gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #324347 from jtojnar/gdm-fingerprint-fix

Browse Source 
nixos/gdm: Fix fingerprint auth rules
This commit is contained in:
Masum Reza
2024-07-04 10:54:46 +05:30
committed by GitHub
parent 2c59823e59 af0cdb44a0
commit 24ced04659
2 changed files with 9 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nixos/modules/services/desktops/gnome/gnome-keyring.nix
+1 -12
View File
@@ -35,18 +35,7 @@ in
xdg.portal.extraPortals = [ pkgs.gnome-keyring ];
security.pam.services = lib.mkMerge [
{
login.enableGnomeKeyring = true;
}
(lib.mkIf config.services.xserver.displayManager.gdm.enable {
gdm-password.enableGnomeKeyring = true;
gdm-autologin.enableGnomeKeyring = true;
})
(lib.mkIf (config.services.xserver.displayManager.gdm.enable && config.services.fprintd.enable) {
gdm-fingerprint.enableGnomeKeyring = true;
})
];
security.pam.services.login.enableGnomeKeyring = true;
security.wrappers.gnome-keyring-daemon = {
owner = "root";
nixos/modules/services/x11/display-managers/gdm.nix
+8 -2
View File
@@ -6,6 +6,7 @@ let
cfg = config.services.xserver.displayManager;
gdm = pkgs.gnome.gdm;
pamCfg = config.security.pam.services;
settingsFormat = pkgs.formats.ini { };
configFile = settingsFormat.generate "custom.conf" cfg.gdm.settings;
@@ -321,15 +322,20 @@ in
session include login
'';
# This would block password prompt when included by gdm-password.
# GDM will instead run gdm-fingerprint in parallel.
login.fprintAuth = mkIf config.services.fprintd.enable false;
gdm-fingerprint.text = mkIf config.services.fprintd.enable ''
auth required pam_shells.so
auth requisite pam_nologin.so
auth requisite pam_faillock.so preauth
auth required ${pkgs.fprintd}/lib/security/pam_fprintd.so
auth optional pam_permit.so
auth required pam_env.so
auth [success=ok default=1] ${pkgs.gnome.gdm}/lib/security/pam_gdm.so
${lib.optionalString pamCfg.login.enableGnomeKeyring ''
auth [success=ok default=1] ${pkgs.gnome.gdm}/lib/security/pam_gdm.so
auth optional ${pkgs.gnome-keyring}/lib/security/pam_gnome_keyring.so
''}
account include login