feat: complete session preferences and PAM fixture gates

2026-09-26 02:44:29 +05:30
parent 83345a1842
commit ee6186ed0b
34 changed files with 801 additions and 327 deletions
--- a/scripts/test-pam-fixture.sh
+++ b/scripts/test-pam-fixture.sh
@@ -0,0 +1,93 @@
+#!/bin/sh
+set -eu
+
+if [ "$(id -u)" -ne 0 ]; then
+    echo "pam-fixture: SKIP (root is required to install a temporary PAM policy)"
+    exit 0
+fi
+
+service="latchd-fixture-$$"
+session_service="latchd-session-fixture-$$"
+policy="/etc/pam.d/$service"
+session_policy="/etc/pam.d/$session_service"
+checker="/tmp/latchd-pam-session-check-$$"
+module_source="/tmp/latchd-pam-session-env-$$.c"
+module="/tmp/latchd-pam-session-env-$$.so"
+cleanup() {
+    rm -f "$policy" "$session_policy" "$checker" "$module_source" "$module"
+}
+trap cleanup EXIT HUP INT TERM
+
+umask 077
+cat >"$policy" <<'PAM'
+auth      required pam_deny.so
+account   required pam_permit.so
+password  required pam_deny.so
+session   required pam_permit.so
+PAM
+
+cat >"$checker" <<'SH'
+#!/bin/sh
+set -eu
+
+[ "${PAM_TTY:-}" = "tty2" ]
+[ "${XDG_SESSION_CLASS:-}" = "user" ]
+[ "${XDG_SESSION_TYPE:-}" = "wayland" ]
+[ "${XDG_SESSION_DESKTOP:-}" = "niri" ]
+[ "${XDG_SEAT:-}" = "seat0" ]
+[ "${XDG_VTNR:-}" = "2" ]
+SH
+chmod 700 "$checker"
+
+cat >"$module_source" <<'C'
+#include <security/pam_appl.h>
+#include <security/pam_modules.h>
+
+PAM_EXTERN int pam_sm_open_session(
+    pam_handle_t *pamh,
+    int flags,
+    int argc,
+    const char **argv
+) {
+    int result;
+    (void)flags;
+    (void)argc;
+    (void)argv;
+
+    result = pam_putenv(pamh, "XDG_SESSION_ID=fixture-session");
+    if (result != PAM_SUCCESS) return result;
+    result = pam_putenv(pamh, "XDG_RUNTIME_DIR=/tmp/latchd-runtime-fixture");
+    if (result != PAM_SUCCESS) return result;
+    return pam_putenv(
+        pamh,
+        "DBUS_SESSION_BUS_ADDRESS=unix:path=/tmp/latchd-runtime-fixture/bus"
+    );
+}
+
+PAM_EXTERN int pam_sm_close_session(
+    pam_handle_t *pamh,
+    int flags,
+    int argc,
+    const char **argv
+) {
+    (void)pamh;
+    (void)flags;
+    (void)argc;
+    (void)argv;
+    return PAM_SUCCESS;
+}
+C
+${CC:-cc} -shared -fPIC "$module_source" -o "$module" -lpam
+chmod 700 "$module"
+
+cat >"$session_policy" <<PAM
+auth      required pam_permit.so
+account   required pam_permit.so
+password  required pam_deny.so
+session   required $module
+session   required pam_exec.so $checker
+PAM
+
+LATCHD_PAM_FIXTURE_SERVICE="$service" \
+LATCHD_PAM_SESSION_FIXTURE_SERVICE="$session_service" \
+    cargo test --locked -p latchd-auth --test pam_fixture -- --ignored