From 470a1bd6b94a0ac08dbf426b4b5cff78c27a4c2f Mon Sep 17 00:00:00 2001 From: littleblack111 Date: Thu, 1 Jan 2026 17:35:21 +0800 Subject: bump: etc --- etc/crypttab | 6 ++++-- etc/pam.d/chfn | 6 ++++++ etc/pam.d/chpasswd | 4 ++++ etc/pam.d/chsh | 6 ++++++ etc/pam.d/cups | 3 +++ etc/pam.d/groupmems | 4 ++++ etc/pam.d/hyprlock | 5 +++++ etc/pam.d/login | 7 +++++++ etc/pam.d/newusers | 4 ++++ etc/pam.d/other | 9 +++++++++ etc/pam.d/passwd | 4 ++++ etc/pam.d/remote | 8 ++++++++ etc/pam.d/rlogin | 13 +++++++++++++ etc/pam.d/rsh | 11 +++++++++++ etc/pam.d/runuser | 4 ++++ etc/pam.d/runuser-l | 4 ++++ etc/pam.d/samba | 3 +++ etc/pam.d/screen | 1 + etc/pam.d/sddm | 15 +++++++++++++++ etc/pam.d/sddm-autologin | 13 +++++++++++++ etc/pam.d/sddm-greeter | 17 +++++++++++++++++ etc/pam.d/sshd | 6 ++++++ etc/pam.d/su | 10 ++++++++++ etc/pam.d/su-l | 10 ++++++++++ etc/pam.d/sudo | 4 ++++ etc/pam.d/system-auth | 29 +++++++++++++++++++++++++++++ etc/pam.d/system-local-login | 6 ++++++ etc/pam.d/system-login | 21 +++++++++++++++++++++ etc/pam.d/system-remote-login | 6 ++++++ etc/pam.d/system-services | 11 +++++++++++ etc/pam.d/vlock | 5 +++++ etc/pam.d/weston-remote-access | 3 +++ etc/pam.d/xfce4-screensaver | 2 ++ etc/u2f_mappings | 1 + 34 files changed, 259 insertions(+), 2 deletions(-) create mode 100644 etc/pam.d/chfn create mode 100644 etc/pam.d/chpasswd create mode 100644 etc/pam.d/chsh create mode 100644 etc/pam.d/cups create mode 100644 etc/pam.d/groupmems create mode 100644 etc/pam.d/hyprlock create mode 100644 etc/pam.d/login create mode 100644 etc/pam.d/newusers create mode 100644 etc/pam.d/other create mode 100644 etc/pam.d/passwd create mode 100644 etc/pam.d/remote create mode 100644 etc/pam.d/rlogin create mode 100644 etc/pam.d/rsh create mode 100644 etc/pam.d/runuser create mode 100644 etc/pam.d/runuser-l create mode 100644 etc/pam.d/samba create mode 100644 etc/pam.d/screen create mode 100644 etc/pam.d/sddm create mode 100644 etc/pam.d/sddm-autologin create mode 100644 etc/pam.d/sddm-greeter create mode 100644 etc/pam.d/sshd create mode 100644 etc/pam.d/su create mode 100644 etc/pam.d/su-l create mode 100644 etc/pam.d/sudo create mode 100644 etc/pam.d/system-auth create mode 100644 etc/pam.d/system-local-login create mode 100644 etc/pam.d/system-login create mode 100644 etc/pam.d/system-remote-login create mode 100644 etc/pam.d/system-services create mode 100644 etc/pam.d/vlock create mode 100644 etc/pam.d/weston-remote-access create mode 100644 etc/pam.d/xfce4-screensaver create mode 100644 etc/u2f_mappings diff --git a/etc/crypttab b/etc/crypttab index 5f1d2973..8bf3b2d2 100644 --- a/etc/crypttab +++ b/etc/crypttab @@ -10,5 +10,7 @@ # data2 /dev/sda5 /etc/cryptfs.key # swap /dev/sdx4 /dev/urandom swap,cipher=aes-cbc-essiv:sha256,size=256 # vol /dev/sdb7 none -arch-root UUID=bc526687-9deb-4078-abd1-55692022e073 - tpm2-device=auto -# cryptdata UUID=bc526687-9deb-4078-abd1-55692022e073 none luks,keyscript=decrypt_keyctl +# arch-root UUID=71ce78be-ecf4-4696-abd3-cdc17881e5c8 - tpm2-device=auto +arch-root UUID=71ce78be-ecf4-4696-abd3-cdc17881e5c8 - fido2-device=auto +# arch-swap UUID=5361445b-d32a-41ea-94fe-05aacfc7217a - tpm2-device=auto +# cryptdata UUID=8d8ffbd2-5876-481b-b7e7-8ce2fb5346eb none luks,keyscript=decrypt_keyctl diff --git a/etc/pam.d/chfn b/etc/pam.d/chfn new file mode 100644 index 00000000..066186e3 --- /dev/null +++ b/etc/pam.d/chfn @@ -0,0 +1,6 @@ +#%PAM-1.0 +auth sufficient pam_rootok.so +auth required pam_unix.so +account required pam_unix.so +session required pam_unix.so +password required pam_permit.so diff --git a/etc/pam.d/chpasswd b/etc/pam.d/chpasswd new file mode 100644 index 00000000..8f49f5cc --- /dev/null +++ b/etc/pam.d/chpasswd @@ -0,0 +1,4 @@ +#%PAM-1.0 +auth sufficient pam_rootok.so +account required pam_permit.so +password include system-auth diff --git a/etc/pam.d/chsh b/etc/pam.d/chsh new file mode 100644 index 00000000..066186e3 --- /dev/null +++ b/etc/pam.d/chsh @@ -0,0 +1,6 @@ +#%PAM-1.0 +auth sufficient pam_rootok.so +auth required pam_unix.so +account required pam_unix.so +session required pam_unix.so +password required pam_permit.so diff --git a/etc/pam.d/cups b/etc/pam.d/cups new file mode 100644 index 00000000..53724d1f --- /dev/null +++ b/etc/pam.d/cups @@ -0,0 +1,3 @@ +auth required pam_unix.so +account required pam_unix.so +session required pam_unix.so diff --git a/etc/pam.d/groupmems b/etc/pam.d/groupmems new file mode 100644 index 00000000..8f49f5cc --- /dev/null +++ b/etc/pam.d/groupmems @@ -0,0 +1,4 @@ +#%PAM-1.0 +auth sufficient pam_rootok.so +account required pam_permit.so +password include system-auth diff --git a/etc/pam.d/hyprlock b/etc/pam.d/hyprlock new file mode 100644 index 00000000..247d48da --- /dev/null +++ b/etc/pam.d/hyprlock @@ -0,0 +1,5 @@ +# PAM configuration file for hyprlock +# the 'login' configuration file (see /etc/pam.d/login) + +auth include login + diff --git a/etc/pam.d/login b/etc/pam.d/login new file mode 100644 index 00000000..28f6fc5d --- /dev/null +++ b/etc/pam.d/login @@ -0,0 +1,7 @@ +#%PAM-1.0 + +auth requisite pam_nologin.so +auth include system-local-login +account include system-local-login +session include system-local-login +password include system-local-login diff --git a/etc/pam.d/newusers b/etc/pam.d/newusers new file mode 100644 index 00000000..8f49f5cc --- /dev/null +++ b/etc/pam.d/newusers @@ -0,0 +1,4 @@ +#%PAM-1.0 +auth sufficient pam_rootok.so +account required pam_permit.so +password include system-auth diff --git a/etc/pam.d/other b/etc/pam.d/other new file mode 100644 index 00000000..3f50bd1c --- /dev/null +++ b/etc/pam.d/other @@ -0,0 +1,9 @@ +#%PAM-1.0 +auth required pam_deny.so +auth required pam_warn.so +account required pam_deny.so +account required pam_warn.so +password required pam_deny.so +password required pam_warn.so +session required pam_deny.so +session required pam_warn.so diff --git a/etc/pam.d/passwd b/etc/pam.d/passwd new file mode 100644 index 00000000..731c0d36 --- /dev/null +++ b/etc/pam.d/passwd @@ -0,0 +1,4 @@ +#%PAM-1.0 +auth include system-auth +account include system-auth +password include system-auth diff --git a/etc/pam.d/remote b/etc/pam.d/remote new file mode 100644 index 00000000..7fce079c --- /dev/null +++ b/etc/pam.d/remote @@ -0,0 +1,8 @@ +#%PAM-1.0 + +auth required pam_securetty.so +auth requisite pam_nologin.so +auth include system-remote-login +account include system-remote-login +session include system-remote-login +password include system-remote-login diff --git a/etc/pam.d/rlogin b/etc/pam.d/rlogin new file mode 100644 index 00000000..d92a5da4 --- /dev/null +++ b/etc/pam.d/rlogin @@ -0,0 +1,13 @@ +#%PAM-1.0 +# For root login to succeed here with pam_securetty, "rlogin" must be +# listed in /etc/securetty. +auth required pam_nologin.so +auth required pam_securetty.so +auth required pam_env.so +auth sufficient pam_rhosts.so +auth include system-auth +account include system-auth +password include system-auth +session optional pam_keyinit.so force revoke +session required pam_loginuid.so +session include system-auth diff --git a/etc/pam.d/rsh b/etc/pam.d/rsh new file mode 100644 index 00000000..3c04bc7d --- /dev/null +++ b/etc/pam.d/rsh @@ -0,0 +1,11 @@ +#%PAM-1.0 +# For root login to succeed here with pam_securetty, "rsh" must be +# listed in /etc/securetty. +auth required pam_nologin.so +auth required pam_securetty.so +auth required pam_env.so +auth required pam_rhosts.so +account include system-auth +session optional pam_keyinit.so force revoke +session required pam_loginuid.so +session include system-auth diff --git a/etc/pam.d/runuser b/etc/pam.d/runuser new file mode 100644 index 00000000..26b59d51 --- /dev/null +++ b/etc/pam.d/runuser @@ -0,0 +1,4 @@ +#%PAM-1.0 + +auth sufficient pam_rootok.so +session include system-login diff --git a/etc/pam.d/runuser-l b/etc/pam.d/runuser-l new file mode 100644 index 00000000..26b59d51 --- /dev/null +++ b/etc/pam.d/runuser-l @@ -0,0 +1,4 @@ +#%PAM-1.0 + +auth sufficient pam_rootok.so +session include system-login diff --git a/etc/pam.d/samba b/etc/pam.d/samba new file mode 100644 index 00000000..53724d1f --- /dev/null +++ b/etc/pam.d/samba @@ -0,0 +1,3 @@ +auth required pam_unix.so +account required pam_unix.so +session required pam_unix.so diff --git a/etc/pam.d/screen b/etc/pam.d/screen new file mode 100644 index 00000000..07c42adb --- /dev/null +++ b/etc/pam.d/screen @@ -0,0 +1 @@ +auth required pam_unix.so diff --git a/etc/pam.d/sddm b/etc/pam.d/sddm new file mode 100644 index 00000000..df11003e --- /dev/null +++ b/etc/pam.d/sddm @@ -0,0 +1,15 @@ +#%PAM-1.0 + +auth include system-login +-auth optional pam_gnome_keyring.so +-auth optional pam_kwallet5.so + +account include system-login + +password include system-login +-password optional pam_gnome_keyring.so use_authtok + +session optional pam_keyinit.so force revoke +session include system-login +-session optional pam_gnome_keyring.so auto_start +-session optional pam_kwallet5.so auto_start diff --git a/etc/pam.d/sddm-autologin b/etc/pam.d/sddm-autologin new file mode 100644 index 00000000..b42991e3 --- /dev/null +++ b/etc/pam.d/sddm-autologin @@ -0,0 +1,13 @@ +#%PAM-1.0 +auth required pam_env.so +auth required pam_faillock.so preauth +auth required pam_shells.so +auth required pam_nologin.so +auth required pam_permit.so +-auth optional pam_gnome_keyring.so +-auth optional pam_kwallet5.so +account include system-local-login +password include system-local-login +session include system-local-login +-session optional pam_gnome_keyring.so auto_start +-session optional pam_kwallet5.so auto_start diff --git a/etc/pam.d/sddm-greeter b/etc/pam.d/sddm-greeter new file mode 100644 index 00000000..44e209e9 --- /dev/null +++ b/etc/pam.d/sddm-greeter @@ -0,0 +1,17 @@ +#%PAM-1.0 + +# Load environment from /etc/environment and ~/.pam_environment +auth required pam_env.so + +# Always let the greeter start without authentication +auth required pam_permit.so + +# No action required for account management +account required pam_permit.so + +# Can't change password +password required pam_deny.so + +# Setup session +session required pam_unix.so +session optional pam_systemd.so diff --git a/etc/pam.d/sshd b/etc/pam.d/sshd new file mode 100644 index 00000000..4efc1ee6 --- /dev/null +++ b/etc/pam.d/sshd @@ -0,0 +1,6 @@ +#%PAM-1.0 + +auth include system-remote-login +account include system-remote-login +password include system-remote-login +session include system-remote-login diff --git a/etc/pam.d/su b/etc/pam.d/su new file mode 100644 index 00000000..cb5aa848 --- /dev/null +++ b/etc/pam.d/su @@ -0,0 +1,10 @@ +#%PAM-1.0 +auth sufficient pam_rootok.so +# Uncomment the following line to implicitly trust users in the "wheel" group. +#auth sufficient pam_wheel.so trust use_uid +# Uncomment the following line to require a user to be in the "wheel" group. +#auth required pam_wheel.so use_uid +auth required pam_unix.so +account required pam_unix.so +session required pam_unix.so +password include system-auth diff --git a/etc/pam.d/su-l b/etc/pam.d/su-l new file mode 100644 index 00000000..cb5aa848 --- /dev/null +++ b/etc/pam.d/su-l @@ -0,0 +1,10 @@ +#%PAM-1.0 +auth sufficient pam_rootok.so +# Uncomment the following line to implicitly trust users in the "wheel" group. +#auth sufficient pam_wheel.so trust use_uid +# Uncomment the following line to require a user to be in the "wheel" group. +#auth required pam_wheel.so use_uid +auth required pam_unix.so +account required pam_unix.so +session required pam_unix.so +password include system-auth diff --git a/etc/pam.d/sudo b/etc/pam.d/sudo new file mode 100644 index 00000000..ab053c54 --- /dev/null +++ b/etc/pam.d/sudo @@ -0,0 +1,4 @@ +#%PAM-1.0 +auth include system-auth +account include system-auth +session include system-auth diff --git a/etc/pam.d/system-auth b/etc/pam.d/system-auth new file mode 100644 index 00000000..5b254d3a --- /dev/null +++ b/etc/pam.d/system-auth @@ -0,0 +1,29 @@ +#%PAM-1.0 + +auth sufficient /lib/security/pam_howdy.so +auth sufficient pam_u2f.so authfile=/etc/u2f_mappings cue origin=pam://arch appid=pam://arch +auth required pam_faillock.so preauth +# Optionally use requisite above if you do not want to prompt for the password +# on locked accounts. +-auth [success=2 default=ignore] pam_systemd_home.so +auth [success=1 default=bad] pam_unix.so try_first_pass nullok nodelay +auth [default=die] pam_faillock.so authfail +auth optional pam_permit.so +auth required pam_env.so +auth required pam_faillock.so authsucc +# If you drop the above call to pam_faillock.so the lock will be done also +# on non-consecutive authentication failures. + +-account [success=1 default=ignore] pam_systemd_home.so +account required pam_unix.so +account optional pam_permit.so +account required pam_time.so + +-password [success=1 default=ignore] pam_systemd_home.so +password required pam_unix.so try_first_pass nullok shadow +password optional pam_permit.so + +-session optional pam_systemd_home.so +session required pam_limits.so +session required pam_unix.so +session optional pam_permit.so diff --git a/etc/pam.d/system-local-login b/etc/pam.d/system-local-login new file mode 100644 index 00000000..347b8155 --- /dev/null +++ b/etc/pam.d/system-local-login @@ -0,0 +1,6 @@ +#%PAM-1.0 + +auth include system-login +account include system-login +password include system-login +session include system-login diff --git a/etc/pam.d/system-login b/etc/pam.d/system-login new file mode 100644 index 00000000..3eeedda2 --- /dev/null +++ b/etc/pam.d/system-login @@ -0,0 +1,21 @@ +#%PAM-1.0 + +auth required pam_shells.so +auth requisite pam_nologin.so +auth include system-auth + +account required pam_access.so +account required pam_nologin.so +account include system-auth + +password include system-auth + +session optional pam_loginuid.so +session optional pam_keyinit.so force revoke +session include system-auth +session optional pam_lastlog2.so silent +session optional pam_motd.so +session optional pam_mail.so dir=/var/spool/mail standard quiet +session optional pam_umask.so +-session optional pam_systemd.so +session required pam_env.so diff --git a/etc/pam.d/system-remote-login b/etc/pam.d/system-remote-login new file mode 100644 index 00000000..347b8155 --- /dev/null +++ b/etc/pam.d/system-remote-login @@ -0,0 +1,6 @@ +#%PAM-1.0 + +auth include system-login +account include system-login +password include system-login +session include system-login diff --git a/etc/pam.d/system-services b/etc/pam.d/system-services new file mode 100644 index 00000000..6ed9bdc1 --- /dev/null +++ b/etc/pam.d/system-services @@ -0,0 +1,11 @@ +#%PAM-1.0 + +auth sufficient pam_permit.so + +account include system-auth + +session optional pam_loginuid.so +session required pam_limits.so +session required pam_unix.so +session optional pam_permit.so +session required pam_env.so diff --git a/etc/pam.d/vlock b/etc/pam.d/vlock new file mode 100644 index 00000000..dbda8331 --- /dev/null +++ b/etc/pam.d/vlock @@ -0,0 +1,5 @@ +#%PAM-1.0 +auth required pam_unix.so +account required pam_unix.so +password required pam_unix.so +session required pam_unix.so diff --git a/etc/pam.d/weston-remote-access b/etc/pam.d/weston-remote-access new file mode 100644 index 00000000..d3014dd8 --- /dev/null +++ b/etc/pam.d/weston-remote-access @@ -0,0 +1,3 @@ +#%PAM-1.0 +auth include login +account include login diff --git a/etc/pam.d/xfce4-screensaver b/etc/pam.d/xfce4-screensaver new file mode 100644 index 00000000..2c264c4d --- /dev/null +++ b/etc/pam.d/xfce4-screensaver @@ -0,0 +1,2 @@ +auth include system-auth +-auth optional pam_gnome_keyring.so diff --git a/etc/u2f_mappings b/etc/u2f_mappings new file mode 100644 index 00000000..8882dd35 --- /dev/null +++ b/etc/u2f_mappings @@ -0,0 +1 @@ +use pamu2fcfg to generate -- cgit v1.2.3