feat: new PAM auth management & settings in greeter/lockscreen

- Introduce external management of greetd PAM
- New functionality to validate and apply custom PAM service paths in lockscreen

Port 1.5

core/cmd/dms/commands_auth.go

@@ -1,7 +1,10 @@
 package main
 
 import (
+	"encoding/json"
 	"fmt"
+	"os"
+	"path/filepath"
 	"strings"
 
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
@@ -56,10 +59,108 @@ var authResolveLockCmd = &cobra.Command{
 	},
 }
 
+var authListServicesCmd = &cobra.Command{
+	Use:   "list-services",
+	Short: "List candidate lock-screen PAM services available on this system",
+	Long:  "Enumerate the lock-screen PAM services that exist on this system and report their resolved auth stack (whether it has an auth directive and whether fingerprint/U2F modules appear inline).",
+	Run: func(cmd *cobra.Command, args []string) {
+		asJSON, _ := cmd.Flags().GetBool("json")
+		services := sharedpam.ListLockscreenPamServices()
+
+		if asJSON {
+			payload := struct {
+				Services []sharedpam.LockscreenPamServiceInfo `json:"services"`
+			}{Services: services}
+			data, err := json.MarshalIndent(payload, "", "  ")
+			if err != nil {
+				log.Fatalf("Error encoding services: %v", err)
+			}
+			fmt.Println(string(data))
+			return
+		}
+
+		if len(services) == 0 {
+			fmt.Println("No candidate lock-screen PAM services found.")
+			return
+		}
+		for _, s := range services {
+			fmt.Printf("%-20s %-30s auth=%-5t fingerprint=%-5t u2f=%t\n", s.Name, s.Path, s.HasAuth, s.InlineFingerprint, s.InlineU2f)
+		}
+	},
+}
+
+var authValidateCmd = &cobra.Command{
+	Use:   "validate",
+	Short: "Validate a PAM service file for use as the DMS lock-screen password stack",
+	Long:  "Validate one PAM service (by --service NAME or --path /abs/file) for use as the DMS lock-screen password stack. Exits 1 when the file is not usable.",
+	Run: func(cmd *cobra.Command, args []string) {
+		path, _ := cmd.Flags().GetString("path")
+		service, _ := cmd.Flags().GetString("service")
+		asJSON, _ := cmd.Flags().GetBool("json")
+
+		if (path == "") == (service == "") {
+			log.Fatalf("Error: exactly one of --path or --service is required")
+		}
+
+		var result sharedpam.LockscreenPamValidation
+		if path != "" {
+			if !filepath.IsAbs(path) {
+				result = sharedpam.LockscreenPamValidation{
+					Path:           path,
+					MissingModules: []string{},
+					Warnings:       []string{},
+					Errors:         []string{"--path must be an absolute file path"},
+				}
+			} else {
+				result = sharedpam.ValidateLockscreenPamPath(path)
+			}
+		} else {
+			result = sharedpam.ValidateLockscreenPamService(service)
+		}
+
+		if asJSON {
+			data, err := json.MarshalIndent(result, "", "  ")
+			if err != nil {
+				log.Fatalf("Error encoding validation: %v", err)
+			}
+			fmt.Println(string(data))
+		} else {
+			printLockscreenPamValidation(result)
+		}
+
+		if !result.Valid {
+			os.Exit(1)
+		}
+	},
+}
+
+func printLockscreenPamValidation(result sharedpam.LockscreenPamValidation) {
+	fmt.Printf("Path:               %s\n", result.Path)
+	fmt.Printf("Valid:              %t\n", result.Valid)
+	fmt.Printf("Has auth:           %t\n", result.HasAuth)
+	fmt.Printf("Inline fingerprint: %t\n", result.InlineFingerprint)
+	fmt.Printf("Inline U2F:         %t\n", result.InlineU2f)
+	if len(result.MissingModules) > 0 {
+		fmt.Printf("Missing modules:    %s\n", strings.Join(result.MissingModules, ", "))
+	}
+	for _, w := range result.Warnings {
+		fmt.Println("⚠ " + w)
+	}
+	for _, e := range result.Errors {
+		fmt.Println("✗ " + e)
+	}
+}
+
 func init() {
 	authSyncCmd.Flags().BoolP("yes", "y", false, "Non-interactive mode: skip prompts")
 	authSyncCmd.Flags().BoolP("terminal", "t", false, "Run auth sync in a new terminal (for entering sudo password)")
 	authResolveLockCmd.Flags().BoolP("quiet", "q", false, "Only print the resulting file path")
+
+	authListServicesCmd.Flags().Bool("json", false, "Output as JSON")
+
+	authValidateCmd.Flags().String("path", "", "Absolute path to a PAM service file to validate")
+	authValidateCmd.Flags().String("service", "", "Name of a PAM service to resolve across the system PAM dirs")
+	authValidateCmd.Flags().Bool("json", false, "Output as JSON")
 }
 
 func syncAuth(nonInteractive bool) error {

core/cmd/dms/main.go

@@ -20,7 +20,7 @@ func init() {
 	runCmd.Flags().MarkHidden("daemon-child")
 
 	greeterCmd.AddCommand(greeterInstallCmd, greeterSyncCmd, greeterEnableCmd, greeterStatusCmd, greeterUninstallCmd, greeterLaunchSessionCmd)
-	authCmd.AddCommand(authSyncCmd, authResolveLockCmd)
+	authCmd.AddCommand(authSyncCmd, authResolveLockCmd, authListServicesCmd, authValidateCmd)
 	setupCmd.AddCommand(setupBindsCmd, setupLayoutCmd, setupColorsCmd, setupAlttabCmd, setupOutputsCmd, setupCursorCmd, setupWindowrulesCmd)
 	updateCmd.AddCommand(updateCheckCmd)
 	pluginsCmd.AddCommand(pluginsBrowseCmd, pluginsListCmd, pluginsInstallCmd, pluginsUninstallCmd, pluginsUpdateCmd)

core/cmd/dms/main_distro.go

@@ -20,7 +20,7 @@ func init() {
 	runCmd.Flags().MarkHidden("daemon-child")
 
 	greeterCmd.AddCommand(greeterInstallCmd, greeterSyncCmd, greeterEnableCmd, greeterStatusCmd, greeterUninstallCmd, greeterLaunchSessionCmd)
-	authCmd.AddCommand(authSyncCmd, authResolveLockCmd)
+	authCmd.AddCommand(authSyncCmd, authResolveLockCmd, authListServicesCmd, authValidateCmd)
 	setupCmd.AddCommand(setupBindsCmd, setupLayoutCmd, setupColorsCmd, setupAlttabCmd, setupOutputsCmd, setupCursorCmd, setupWindowrulesCmd)
 	pluginsCmd.AddCommand(pluginsBrowseCmd, pluginsListCmd, pluginsInstallCmd, pluginsUninstallCmd, pluginsUpdateCmd)
 	rootCmd.AddCommand(getCommonCommands()...)

core/internal/pam/pam.go

@@ -70,10 +70,11 @@ var includedPamAuthFiles = []string{
 }
 
 type AuthSettings struct {
-	EnableFprint        bool `json:"enableFprint"`
-	EnableU2f           bool `json:"enableU2f"`
-	GreeterEnableFprint bool `json:"greeterEnableFprint"`
-	GreeterEnableU2f    bool `json:"greeterEnableU2f"`
+	EnableFprint                bool `json:"enableFprint"`
+	EnableU2f                   bool `json:"enableU2f"`
+	GreeterEnableFprint         bool `json:"greeterEnableFprint"`
+	GreeterEnableU2f            bool `json:"greeterEnableU2f"`
+	GreeterPamExternallyManaged bool `json:"greeterPamExternallyManaged"`
 }
 
 type SyncAuthOptions struct {
@@ -236,6 +237,14 @@ func syncAuthConfigWithDeps(logFunc func(string), sudoPassword string, options S
 		return fmt.Errorf("failed to inspect %s: %w", deps.greetdPath, err)
 	}
 
+	if settings.GreeterPamExternallyManaged {
+		if err := removeManagedGreeterPamBlockWithDeps(logFunc, sudoPassword, deps); err != nil {
+			return err
+		}
+		logFunc("ℹ /etc/pam.d/greetd is externally managed. Skipping DMS greeter PAM sync.")
+		return nil
+	}
+
 	if err := syncGreeterPamConfigWithDeps(logFunc, sudoPassword, settings, options.ForceGreeterAuth, deps); err != nil {
 		return err
 	}
@@ -583,6 +592,270 @@ func buildManagedLockscreenPamContent(baseDirs []string, readFile func(string) (
 	return b.String(), nil
 }
 
+// lockscreenPamCandidateServices are the services surfaced by list-services:
+// the standalone entry points plus the shared auth blocks users may pin.
+var lockscreenPamCandidateServices = []string{
+	"login",
+	"system-auth",
+	"system-login",
+	"system-local-login",
+	"common-auth",
+	"base-auth",
+}
+
+// LockscreenPamServiceInfo describes one candidate lock-screen PAM service.
+type LockscreenPamServiceInfo struct {
+	Name              string `json:"name"`
+	Dir               string `json:"dir"`
+	Path              string `json:"path"`
+	HasAuth           bool   `json:"hasAuth"`
+	InlineFingerprint bool   `json:"inlineFingerprint"`
+	InlineU2f         bool   `json:"inlineU2f"`
+}
+
+// LockscreenPamValidation is the result of validating a PAM service file for
+// use as the DMS lock-screen password stack.
+type LockscreenPamValidation struct {
+	Valid             bool     `json:"valid"`
+	Path              string   `json:"path"`
+	HasAuth           bool     `json:"hasAuth"`
+	InlineFingerprint bool     `json:"inlineFingerprint"`
+	InlineU2f         bool     `json:"inlineU2f"`
+	MissingModules    []string `json:"missingModules"`
+	Warnings          []string `json:"warnings"`
+	Errors            []string `json:"errors"`
+}
+
+type lockscreenPamValidateDeps struct {
+	baseDirs        []string
+	readFile        func(string) ([]byte, error)
+	stat            func(string) (os.FileInfo, error)
+	pamModuleExists func(string) bool
+}
+
+func defaultValidateDeps() lockscreenPamValidateDeps {
+	return lockscreenPamValidateDeps{
+		baseDirs:        lockscreenPamBaseDirs,
+		readFile:        os.ReadFile,
+		stat:            os.Stat,
+		pamModuleExists: pamModuleExists,
+	}
+}
+
+// lockscreenPamAnalysis is a non-destructive walk of a PAM service. Unlike
+// resolveService it detects (rather than strips) pam_fprintd/pam_u2f and
+// records unknown directives instead of hard-failing on them.
+type lockscreenPamAnalysis struct {
+	lines             []string
+	hasAuth           bool
+	inlineFingerprint bool
+	inlineU2f         bool
+	modules           []string
+	unknownDirectives []string
+	err               error
+}
+
+func (r lockscreenPamResolver) analyzePath(path string) lockscreenPamAnalysis {
+	var acc lockscreenPamAnalysis
+	if err := r.analyzeInto(filepath.Clean(path), "", nil, &acc); err != nil {
+		acc.err = err
+	}
+	return acc
+}
+
+func (r lockscreenPamResolver) analyzeInto(path string, filterType string, stack []string, acc *lockscreenPamAnalysis) error {
+	for _, seen := range stack {
+		if seen == path {
+			chain := append(append([]string{}, stack...), path)
+			display := make([]string, 0, len(chain))
+			for _, item := range chain {
+				display = append(display, filepath.Base(item))
+			}
+			return fmt.Errorf("cyclic PAM include detected: %s", strings.Join(display, " -> "))
+		}
+	}
+
+	data, err := r.readFile(path)
+	if err != nil {
+		return fmt.Errorf("failed to read PAM file %s: %w", path, err)
+	}
+
+	for _, rawLine := range strings.Split(strings.ReplaceAll(string(data), "\r\n", "\n"), "\n") {
+		rawLine = strings.TrimRight(rawLine, "\r")
+		trimmed := strings.TrimSpace(rawLine)
+		if trimmed == "" || strings.HasPrefix(trimmed, "#") {
+			continue
+		}
+
+		if include, ok := parseLockscreenPamIncludeDirective(trimmed, filterType); ok {
+			lineType := pamDirectiveType(trimmed)
+			if filterType != "" && lineType != "" && lineType != filterType {
+				continue
+			}
+			nestedPath := include.target
+			if filepath.IsAbs(nestedPath) {
+				nestedPath = filepath.Clean(nestedPath)
+			} else {
+				located, err := r.locate(include.target)
+				if err != nil {
+					return fmt.Errorf("failed to read PAM file %s: %w", include.target, err)
+				}
+				nestedPath = located
+			}
+			if err := r.analyzeInto(nestedPath, include.filterType, append(stack, path), acc); err != nil {
+				return err
+			}
+			continue
+		}
+
+		lineType := pamDirectiveType(trimmed)
+		if lineType == "" {
+			acc.unknownDirectives = append(acc.unknownDirectives, trimmed)
+			continue
+		}
+		if filterType != "" && lineType != filterType {
+			continue
+		}
+
+		acc.lines = append(acc.lines, rawLine)
+		if lineType == "auth" {
+			acc.hasAuth = true
+		}
+
+		foundModule := false
+		for _, field := range strings.Fields(trimmed) {
+			if strings.HasPrefix(field, "#") {
+				break
+			}
+			if strings.Contains(field, "pam_fprintd") {
+				acc.inlineFingerprint = true
+			}
+			if strings.Contains(field, "pam_u2f") {
+				acc.inlineU2f = true
+			}
+			if !foundModule && strings.HasSuffix(field, ".so") {
+				acc.modules = append(acc.modules, field)
+				foundModule = true
+			}
+		}
+	}
+
+	return nil
+}
+
+// ListLockscreenPamServices enumerates the candidate lock-screen services that
+// exist on this system, earlier base dir winning per name (libpam precedence).
+func ListLockscreenPamServices() []LockscreenPamServiceInfo {
+	return listLockscreenPamServices(lockscreenPamBaseDirs, os.ReadFile)
+}
+
+func listLockscreenPamServices(baseDirs []string, readFile func(string) ([]byte, error)) []LockscreenPamServiceInfo {
+	resolver := lockscreenPamResolver{baseDirs: baseDirs, readFile: readFile}
+	out := make([]LockscreenPamServiceInfo, 0, len(lockscreenPamCandidateServices))
+	for _, name := range lockscreenPamCandidateServices {
+		path, err := resolver.locate(name)
+		if err != nil {
+			continue
+		}
+		info := LockscreenPamServiceInfo{
+			Name: name,
+			Dir:  filepath.Dir(path),
+			Path: path,
+		}
+		if analysis := resolver.analyzePath(path); analysis.err == nil {
+			info.HasAuth = analysis.hasAuth
+			info.InlineFingerprint = analysis.inlineFingerprint
+			info.InlineU2f = analysis.inlineU2f
+		}
+		out = append(out, info)
+	}
+	return out
+}
+
+// ValidateLockscreenPamService validates a named service resolved across the
+// system PAM base dirs.
+func ValidateLockscreenPamService(name string) LockscreenPamValidation {
+	return validateLockscreenPam(name, "", defaultValidateDeps())
+}
+
+// ValidateLockscreenPamPath validates an arbitrary absolute PAM file, which may
+// live outside the standard base dirs.
+func ValidateLockscreenPamPath(path string) LockscreenPamValidation {
+	return validateLockscreenPam("", path, defaultValidateDeps())
+}
+
+func validateLockscreenPam(serviceName string, path string, deps lockscreenPamValidateDeps) LockscreenPamValidation {
+	result := LockscreenPamValidation{
+		MissingModules: []string{},
+		Warnings:       []string{},
+		Errors:         []string{},
+	}
+	resolver := lockscreenPamResolver{baseDirs: deps.baseDirs, readFile: deps.readFile}
+
+	var analysis lockscreenPamAnalysis
+	if path != "" {
+		result.Path = path
+		analysis = resolver.analyzePath(path)
+	} else {
+		located, err := resolver.locate(serviceName)
+		if err != nil {
+			result.Errors = append(result.Errors, fmt.Sprintf("PAM service %q not found: %v", serviceName, err))
+			return result
+		}
+		result.Path = located
+		analysis = resolver.analyzePath(located)
+	}
+
+	if analysis.err != nil {
+		result.Errors = append(result.Errors, analysis.err.Error())
+		return result
+	}
+
+	result.HasAuth = analysis.hasAuth
+	result.InlineFingerprint = analysis.inlineFingerprint
+	result.InlineU2f = analysis.inlineU2f
+
+	if !analysis.hasAuth {
+		result.Errors = append(result.Errors, "no auth directives found after include resolution")
+	}
+
+	for _, directive := range analysis.unknownDirectives {
+		result.Warnings = append(result.Warnings, "unsupported PAM directive (libpam may still handle it at runtime): "+directive)
+	}
+
+	seen := map[string]bool{}
+	for _, ref := range analysis.modules {
+		name := filepath.Base(ref)
+		if seen[name] {
+			continue
+		}
+		seen[name] = true
+		if moduleReferenceExists(ref, deps) {
+			continue
+		}
+		result.MissingModules = append(result.MissingModules, name)
+		result.Warnings = append(result.Warnings, "referenced PAM module not found: "+name)
+	}
+
+	if analysis.inlineFingerprint {
+		result.Warnings = append(result.Warnings, "pam_fprintd is present in the resolved stack; may double-prompt with DMS's separate fingerprint context")
+	}
+	if analysis.inlineU2f {
+		result.Warnings = append(result.Warnings, "pam_u2f is present in the resolved stack; may double-prompt with DMS's separate U2F context")
+	}
+
+	result.Valid = len(result.Errors) == 0
+	return result
+}
+
+func moduleReferenceExists(ref string, deps lockscreenPamValidateDeps) bool {
+	if filepath.IsAbs(ref) {
+		_, err := deps.stat(ref)
+		return err == nil
+	}
+	return deps.pamModuleExists(ref)
+}
+
 const UserLockscreenPamService = "dankshell"
 
 func UserLockscreenPamDir() string {

core/internal/pam/pam_test.go

@@ -786,6 +786,223 @@ func TestRemoveManagedGreeterPamBlockWithDeps(t *testing.T) {
 	}
 }
 
+func (e *pamTestEnv) validateDeps() lockscreenPamValidateDeps {
+	return lockscreenPamValidateDeps{
+		baseDirs:        []string{e.pamDir},
+		readFile:        os.ReadFile,
+		stat:            os.Stat,
+		pamModuleExists: func(module string) bool { return e.availableModules[module] },
+	}
+}
+
+func TestListLockscreenPamServices(t *testing.T) {
+	t.Parallel()
+
+	t.Run("dedupes by name with earlier base dir winning", func(t *testing.T) {
+		t.Parallel()
+
+		etcDir := t.TempDir()
+		vendorDir := t.TempDir()
+		// login exists in both dirs; system-auth only in the vendor dir.
+		writeTestFile(t, filepath.Join(etcDir, "login"), "#%PAM-1.0\nauth required pam_unix.so\naccount required pam_unix.so\n")
+		writeTestFile(t, filepath.Join(vendorDir, "login"), "#%PAM-1.0\nauth required pam_deny.so\n")
+		writeTestFile(t, filepath.Join(vendorDir, "system-auth"), "#%PAM-1.0\nauth sufficient pam_unix.so\naccount required pam_unix.so\n")
+
+		services := listLockscreenPamServices([]string{etcDir, vendorDir}, os.ReadFile)
+		if len(services) != 2 {
+			t.Fatalf("expected 2 services (login, system-auth), got %d: %+v", len(services), services)
+		}
+		byName := map[string]LockscreenPamServiceInfo{}
+		for _, s := range services {
+			byName[s.Name] = s
+		}
+		login, ok := byName["login"]
+		if !ok {
+			t.Fatalf("expected login service, got %+v", services)
+		}
+		if login.Dir != etcDir || login.Path != filepath.Join(etcDir, "login") {
+			t.Fatalf("expected login to resolve in earlier dir %s, got dir=%s path=%s", etcDir, login.Dir, login.Path)
+		}
+		if !login.HasAuth {
+			t.Fatalf("expected login to report hasAuth")
+		}
+		if byName["system-auth"].Dir != vendorDir {
+			t.Fatalf("expected system-auth to resolve in vendor dir, got %s", byName["system-auth"].Dir)
+		}
+	})
+
+	t.Run("include resolution sets hasAuth and detects inline fprintd/u2f", func(t *testing.T) {
+		t.Parallel()
+
+		env := newPamTestEnv(t)
+		env.writePamFile(t, "login", "#%PAM-1.0\nauth include system-auth\naccount include system-auth\n")
+		env.writePamFile(t, "system-auth", "auth sufficient pam_unix.so\nauth sufficient pam_fprintd.so\nauth sufficient pam_u2f.so cue\naccount required pam_unix.so\n")
+
+		services := listLockscreenPamServices([]string{env.pamDir}, os.ReadFile)
+		var login LockscreenPamServiceInfo
+		for _, s := range services {
+			if s.Name == "login" {
+				login = s
+			}
+		}
+		if !login.HasAuth {
+			t.Fatalf("expected hasAuth via resolved include")
+		}
+		if !login.InlineFingerprint || !login.InlineU2f {
+			t.Fatalf("expected inline fingerprint and u2f detection, got %+v", login)
+		}
+	})
+}
+
+func TestValidateLockscreenPam(t *testing.T) {
+	t.Parallel()
+
+	t.Run("valid service with resolved auth", func(t *testing.T) {
+		t.Parallel()
+
+		env := newPamTestEnv(t)
+		env.availableModules["pam_unix.so"] = true
+		env.writePamFile(t, "login", "#%PAM-1.0\nauth include system-auth\naccount include system-auth\n")
+		env.writePamFile(t, "system-auth", "auth sufficient pam_unix.so\naccount required pam_unix.so\n")
+
+		result := validateLockscreenPam("login", "", env.validateDeps())
+		if !result.Valid {
+			t.Fatalf("expected valid result, got %+v", result)
+		}
+		if !result.HasAuth {
+			t.Fatalf("expected hasAuth true")
+		}
+		if len(result.Errors) != 0 {
+			t.Fatalf("expected no errors, got %v", result.Errors)
+		}
+	})
+
+	t.Run("path outside base dirs is read directly", func(t *testing.T) {
+		t.Parallel()
+
+		env := newPamTestEnv(t)
+		env.availableModules["pam_unix.so"] = true
+		outside := filepath.Join(t.TempDir(), "custom-pam")
+		writeTestFile(t, outside, "#%PAM-1.0\nauth sufficient pam_unix.so\naccount required pam_unix.so\n")
+
+		result := validateLockscreenPam("", outside, env.validateDeps())
+		if !result.Valid || result.Path != outside {
+			t.Fatalf("expected valid result for outside path, got %+v", result)
+		}
+	})
+
+	t.Run("missing module produces warning and missingModules but stays valid", func(t *testing.T) {
+		t.Parallel()
+
+		env := newPamTestEnv(t)
+		env.availableModules["pam_unix.so"] = true
+		env.writePamFile(t, "system-auth", "#%PAM-1.0\nauth sufficient pam_unix.so\nauth required pam_absent.so\naccount required pam_unix.so\n")
+
+		result := validateLockscreenPam("system-auth", "", env.validateDeps())
+		if !result.Valid {
+			t.Fatalf("expected valid despite missing module, got %+v", result)
+		}
+		if len(result.MissingModules) != 1 || result.MissingModules[0] != "pam_absent.so" {
+			t.Fatalf("expected missing pam_absent.so, got %v", result.MissingModules)
+		}
+		if !containsSubstr(result.Warnings, "pam_absent.so") {
+			t.Fatalf("expected warning about missing module, got %v", result.Warnings)
+		}
+	})
+
+	t.Run("unknown directive is a warning not an error", func(t *testing.T) {
+		t.Parallel()
+
+		env := newPamTestEnv(t)
+		env.availableModules["pam_unix.so"] = true
+		env.availableModules["pam_foo.so"] = true
+		env.writePamFile(t, "system-auth", "#%PAM-1.0\nauth sufficient pam_unix.so\nbadtype required pam_foo.so\naccount required pam_unix.so\n")
+
+		result := validateLockscreenPam("system-auth", "", env.validateDeps())
+		if !result.Valid {
+			t.Fatalf("expected valid with unknown directive, got %+v", result)
+		}
+		if len(result.Errors) != 0 {
+			t.Fatalf("expected no errors, got %v", result.Errors)
+		}
+		if !containsSubstr(result.Warnings, "unsupported PAM directive") {
+			t.Fatalf("expected unsupported directive warning, got %v", result.Warnings)
+		}
+	})
+
+	t.Run("cyclic include is an error", func(t *testing.T) {
+		t.Parallel()
+
+		env := newPamTestEnv(t)
+		env.writePamFile(t, "login", "#%PAM-1.0\nauth include system-auth\n")
+		env.writePamFile(t, "system-auth", "auth include login\n")
+
+		result := validateLockscreenPam("login", "", env.validateDeps())
+		if result.Valid {
+			t.Fatalf("expected invalid on cyclic include, got %+v", result)
+		}
+		if !containsSubstr(result.Errors, "cyclic PAM include detected") {
+			t.Fatalf("expected cyclic include error, got %v", result.Errors)
+		}
+	})
+
+	t.Run("no auth directives is an error", func(t *testing.T) {
+		t.Parallel()
+
+		env := newPamTestEnv(t)
+		env.availableModules["pam_unix.so"] = true
+		env.writePamFile(t, "system-auth", "#%PAM-1.0\naccount required pam_unix.so\n")
+
+		result := validateLockscreenPam("system-auth", "", env.validateDeps())
+		if result.Valid {
+			t.Fatalf("expected invalid when no auth directives, got %+v", result)
+		}
+		if !containsSubstr(result.Errors, "no auth directives") {
+			t.Fatalf("expected no-auth error, got %v", result.Errors)
+		}
+	})
+
+	t.Run("missing file is an error", func(t *testing.T) {
+		t.Parallel()
+
+		env := newPamTestEnv(t)
+		result := validateLockscreenPam("", filepath.Join(env.pamDir, "does-not-exist"), env.validateDeps())
+		if result.Valid || len(result.Errors) == 0 {
+			t.Fatalf("expected invalid for missing file, got %+v", result)
+		}
+	})
+
+	t.Run("inline fingerprint and u2f produce warnings", func(t *testing.T) {
+		t.Parallel()
+
+		env := newPamTestEnv(t)
+		env.availableModules["pam_unix.so"] = true
+		env.availableModules["pam_fprintd.so"] = true
+		env.availableModules["pam_u2f.so"] = true
+		env.writePamFile(t, "system-auth", "#%PAM-1.0\nauth sufficient pam_unix.so\nauth sufficient pam_fprintd.so\nauth sufficient pam_u2f.so cue\naccount required pam_unix.so\n")
+
+		result := validateLockscreenPam("system-auth", "", env.validateDeps())
+		if !result.Valid {
+			t.Fatalf("expected valid, got %+v", result)
+		}
+		if !result.InlineFingerprint || !result.InlineU2f {
+			t.Fatalf("expected inline flags set, got %+v", result)
+		}
+		if !containsSubstr(result.Warnings, "pam_fprintd") || !containsSubstr(result.Warnings, "pam_u2f") {
+			t.Fatalf("expected double-prompt warnings, got %v", result.Warnings)
+		}
+	})
+}
+
+func containsSubstr(items []string, substr string) bool {
+	for _, item := range items {
+		if strings.Contains(item, substr) {
+			return true
+		}
+	}
+	return false
+}
+
 func TestSyncAuthConfigWithDeps(t *testing.T) {
 	t.Parallel()
 
@@ -848,6 +1065,39 @@ func TestSyncAuthConfigWithDeps(t *testing.T) {
 		}
 	})
 
+	t.Run("externally managed greetd is stripped and greeter sync skipped", func(t *testing.T) {
+		t.Parallel()
+
+		env := newPamTestEnv(t)
+		env.availableModules["pam_fprintd.so"] = true
+		env.writeSettings(t, `{"greeterPamExternallyManaged":true,"greeterEnableFprint":true}`)
+		env.writePamFile(t, "login", "#%PAM-1.0\nauth include system-auth\naccount include system-auth\n")
+		env.writePamFile(t, "system-auth", "auth sufficient pam_unix.so\naccount required pam_unix.so\n")
+		env.writePamFile(t, "greetd", "#%PAM-1.0\nauth include system-auth\n"+
+			GreeterPamManagedBlockStart+"\n"+
+			"auth sufficient pam_fprintd.so max-tries=2 timeout=10\n"+
+			GreeterPamManagedBlockEnd+"\n")
+
+		var logs []string
+		err := syncAuthConfigWithDeps(func(msg string) {
+			logs = append(logs, msg)
+		}, "", SyncAuthOptions{HomeDir: env.homeDir}, env.deps(false))
+		if err != nil {
+			t.Fatalf("syncAuthConfigWithDeps returned error: %v", err)
+		}
+
+		greetd := readFileString(t, env.greetdPath)
+		if strings.Contains(greetd, GreeterPamManagedBlockStart) || strings.Contains(greetd, "pam_fprintd") {
+			t.Fatalf("expected DMS-managed block stripped from externally managed greetd:\n%s", greetd)
+		}
+		if !strings.Contains(greetd, "auth include system-auth") {
+			t.Fatalf("expected non-DMS greetd lines to remain:\n%s", greetd)
+		}
+		if !containsSubstr(logs, "externally managed") {
+			t.Fatalf("expected externally-managed skip log, got %v", logs)
+		}
+	})
+
 	t.Run("NixOS remains informational and non-mutating", func(t *testing.T) {
 		t.Parallel()