24 lines
1.3 KiB
Plaintext
24 lines
1.3 KiB
Plaintext
# PAM stack for the autologin kiosk session — installed to /etc/pam.d/kiosk and
|
|
# referenced by kiosk.service (PAMName=kiosk). Replaces the previous
|
|
# PAMName=login, which pulled in the STIG-hardened login/system-auth stacks
|
|
# (pam_faillock account phase + password aging/inactivity). The kiosk user is
|
|
# unprivileged and PASSWORDLESS, so that hardened *account* phase rejected it and
|
|
# the session never opened (getty kept tty1).
|
|
#
|
|
# systemd runs only the ACCOUNT and SESSION phases for PAMName (never auth), so:
|
|
# - account: permissive (the kiosk user has no password to age/lock; this is an
|
|
# intentional appliance-account deviation — see docs/stig-deviations.md).
|
|
# - session: a full-enough stack that logind/pam_systemd registers the session
|
|
# on seat0/vt1 (weston needs a seat for DRM master + libinput). pam_loginuid
|
|
# keeps the audit trail; pam_limits applies ulimits.
|
|
# A custom service name means STIG/authselect (which only regenerate
|
|
# system-auth/password-auth/login) never touch this file.
|
|
auth required pam_permit.so
|
|
account required pam_permit.so
|
|
password required pam_deny.so
|
|
session required pam_loginuid.so
|
|
session optional pam_keyinit.so force revoke
|
|
session required pam_limits.so
|
|
session optional pam_systemd.so
|
|
session required pam_unix.so
|