cc541d1eaa
SESSION-AUTHORITY-DOCTRINE §3 names /etc/pam.d/souveraine-stepup by path. Root-owned config can only arrive by package: rootfs-overlay/ reaches a device on flash and the phone does not flash. auth_self, never auth_admin — step-up re-proves the user to themselves, it does not escalate. The leading '-' on pam_fpc_polkit.so loads the fingerprint factor only where it is installed, so one file serves phone and laptop. Inert until a consumer calls it; no src/ path does yet.
13 lines
616 B
Text
13 lines
616 B
Text
# Step-up authentication for SouveraineOS (SESSION-AUTHORITY-DOCTRINE §3).
|
|
# Never unlocks the session; a success mints a short-lived in-memory grant.
|
|
#
|
|
# Same stack as the lock surface, for the same reason souveraine-sessiond gives:
|
|
# step-up must accept exactly the credentials the lockscreen accepts, no more.
|
|
#
|
|
# The leading '-' loads the FPC factor only where it is installed, so one file
|
|
# serves the phone and the laptop. The module is polkit-1-only today and
|
|
# returns PAM_IGNORE here until its service allowlist is widened.
|
|
-auth sufficient pam_fpc_polkit.so
|
|
auth include login
|
|
|
|
account include login
|