feat: support automatic login for user sessions

[glyvut]

Add autologin support with dedicated ddm-autologin PAM service and nopasswdlogin group for passwordless login.

新增自动登录功能：提供独立的ddm-autologin PAM服务，并通过
nopasswdlogin用户组支持免密登录。重构Display登录流程，提取
startUserSession()复用会话启动逻辑，登录时根据配置决定直接
自动登录或显示登录界面。

Log: 支持用户自动登录
Influence: 配置Autologin后可跳过登录界面直接进入桌面；nopasswdlogin组成员可免密登录。

Summary by Sourcery

Enable configurable automatic and passwordless user login while sharing the existing session startup flow.

New Features:

• Add configurable automatic login for a selected user and session, falling back to the last used session when no session is specified.
• Support passwordless authentication through a dedicated ddm-autologin PAM service.
• Allow members of the nopasswdlogin group to authenticate without entering a password.

Enhancements:

• Refactor user-session startup into shared logic for regular and automatic login flows.
• Show the greeter only when automatic login is disabled or cannot be started, and limit automatic login attempts to the initial connection after boot.

Build:

• Install the dedicated ddm-autologin PAM configuration on supported distributions.

[deepin-ci-robot]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[sourcery-ai]

Reviewer's Guide

Adds an automatic user login feature by introducing a dedicated ddm‑autologin PAM service, new autologin configuration options, and refactoring the display login flow to reuse a shared session-start routine that supports both normal and passwordless login paths.

Sequence diagram for automatic login vs showing greeter

sequenceDiagram
    actor Greeter
    participant Display
    participant Auth
    participant Pam_ddm_autologin

    Greeter->>Display: connected(socket)
    Display->>Display: check auths for active sessions
    alt [no active user] and [Autologin.User set] and [Autologin.Timeout == 0]
        Display->>Display: startAutologin()
        Display->>Auth: new Auth(this, user)
        Display->>Auth: set pamService = ddm-autologin
        Auth->>Pam_ddm_autologin: authenticate(QByteArray())
        Pam_ddm_autologin-->>Auth: success/failure
        alt [authentication success]
            Display->>Display: startUserSession(auth, session)
            Display-->>Greeter: (no message, greeter stays hidden)
        else [authentication failed or session start failed]
            Display-->>Greeter: ShowGreeter
        end
    else other cases
        Display-->>Greeter: ShowGreeter
    end

Loading

File-Level Changes

Change	Details	Files
Introduce dedicated PAM service and system user configuration for passwordless autologin.	Install ddm-autologin PAM file alongside existing ddm PAM service for both Debian and non-Debian systems Add new ddm-autologin PAM configuration file defining passwordless authentication behavior Extend sysuser config templates to support nopasswdlogin group or related system user setup Adjust existing ddm PAM configs to integrate with autologin and nopasswdlogin behavior	services/CMakeLists.txt services/ddm-autologin.pam services/ddm-sysuser.conf.in services/debian.ddm-sysuser.conf.in services/ddm.pam services/debian.ddm.pam
Add configurable autologin options to the main configuration schema.	Introduce Autologin section with User, Session, Timeout, and InBackground entries Provide defaults and descriptions for new autologin-related config keys	src/common/Configuration.h
Extend daemon messaging to let the greeter know when to show the login screen versus autologin.	Add ShowGreeter message type to daemon messages enum Use ShowGreeter in display connection logic to instruct the greeter to present the login UI when autologin is not used or fails	src/common/Messages.h src/daemon/Display.cpp
Allow Auth to select PAM service dynamically and support autologin service.	Add pamService member to Auth with default "ddm" Change authentication startup to call pam_start with configurable pamService instead of hard-coded service name	src/daemon/Auth.h src/daemon/Auth.cpp
Refactor session startup logic and implement autologin flow in Display.	Extract session validation, VT allocation, display server startup, and logind registration into new startUserSession(Auth*, const Session&) helper returning success/failure Update existing login path to call startUserSession and emit loginFailed on failure Introduce startAutologin() which reads Autologin config, resolves the session, creates an Auth using ddm-autologin PAM service, runs passwordless authentication, saves last user/session, and starts the session via startUserSession Update Display::connected to check for active users and, when none, attempt immediate autologin according to Autologin.Timeout and User; on failure, send ShowGreeter to the greeter Fix logging and VT allocation calls to consistently use auth->user instead of a separate user variable	src/daemon/Display.cpp src/daemon/Display.h

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Sorry @glyvut, you have reached your weekly rate limit of 500000 diff characters.

Please try again later or upgrade to continue using Sourcery

[deepin-wm]

PR 审查结果

对 treeland #1305 + ddm #106 的联合审查中，ddm 部分的审查结论如下。整体方案连贯，无阻断性问题。

交互流程验证

三条路径均自洽：

• 自动登录成功：ddm connected() → startAutologin() → startUserSession() → activateSession() → TreelandDisplayServer::activateUser() 发送 UserActivateMessage → treeland 隐藏 greeter。✓
• 自动登录未启用/失败：ddm connected() 发送 ShowGreeter → treeland showLockScreen(false) 显示登录界面。✓
• DDM 超时/崩溃：treeland 5s 兜底定时器 → lock() → setLock(true) 显示登录界面。✓

设计合理的部分

• startUserSession() / startAutologin() 提取重构清晰，登录与自动登录复用会话启动逻辑。
• ddm-autologin PAM 使用 pam_permit.so + pam_succeed_if.so shell notin /sbin/nologin + pam_nologin.so，适合管理员配置的自动登录场景。
• nopasswdlogin 组加入 sysuser 配置；常规 ddm/debian.ddm PAM 新增 pam_succeed_if.so user ingroup nopasswdlogin sufficient 用于交互式免密登录。两条路径分离清晰。
• m_connectedOnce 标志避免 greeter 重启后重复尝试自动登录。
• 拒绝 dde 作为自动登录用户、要求有效 session 等守卫到位。

需要处理的问题

1. Autologin.InBackground 声明但从未使用；Autologin.Timeout 仅判断 == 0。 connected() 中 mainConfig.Autologin.Timeout.get() == 0 只支持立即自动登录，非零超时（延迟自动登录）和后台登录均未实现。建议要么实现这些功能，要么移除无用配置项，避免误导管理员。

2. startAutologin() 失败不发送 loginFailed —— 直接返回 false，connected() 回退到 ShowGreeter。静默回退到 greeter 是合理的，仅提示缺少用户反馈（除 qWarning 外）。

安全设计说明（澄清）

ddm-autologin PAM 不检查 nopasswdlogin 组成员，依赖 pam_permit.so。这是设计意图：自动登录是管理员配置功能（Autologin.User），不是用户/组属性；nopasswdlogin 组是交互式免密登录的独立机制，经常规 ddm PAM 实现。两者分离正确。ddm-autologin 中的 pam_succeed_if.so shell notin nologin 和 pam_nologin.so 提供了合理的安全护栏。

总结

无阻断性问题，建议合入前处理以下可操作项：

• 移除或实现 Autologin.InBackground 及非零 Timeout。

更新：撤回原第 2 条「startUserSession() 无条件删除 auth，建议将 session 有效性检查移到认证前」。经复核，该行为变更实际是改善——重构后所有失败路径（无效 session、VT 分配失败等）统一 emit loginFailed，而旧代码这些路径直接 return 不发送反馈；预存 auth 被删除亦无害。无需调整。

[deepin-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: glyvut, waterlovemelon

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• debian/deepin/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment