5cc7a90f44
blueline-fingerprintd installs /usr/lib/security/pam_souveraine_fpc.so
(PKGBUILD:48). cc541d1 named pam_fpc_polkit.so, which exists nowhere.
The leading '-' means a missing module is skipped without complaint, so
a wrong name here fails silently and permanently: the finger does
nothing and no log says why.
The module returns PAM_IGNORE outside PAM_SERVICE=polkit-1
(fpc-polkit-pam.c:86), so step-up falls through to the password stack
until that allowlist widens.
14 lines
706 B
Text
14 lines
706 B
Text
# Step-up authentication for SouveraineOS (SESSION-AUTHORITY-DOCTRINE §3).
|
|
# Never unlocks the session; a success mints a short-lived in-memory grant.
|
|
#
|
|
# Same stack as the lock surface, for the same reason souveraine-sessiond gives:
|
|
# step-up must accept exactly the credentials the lockscreen accepts, no more.
|
|
#
|
|
# The leading '-' loads the FPC factor only where it is installed, so one file
|
|
# serves the phone and the laptop. blueline-fingerprintd ships the module; it
|
|
# accepts only PAM_SERVICE=polkit-1 today and returns PAM_IGNORE here, falling
|
|
# through to the password stack until its service check is widened.
|
|
-auth sufficient pam_souveraine_fpc.so
|
|
auth include login
|
|
|
|
account include login
|