bump: etc

34 files changed, 259 insertions, 2 deletions

diff --git a/etc/crypttab b/etc/crypttab
index 5f1d2973..8bf3b2d2 100644
--- a/etc/crypttab
+++ b/etc/crypttab
@@ -10,5 +10,7 @@
 # data2        /dev/sda5                                    /etc/cryptfs.key
 # swap         /dev/sdx4                                    /dev/urandom            swap,cipher=aes-cbc-essiv:sha256,size=256
 # vol          /dev/sdb7                                    none
-arch-root      UUID=bc526687-9deb-4078-abd1-55692022e073    -                       tpm2-device=auto
-# cryptdata      UUID=bc526687-9deb-4078-abd1-55692022e073    none    luks,keyscript=decrypt_keyctl
+# arch-root      UUID=71ce78be-ecf4-4696-abd3-cdc17881e5c8    -                       tpm2-device=auto
+arch-root      UUID=71ce78be-ecf4-4696-abd3-cdc17881e5c8    -                       fido2-device=auto
+# arch-swap	   UUID=5361445b-d32a-41ea-94fe-05aacfc7217a	-					   tpm2-device=auto
+# cryptdata      UUID=8d8ffbd2-5876-481b-b7e7-8ce2fb5346eb    none    luks,keyscript=decrypt_keyctl
diff --git a/etc/pam.d/chfn b/etc/pam.d/chfn
new file mode 100644
index 00000000..066186e3
--- /dev/null
+++ b/etc/pam.d/chfn
@@ -0,0 +1,6 @@
+#%PAM-1.0
+auth            sufficient      pam_rootok.so
+auth            required        pam_unix.so
+account         required        pam_unix.so
+session         required        pam_unix.so
+password        required        pam_permit.so
diff --git a/etc/pam.d/chpasswd b/etc/pam.d/chpasswd
new file mode 100644
index 00000000..8f49f5cc
--- /dev/null
+++ b/etc/pam.d/chpasswd
@@ -0,0 +1,4 @@
+#%PAM-1.0
+auth		sufficient	pam_rootok.so
+account		required	pam_permit.so
+password	include		system-auth
diff --git a/etc/pam.d/chsh b/etc/pam.d/chsh
new file mode 100644
index 00000000..066186e3
--- /dev/null
+++ b/etc/pam.d/chsh
@@ -0,0 +1,6 @@
+#%PAM-1.0
+auth            sufficient      pam_rootok.so
+auth            required        pam_unix.so
+account         required        pam_unix.so
+session         required        pam_unix.so
+password        required        pam_permit.so
diff --git a/etc/pam.d/cups b/etc/pam.d/cups
new file mode 100644
index 00000000..53724d1f
--- /dev/null
+++ b/etc/pam.d/cups
@@ -0,0 +1,3 @@
+auth		required	pam_unix.so
+account		required	pam_unix.so
+session		required	pam_unix.so
diff --git a/etc/pam.d/groupmems b/etc/pam.d/groupmems
new file mode 100644
index 00000000..8f49f5cc
--- /dev/null
+++ b/etc/pam.d/groupmems
@@ -0,0 +1,4 @@
+#%PAM-1.0
+auth		sufficient	pam_rootok.so
+account		required	pam_permit.so
+password	include		system-auth
diff --git a/etc/pam.d/hyprlock b/etc/pam.d/hyprlock
new file mode 100644
index 00000000..247d48da
--- /dev/null
+++ b/etc/pam.d/hyprlock
@@ -0,0 +1,5 @@
+# PAM configuration file for hyprlock
+# the 'login' configuration file (see /etc/pam.d/login)
+
+auth        include     login
+
diff --git a/etc/pam.d/login b/etc/pam.d/login
new file mode 100644
index 00000000..28f6fc5d
--- /dev/null
+++ b/etc/pam.d/login
@@ -0,0 +1,7 @@
+#%PAM-1.0
+
+auth       requisite    pam_nologin.so
+auth       include      system-local-login
+account    include      system-local-login
+session    include      system-local-login
+password   include      system-local-login
diff --git a/etc/pam.d/newusers b/etc/pam.d/newusers
new file mode 100644
index 00000000..8f49f5cc
--- /dev/null
+++ b/etc/pam.d/newusers
@@ -0,0 +1,4 @@
+#%PAM-1.0
+auth		sufficient	pam_rootok.so
+account		required	pam_permit.so
+password	include		system-auth
diff --git a/etc/pam.d/other b/etc/pam.d/other
new file mode 100644
index 00000000..3f50bd1c
--- /dev/null
+++ b/etc/pam.d/other
@@ -0,0 +1,9 @@
+#%PAM-1.0
+auth      required   pam_deny.so
+auth      required   pam_warn.so
+account   required   pam_deny.so
+account   required   pam_warn.so
+password  required   pam_deny.so
+password  required   pam_warn.so
+session   required   pam_deny.so
+session   required   pam_warn.so
diff --git a/etc/pam.d/passwd b/etc/pam.d/passwd
new file mode 100644
index 00000000..731c0d36
--- /dev/null
+++ b/etc/pam.d/passwd
@@ -0,0 +1,4 @@
+#%PAM-1.0
+auth		include		system-auth
+account		include		system-auth
+password	include		system-auth
diff --git a/etc/pam.d/remote b/etc/pam.d/remote
new file mode 100644
index 00000000..7fce079c
--- /dev/null
+++ b/etc/pam.d/remote
@@ -0,0 +1,8 @@
+#%PAM-1.0
+
+auth       required     pam_securetty.so
+auth       requisite    pam_nologin.so
+auth       include      system-remote-login
+account    include      system-remote-login
+session    include      system-remote-login
+password   include      system-remote-login
diff --git a/etc/pam.d/rlogin b/etc/pam.d/rlogin
new file mode 100644
index 00000000..d92a5da4
--- /dev/null
+++ b/etc/pam.d/rlogin
@@ -0,0 +1,13 @@
+#%PAM-1.0
+# For root login to succeed here with pam_securetty, "rlogin" must be
+# listed in /etc/securetty.
+auth       required     pam_nologin.so
+auth       required     pam_securetty.so
+auth       required     pam_env.so
+auth       sufficient   pam_rhosts.so
+auth       include      system-auth
+account    include      system-auth
+password   include      system-auth
+session	   optional     pam_keyinit.so    force revoke
+session    required     pam_loginuid.so
+session    include      system-auth
diff --git a/etc/pam.d/rsh b/etc/pam.d/rsh
new file mode 100644
index 00000000..3c04bc7d
--- /dev/null
+++ b/etc/pam.d/rsh
@@ -0,0 +1,11 @@
+#%PAM-1.0
+# For root login to succeed here with pam_securetty, "rsh" must be
+# listed in /etc/securetty.
+auth       required     pam_nologin.so
+auth       required     pam_securetty.so
+auth       required     pam_env.so
+auth       required     pam_rhosts.so
+account    include      system-auth
+session	   optional     pam_keyinit.so    force revoke
+session    required     pam_loginuid.so
+session    include      system-auth
diff --git a/etc/pam.d/runuser b/etc/pam.d/runuser
new file mode 100644
index 00000000..26b59d51
--- /dev/null
+++ b/etc/pam.d/runuser
@@ -0,0 +1,4 @@
+#%PAM-1.0
+
+auth    sufficient      pam_rootok.so
+session include         system-login
diff --git a/etc/pam.d/runuser-l b/etc/pam.d/runuser-l
new file mode 100644
index 00000000..26b59d51
--- /dev/null
+++ b/etc/pam.d/runuser-l
@@ -0,0 +1,4 @@
+#%PAM-1.0
+
+auth    sufficient      pam_rootok.so
+session include         system-login
diff --git a/etc/pam.d/samba b/etc/pam.d/samba
new file mode 100644
index 00000000..53724d1f
--- /dev/null
+++ b/etc/pam.d/samba
@@ -0,0 +1,3 @@
+auth		required	pam_unix.so
+account		required	pam_unix.so
+session		required	pam_unix.so
diff --git a/etc/pam.d/screen b/etc/pam.d/screen
new file mode 100644
index 00000000..07c42adb
--- /dev/null
+++ b/etc/pam.d/screen
@@ -0,0 +1 @@
+auth		required	pam_unix.so
diff --git a/etc/pam.d/sddm b/etc/pam.d/sddm
new file mode 100644
index 00000000..df11003e
--- /dev/null
+++ b/etc/pam.d/sddm
@@ -0,0 +1,15 @@
+#%PAM-1.0
+
+auth        include     system-login
+-auth       optional    pam_gnome_keyring.so
+-auth       optional    pam_kwallet5.so
+
+account     include     system-login
+
+password    include     system-login
+-password   optional    pam_gnome_keyring.so    use_authtok
+
+session     optional    pam_keyinit.so          force revoke
+session     include     system-login
+-session    optional    pam_gnome_keyring.so    auto_start
+-session    optional    pam_kwallet5.so         auto_start
diff --git a/etc/pam.d/sddm-autologin b/etc/pam.d/sddm-autologin
new file mode 100644
index 00000000..b42991e3
--- /dev/null
+++ b/etc/pam.d/sddm-autologin
@@ -0,0 +1,13 @@
+#%PAM-1.0
+auth        required    pam_env.so
+auth        required    pam_faillock.so preauth
+auth        required    pam_shells.so
+auth        required    pam_nologin.so
+auth        required    pam_permit.so
+-auth       optional    pam_gnome_keyring.so
+-auth       optional    pam_kwallet5.so
+account     include     system-local-login
+password    include     system-local-login
+session     include     system-local-login
+-session    optional    pam_gnome_keyring.so auto_start
+-session    optional    pam_kwallet5.so auto_start
diff --git a/etc/pam.d/sddm-greeter b/etc/pam.d/sddm-greeter
new file mode 100644
index 00000000..44e209e9
--- /dev/null
+++ b/etc/pam.d/sddm-greeter
@@ -0,0 +1,17 @@
+#%PAM-1.0
+
+# Load environment from /etc/environment and ~/.pam_environment
+auth		required pam_env.so
+
+# Always let the greeter start without authentication
+auth		required pam_permit.so
+
+# No action required for account management
+account		required pam_permit.so
+
+# Can't change password
+password	required pam_deny.so
+
+# Setup session
+session		required pam_unix.so
+session		optional pam_systemd.so
diff --git a/etc/pam.d/sshd b/etc/pam.d/sshd
new file mode 100644
index 00000000..4efc1ee6
--- /dev/null
+++ b/etc/pam.d/sshd
@@ -0,0 +1,6 @@
+#%PAM-1.0
+
+auth      include   system-remote-login
+account   include   system-remote-login
+password  include   system-remote-login
+session   include   system-remote-login
diff --git a/etc/pam.d/su b/etc/pam.d/su
new file mode 100644
index 00000000..cb5aa848
--- /dev/null
+++ b/etc/pam.d/su
@@ -0,0 +1,10 @@
+#%PAM-1.0
+auth            sufficient      pam_rootok.so
+# Uncomment the following line to implicitly trust users in the "wheel" group.
+#auth           sufficient      pam_wheel.so trust use_uid
+# Uncomment the following line to require a user to be in the "wheel" group.
+#auth           required        pam_wheel.so use_uid
+auth            required        pam_unix.so
+account         required        pam_unix.so
+session	        required        pam_unix.so
+password        include         system-auth
diff --git a/etc/pam.d/su-l b/etc/pam.d/su-l
new file mode 100644
index 00000000..cb5aa848
--- /dev/null
+++ b/etc/pam.d/su-l
@@ -0,0 +1,10 @@
+#%PAM-1.0
+auth            sufficient      pam_rootok.so
+# Uncomment the following line to implicitly trust users in the "wheel" group.
+#auth           sufficient      pam_wheel.so trust use_uid
+# Uncomment the following line to require a user to be in the "wheel" group.
+#auth           required        pam_wheel.so use_uid
+auth            required        pam_unix.so
+account         required        pam_unix.so
+session	        required        pam_unix.so
+password        include         system-auth
diff --git a/etc/pam.d/sudo b/etc/pam.d/sudo
new file mode 100644
index 00000000..ab053c54
--- /dev/null
+++ b/etc/pam.d/sudo
@@ -0,0 +1,4 @@
+#%PAM-1.0
+auth		include		system-auth
+account		include		system-auth
+session		include		system-auth
diff --git a/etc/pam.d/system-auth b/etc/pam.d/system-auth
new file mode 100644
index 00000000..5b254d3a
--- /dev/null
+++ b/etc/pam.d/system-auth
@@ -0,0 +1,29 @@
+#%PAM-1.0
+
+auth			sufficient 				/lib/security/pam_howdy.so
+auth            sufficient      		pam_u2f.so authfile=/etc/u2f_mappings cue origin=pam://arch appid=pam://arch
+auth       		required                pam_faillock.so      preauth
+# Optionally use requisite above if you do not want to prompt for the password
+# on locked accounts.
+-auth      [success=2 default=ignore]  pam_systemd_home.so
+auth       [success=1 default=bad]     pam_unix.so          try_first_pass nullok nodelay
+auth       [default=die]               pam_faillock.so      authfail
+auth       optional                    pam_permit.so
+auth       required                    pam_env.so
+auth       required                    pam_faillock.so      authsucc
+# If you drop the above call to pam_faillock.so the lock will be done also
+# on non-consecutive authentication failures.
+
+-account   [success=1 default=ignore]  pam_systemd_home.so
+account    required                    pam_unix.so
+account    optional                    pam_permit.so
+account    required                    pam_time.so
+
+-password  [success=1 default=ignore]  pam_systemd_home.so
+password   required                    pam_unix.so          try_first_pass nullok shadow
+password   optional                    pam_permit.so
+
+-session   optional                    pam_systemd_home.so
+session    required                    pam_limits.so
+session    required                    pam_unix.so
+session    optional                    pam_permit.so
diff --git a/etc/pam.d/system-local-login b/etc/pam.d/system-local-login
new file mode 100644
index 00000000..347b8155
--- /dev/null
+++ b/etc/pam.d/system-local-login
@@ -0,0 +1,6 @@
+#%PAM-1.0
+
+auth      include   system-login
+account   include   system-login
+password  include   system-login
+session   include   system-login
diff --git a/etc/pam.d/system-login b/etc/pam.d/system-login
new file mode 100644
index 00000000..3eeedda2
--- /dev/null
+++ b/etc/pam.d/system-login
@@ -0,0 +1,21 @@
+#%PAM-1.0
+
+auth       required   pam_shells.so
+auth       requisite  pam_nologin.so
+auth       include    system-auth
+
+account    required   pam_access.so
+account    required   pam_nologin.so
+account    include    system-auth
+
+password   include    system-auth
+
+session    optional   pam_loginuid.so
+session    optional   pam_keyinit.so       force revoke
+session    include    system-auth
+session    optional   pam_lastlog2.so      silent
+session    optional   pam_motd.so
+session    optional   pam_mail.so          dir=/var/spool/mail standard quiet
+session    optional   pam_umask.so
+-session   optional   pam_systemd.so
+session    required   pam_env.so
diff --git a/etc/pam.d/system-remote-login b/etc/pam.d/system-remote-login
new file mode 100644
index 00000000..347b8155
--- /dev/null
+++ b/etc/pam.d/system-remote-login
@@ -0,0 +1,6 @@
+#%PAM-1.0
+
+auth      include   system-login
+account   include   system-login
+password  include   system-login
+session   include   system-login
diff --git a/etc/pam.d/system-services b/etc/pam.d/system-services
new file mode 100644
index 00000000..6ed9bdc1
--- /dev/null
+++ b/etc/pam.d/system-services
@@ -0,0 +1,11 @@
+#%PAM-1.0
+
+auth      sufficient  pam_permit.so
+
+account   include     system-auth
+
+session   optional    pam_loginuid.so
+session   required    pam_limits.so
+session   required    pam_unix.so
+session   optional    pam_permit.so
+session   required    pam_env.so
diff --git a/etc/pam.d/vlock b/etc/pam.d/vlock
new file mode 100644
index 00000000..dbda8331
--- /dev/null
+++ b/etc/pam.d/vlock
@@ -0,0 +1,5 @@
+#%PAM-1.0
+auth required pam_unix.so
+account required pam_unix.so
+password required pam_unix.so
+session required pam_unix.so
diff --git a/etc/pam.d/weston-remote-access b/etc/pam.d/weston-remote-access
new file mode 100644
index 00000000..d3014dd8
--- /dev/null
+++ b/etc/pam.d/weston-remote-access
@@ -0,0 +1,3 @@
+#%PAM-1.0
+auth    include login
+account include login
diff --git a/etc/pam.d/xfce4-screensaver b/etc/pam.d/xfce4-screensaver
new file mode 100644
index 00000000..2c264c4d
--- /dev/null
+++ b/etc/pam.d/xfce4-screensaver
@@ -0,0 +1,2 @@
+auth include system-auth
+-auth optional pam_gnome_keyring.so
diff --git a/etc/u2f_mappings b/etc/u2f_mappings
new file mode 100644
index 00000000..8882dd35
--- /dev/null
+++ b/etc/u2f_mappings
@@ -0,0 +1 @@
+use pamu2fcfg to generate