feat: support automatic login for user sessions

services/CMakeLists.txt

@@ -9,6 +9,7 @@ endif()
 
 if(EXISTS "/etc/debian_version")
     install(FILES debian.ddm.pam DESTINATION ${CMAKE_INSTALL_FULL_SYSCONFDIR}/pam.d RENAME ddm)
+    install(FILES debian.ddm-autologin.pam DESTINATION ${CMAKE_INSTALL_FULL_SYSCONFDIR}/pam.d RENAME ddm-autologin)
 
     # In debian-based systems, seatd uses video group instead of seat
     # group, avoid creating seat group mistakenly by specifying
@@ -17,6 +18,7 @@ if(EXISTS "/etc/debian_version")
     install(FILES "${CMAKE_CURRENT_BINARY_DIR}/debian.ddm-sysuser.conf" DESTINATION "${SYSTEMD_SYSUSERS_DIR}" RENAME dde.conf)
 else()
     install(FILES ddm.pam DESTINATION ${CMAKE_INSTALL_FULL_SYSCONFDIR}/pam.d RENAME ddm)
+    install(FILES ddm-autologin.pam DESTINATION ${CMAKE_INSTALL_FULL_SYSCONFDIR}/pam.d RENAME ddm-autologin)
     configure_file(ddm-sysuser.conf.in ddm-sysuser.conf)
     install(FILES "${CMAKE_CURRENT_BINARY_DIR}/ddm-sysuser.conf" DESTINATION "${SYSTEMD_SYSUSERS_DIR}" RENAME dde.conf)
 endif()

services/ddm-autologin.pam

@@ -0,0 +1,34 @@
+#%PAM-1.0
+
+# Block login if shell is nologin or false
+auth    required        pam_succeed_if.so shell notin /sbin/nologin:/usr/sbin/nologin:/bin/false:/usr/bin/false
+
+# Block login if they are globally disabled
+auth    requisite       pam_nologin.so
+
+# Load environment from /etc/environment
+auth    required        pam_env.so
+
+# Allow access without authentication
+auth    required        pam_permit.so
+
+# Check account is active, change password if required
+@include common-account
+
+# Can't change password
+password required      pam_deny.so
+
+# Setup session
+session optional       pam_keyinit.so force revoke
+session required       pam_limits.so
+session required       pam_loginuid.so
+session required       pam_systemd.so
+@include common-session
+-session optional      pam_gnome_keyring.so auto_start
+-session optional      pam_kwallet5.so auto_start
+
+# Load environment from /etc/environment
+session required       pam_env.so
+
+# Load environment from /etc/default/locale and ~/.pam_environment
+session required       pam_env.so envfile=/etc/default/locale user_readenv=1

services/ddm-sysuser.conf.in

@@ -1,6 +1,7 @@
 #Type Name ID GECOS                  Home directory Shell
 u     dde -  "DDM Greeter Account" ${STATE_DIR}   -
 g     dde -
+g     nopasswdlogin -
 m     dde dde
 m     dde seat
 m     dde video

services/ddm.pam

@@ -1,5 +1,8 @@
 #%PAM-1.0
 
+# Allow members of the nopasswdlogin group to log in without a password
+auth        sufficient  pam_succeed_if.so user ingroup nopasswdlogin
+
 auth        include     system-login
 -auth       optional    pam_gnome_keyring.so
 -auth       optional    pam_kwallet5.so

services/debian.ddm-autologin.pam

@@ -0,0 +1,49 @@
+#%PAM-1.0
+auth      requisite pam_inhibit_autologin.so
+# Block login if shell in nologin or false
+auth      required pam_succeed_if.so shell notin /sbin/nologin:/usr/sbin/nologin:/bin/false:/usr/bin/false
+
+# Block login if they are globally disabled
+auth      requisite pam_nologin.so
+
+# Load environment from /etc/environment and ~/.pam_environment
+session      required pam_env.so readenv=1
+session      required pam_env.so readenv=1 envfile=/etc/default/locale
+
+# Unlock keyring when user auto login
+-auth        optional   pam_deepin_keyring.so
+-auth        optional   pam_gnome_keyring.so
+-auth        optional   pam_kwallet5.so
+
+# Allow access without authentication
+auth      required pam_succeed_if.so user != root quiet_success
+auth      required pam_permit.so
+
+@include common-account
+
+# SELinux needs to be the first session rule. This ensures that any
+# lingering context has been cleared. Without out this it is possible
+# that a module could execute code in the wrong domain.
+# When the module is present, "required" would be sufficient (When SELinux
+# is disabled, this returns success.)
+session  [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close
+
+session  required        pam_limits.so
+session  required        pam_loginuid.so
+@include common-session
+
+# SELinux needs to intervene at login time to ensure that the process
+# starts in the proper default security context. Only sessions which are
+# intended to run in the user's context should be run after this.
+session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open
+# When the module is present, "required" would be sufficient (When SELinux
+# is disabled, this returns success.)
+
+# Can't change password
+# Unlock keyring when user no passwd login
+-session  optional  pam_gnome_keyring.so auto_start
+-session  optional  pam_deepin_keyring.so
+-session  optional  pam_kwallet5.so auto_start
+password  required pam_deny.so
+
+@include common-password

services/debian.ddm-sysuser.conf.in

@@ -1,6 +1,7 @@
 #Type Name ID GECOS                  Home directory Shell
 u     dde -  "DDM Greeter Account" ${STATE_DIR}   -
 g     dde -
+g     nopasswdlogin -
 m     dde dde
 m     dde video
 m     dde render

services/debian.ddm.pam

@@ -4,7 +4,9 @@
 auth    requisite       pam_nologin.so
 auth    required        pam_succeed_if.so user != root quiet_success
 
-# auth    sufficient      pam_succeed_if.so user ingroup nopasswdlogin
+# Allow members of the nopasswdlogin group to log in without a password
+auth    sufficient      pam_succeed_if.so user ingroup nopasswdlogin
+
 @include common-auth
 # gnome_keyring breaks QProcess
 -auth   optional        pam_gnome_keyring.so

src/common/Configuration.h

@@ -73,6 +73,13 @@ namespace DDM {
             Entry(RememberLastUser,    bool,        true,                                       _S("Remember the last successfully logged in user"));
             Entry(RememberLastSession, bool,        true,                                       _S("Remember the session of the last successfully logged in user"));
         );
+
+        Section(Autologin,
+            Entry(User,                QString,     QString(),                                  _S("User to log in automatically (empty disables autologin)"));
+            Entry(Session,             QString,     QString(),                                  _S("Session to load for automatic login (overrides the last used session)"));
+            // TODO: InBackground is not implemented yet.
+            // Entry(InBackground,     bool,        false,                                       _S("Load the automatic login session in the background without activating it"));
+        );
     );
 
     Config(StateConfig, []()->QString{auto tmp = getpwnam("ddm"); return tmp ? QString::fromLocal8Bit(tmp->pw_dir) : QStringLiteral(STATE_DIR);}().append(QStringLiteral("/state.conf")), QString(), QString(),

src/common/Messages.h

@@ -51,6 +51,7 @@ namespace DDM {
         UserActivateMessage,
         SwitchToGreeter,
         UserLoggedIn,
+        ShowGreeter,
     };
 
     enum Capability {

src/daemon/Auth.cpp

@@ -241,7 +241,7 @@ namespace DDM {
         Q_ASSERT(!user.isEmpty());
 
         qInfo() << "[Auth] Starting...";
-        d->ret = pam_start("ddm", user.toLocal8Bit().constData(), &d->conv, &d->handle);
+        d->ret = pam_start(pamService.toLocal8Bit().constData(), user.toLocal8Bit().constData(), &d->conv, &d->handle);
         CHECK_RET_AUTH
 
         qInfo() << "[Auth] Authenticating user" << user;

src/daemon/Auth.h

@@ -30,6 +30,10 @@ namespace DDM {
         /** Username. Must be set before authenticate() */
         QString user{};
 
+        /** PAM service to use for authentication (defaults to "ddm"). Use
+         *  "ddm-autologin" to authenticate without a password. */
+        QString pamService{ QStringLiteral("ddm") };
+
         /** Display sever type of the session. Must be set before startUserProcess() */
         Display::DisplayServerType type{};