From 297ae75b3d7bf0f9142ef85b493505a22849508a Mon Sep 17 00:00:00 2001
From: EnumDev <enumdev@enumerated.dev>
Date: Mon, 1 Jun 2026 11:11:44 +0300
Subject: [PATCH] Update pam configuration

---
 pkg.info                           |  3 ++-
 source-files/lightdm-autologin.pam | 27 ++++++++++++---------------
 source-files/lightdm-greeter.pam   |  7 +++++++
 source-files/lightdm.pam           | 11 +++++++++++
 source.sh                          |  6 ++++--
 5 files changed, 36 insertions(+), 18 deletions(-)
 create mode 100644 source-files/lightdm-greeter.pam
 create mode 100644 source-files/lightdm.pam

diff --git a/pkg.info b/pkg.info
index 83b32a2..ae88865 100644
--- a/pkg.info
+++ b/pkg.info
@@ -1,7 +1,7 @@
 name: lightdm
 description: A lightweight display manager
 version: 1.32.0
-revision: 3
+revision: 4
 url: https://github.com/canonical/lightdm
 license: GPL-3.0-or-later AND (LGPL-2.0-only OR LGPL-3.0-only)
 maintainers:
@@ -25,6 +25,7 @@ optional_depends:
   - accountsservice:For enhanced user accounts handling
   - lightdm-gtk-greeter:For the GTK greeter
 make_depends:
+  - elogind
   - gobject-introspection
   - gtk-doc
   - intltool
diff --git a/source-files/lightdm-autologin.pam b/source-files/lightdm-autologin.pam
index 87e1e9d..89a7339 100644
--- a/source-files/lightdm-autologin.pam
+++ b/source-files/lightdm-autologin.pam
@@ -1,15 +1,12 @@
-#%PAM-1.0
-auth        required    pam_env.so
-auth        required    pam_faillock.so preauth
-auth        required    pam_shells.so
-auth        required    pam_nologin.so
-auth        [success=1 default=ignore]  pam_succeed_if.so user ingroup autologin
-auth        required    pam_unix.so
-auth        required    pam_permit.so
--auth       optional    pam_gnome_keyring.so
--auth       optional    pam_kwallet5.so
-account     include     system-local-login
-password    include     system-local-login
-session     include     system-local-login
--session    optional    pam_gnome_keyring.so auto_start
--session    optional    pam_kwallet5.so auto_start
+auth     requisite      pam_nologin.so
+auth     required       pam_env.so
+
+auth     required       pam_succeed_if.so uid >= 1000 quiet
+auth     required       pam_permit.so
+
+account  include        system-account
+
+password required       pam_deny.so
+
+session  required       pam_limits.so
+session  include        system-session
diff --git a/source-files/lightdm-greeter.pam b/source-files/lightdm-greeter.pam
new file mode 100644
index 0000000..6494ecd
--- /dev/null
+++ b/source-files/lightdm-greeter.pam
@@ -0,0 +1,7 @@
+auth     required       pam_env.so
+auth     required       pam_permit.so
+
+account  required       pam_permit.so
+password required       pam_deny.so
+session  required       pam_unix.so
+-session optional       pam_elogind.so
diff --git a/source-files/lightdm.pam b/source-files/lightdm.pam
new file mode 100644
index 0000000..cce49d1
--- /dev/null
+++ b/source-files/lightdm.pam
@@ -0,0 +1,11 @@
+auth     requisite      pam_nologin.so
+auth     required       pam_env.so
+
+auth     required       pam_succeed_if.so uid >= 1000 quiet
+auth     include        system-auth
+
+account  include        system-account
+password include        system-password
+
+session  required       pam_limits.so
+session  include        system-session
diff --git a/source.sh b/source.sh
index cafa58c..0af7ba8 100644
--- a/source.sh
+++ b/source.sh
@@ -31,8 +31,10 @@ package() {
   # Install sysusers file
   install -Dm644 "$BPM_WORKDIR"/sysusers "$BPM_OUTPUT"/usr/lib/sysusers.d/lightdm.conf
 
-  # Install autologin pam file
-  install -Dm644 "$BPM_WORKDIR"/lightdm-autologin.pam "$BPM_WORKDIR"/etc/pam.d/lightdm-autologin
+  # Install pam files
+  install -Dm644 "$BPM_WORKDIR"/lightdm.pam "$BPM_OUTPUT"/etc/pam.d/lightdm
+  install -Dm644 "$BPM_WORKDIR"/lightdm-autologin.pam "$BPM_OUTPUT"/etc/pam.d/lightdm-autologin
+  install -Dm644 "$BPM_WORKDIR"/lightdm-greeter.pam "$BPM_OUTPUT"/etc/pam.d/lightdm-greeter
 
   # Install polkit rules
   install -Dm644 "$BPM_WORKDIR"/polkit-rules "$BPM_OUTPUT"/usr/share/polkit-1/rules.d/lightdm.rules