session locker (ext-session-lock + PAM)
git clone https://git.lucas.co/cce-lock.git
pam/cce-lock (724B)
1 #%PAM-1.0
2 #
3 # Screen locker: a CREDENTIAL CHECK and nothing else.
4 #
5 # No `session` stack on purpose. cce-lock never calls pam_open_session — the
6 # user's session already exists; the locker only re-verifies the person in
7 # front of it. The greeter learned this the hard way: opening a session there
8 # ran pam_gnome_keyring's auto_start, a fork() out of a multi-threaded Vulkan
9 # process, which could wedge before exec and freeze login on
10 # "Authenticating..." (2026-09-18). A locker that did the same would freeze
11 # with the session still locked.
12 #
13 # No `password` stack either: a locker must never be a route to changing a
14 # password.
15
16 auth include system-local-login
17 account include system-local-login