed and weston died with
# "logind: failed to get session seat" -> "failed to create compositor backend".
PAMName=login
PAMName=kiosk
Environment=XDG_SEAT=seat0
Environment=XDG_VTNR=1
TTYPath=/dev/tty1