56ba4dd924
C-side: * New mode=recovery argv branch in pam_sm_authenticate. Reads the two-line /var/lib/authforge/recovery/<user> file, argon2_verify against PAM_AUTHTOK, on match unlinks the file (one-shot) and writes pending(re_enroll=true). Always returns PAM_IGNORE on failure paths so a missing/wrong code never blocks normal auth. * Makefile links -largon2 alongside -lpam. Daemon-side: * policy_apply::render_profile renders the recovery line first in the auth stack with [success=done default=ignore] — successful recovery short- circuits the rest, missing/wrong code falls through. * New policy_apply test asserts the recovery line precedes the default backstop. Doc: * pam/TESTING.md adds libargon2-dev to the build prereqs and a new Smoke test 4 walking through the manual recovery-code flow. C compile gate (make -C pam) requires libargon2-dev — flagged as a deferred verification step until a host with the dev package is available. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
14 lines
406 B
Makefile
14 lines
406 B
Makefile
CFLAGS ?= -Wall -Wextra -Werror -fPIC -O2
|
|
LIBDIR ?= /usr/lib/$(shell dpkg-architecture -qDEB_HOST_MULTIARCH)/security
|
|
|
|
pam_authforge_pending.so: pam_authforge_pending.c
|
|
$(CC) $(CFLAGS) -shared -o $@ $< -lpam -largon2
|
|
|
|
install: pam_authforge_pending.so
|
|
install -D -m 0644 pam_authforge_pending.so $(DESTDIR)$(LIBDIR)/pam_authforge_pending.so
|
|
|
|
clean:
|
|
rm -f pam_authforge_pending.so
|
|
|
|
.PHONY: install clean
|