# PAM stack for the autologin kiosk session — installed to /etc/pam.d/kiosk and
# referenced by kiosk.service (PAMName=kiosk). Replaces the previous
# PAMName=login, which pulled in the STIG-hardened login/system-auth stacks
# (pam_faillock account phase + password aging/inactivity). The kiosk user is
# unprivileged and PASSWORDLESS, so that hardened *account* phase rejected it and
# the session never opened (getty kept tty1).
#
# systemd runs only the ACCOUNT and SESSION phases for PAMName (never auth), so:
#   - account: permissive (the kiosk user has no password to age/lock; this is an
#     intentional appliance-account deviation — see docs/stig-deviations.md).
#   - session: a full-enough stack that logind/pam_systemd registers the session
#     on seat0/vt1 (weston needs a seat for DRM master + libinput). pam_loginuid
#     keeps the audit trail; pam_limits applies ulimits.
# A custom service name means STIG/authselect (which only regenerate
# system-auth/password-auth/login) never touch this file.
auth        required    pam_permit.so
account     required    pam_permit.so
password    required    pam_deny.so
session     required    pam_loginuid.so
session     optional    pam_keyinit.so force revoke
session     required    pam_limits.so
session     optional    pam_systemd.so
session     required    pam_unix.so