fix(lock): add complete bundled PAM services (#2685)

core/internal/pam/pam.go

@@ -499,6 +499,9 @@ func buildManagedLockscreenU2FPamContent() string {
 	b.WriteString("#%PAM-1.0\n")
 	b.WriteString(LockscreenU2FPamManagedBlockStart + "\n")
 	b.WriteString("auth    required    pam_u2f.so  cue nouserok timeout=10\n")
+	b.WriteString("account required    pam_permit.so\n")
+	b.WriteString("password required   pam_deny.so\n")
+	b.WriteString("session required    pam_permit.so\n")
 	b.WriteString(LockscreenU2FPamManagedBlockEnd + "\n")
 	return b.String()
 }

flake.nix

@@ -150,10 +150,17 @@
                   --replace-fail /bin/bash ${pkgs.bashInteractive}/bin/bash
 
                 substituteInPlace $out/share/quickshell/dms/assets/pam/fprint \
-                  --replace-fail pam_fprintd.so ${pkgs.fprintd}/lib/security/pam_fprintd.so
+                  --replace-fail pam_fprintd.so ${pkgs.fprintd}/lib/security/pam_fprintd.so \
+                  --replace-fail pam_deny.so ${pkgs.pam}/lib/security/pam_deny.so \
+                  --replace-fail pam_permit.so ${pkgs.pam}/lib/security/pam_permit.so
 
                 substituteInPlace $out/share/quickshell/dms/assets/pam/u2f \
-                  --replace-fail pam_u2f.so ${pkgs.pam_u2f}/lib/security/pam_u2f.so
+                  --replace-fail pam_u2f.so ${pkgs.pam_u2f}/lib/security/pam_u2f.so \
+                  --replace-fail pam_deny.so ${pkgs.pam}/lib/security/pam_deny.so \
+                  --replace-fail pam_permit.so ${pkgs.pam}/lib/security/pam_permit.so
+
+                substituteInPlace $out/share/quickshell/dms/assets/pam/other \
+                  --replace-fail pam_deny.so ${pkgs.pam}/lib/security/pam_deny.so
 
                 installShellCompletion --cmd dms \
                   --bash <($out/bin/dms completion bash) \

quickshell/assets/pam/fprint

@@ -1,3 +1,6 @@
 #%PAM-1.0
 
 auth    required    pam_fprintd.so  max-tries=5
+account required    pam_permit.so
+password required   pam_deny.so
+session required    pam_permit.so

quickshell/assets/pam/login

@@ -3,3 +3,5 @@ auth      required     pam_env.so
 auth      sufficient   pam_unix.so       try_first_pass nullok
 auth      required     pam_deny.so
 account   required     pam_unix.so
+password  required     pam_deny.so
+session   required     pam_permit.so

quickshell/assets/pam/other

@@ -0,0 +1,5 @@
+#%PAM-1.0
+auth     required    pam_deny.so
+account  required    pam_deny.so
+password required    pam_deny.so
+session  required    pam_deny.so

quickshell/assets/pam/u2f

@@ -1,3 +1,6 @@
 #%PAM-1.0
 
 auth    required    pam_u2f.so  cue nouserok timeout=10
+account required    pam_permit.so
+password required   pam_deny.so
+session required    pam_permit.so