28allday
152923f5d8
We now own the pinned shell, so the runtime patches that the pacman-hook + patch-script machinery re-applied after every caelestia-shell upgrade are baked directly into source. Folds in all five caelestia-shell-targeting patches from the builder's `os updates/`: - Lock PAM (F1, blocker): ship faillock-free assets/pam.d/caelestia and point modules/lock/Pam.qml's passwd PamContext at it (config "passwd" -> "caelestia"). A desktop screen-lock must never lock the user out of their own session. - Updates page: add modules/nexus/pages/UpdatesPage.qml + register it in the first System slot of PageCompRegistry.qml. - Additions page: add modules/nexus/pages/AdditionsPage.qml + register it in the Plugins slot; relabel Plugins -> Additions in PageRegistry.qml. - Sudo toggle: add modules/nexus/common/SudoToggleRow.qml + insert it into ServicesPage.qml after the Smart colour scheme toggle. - Wi-Fi wrong-password recovery: NetworkConnection.qml saved-profile branch now passes a real callback that forgets the bad profile and reopens the dialog. The builder will drop the corresponding patch-*.sh calls + pacman hooks and bump NOSIGNAL_SHELL_COMMIT to this commit. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
20 lines
1,009 B
Text
20 lines
1,009 B
Text
#%PAM-1.0
|
|
# Caelestia lock-screen authentication (NoSignal).
|
|
#
|
|
# Deliberately does NOT use pam_faillock: a desktop screen-lock must never lock
|
|
# the user out of their OWN running session. With faillock in the path (the old
|
|
# "passwd"->system-auth route), a few failed unlocks tripped a temporary account
|
|
# lock that then refused the *correct* password until /run/faillock cleared on
|
|
# reboot. See README.md / finding F1.
|
|
#
|
|
# pam_unix verifies the password supplied via the PAM conversation (the lock UI)
|
|
# using the setuid unix_chkpwd helper, so it works for the uid-1000 Quickshell
|
|
# process. Add pam_systemd_home below if/when systemd-homed users are supported.
|
|
#
|
|
# F8a: deliberately NO `nullok` — a screen lock must never accept an empty
|
|
# password. (Only changes behaviour for empty-password accounts, which are
|
|
# correctly rejected; normal password auth is unaffected.)
|
|
auth required pam_unix.so
|
|
account required pam_unix.so
|
|
password required pam_unix.so
|
|
session required pam_unix.so
|