fix(login): add custom PAM rules for desktop login

  - remove fprint auth from greetd as user home needs decryption
  - add custom rule to require users to be in group 'video', preventing
    admin login on GUI
  - remove older 'desktop' group in favor of 'video'
  - fix user creation script to disallow creating user duplicates
  - fix user creation script to allow '-' characters in name

Signed-off-by: Manuel Bluhm <[email protected]>

modules/common/users/admin.nix

@@ -93,10 +93,12 @@ in
           extraGroups =
             [
               "wheel"
-              "video"
             ]
             ++ cfg.extraGroups
-            ++ optionals cfg.createHome [ "desktop" ]
+            ++ optionals cfg.createHome [
+              "audio"
+              "video"
+            ]
             ++ optionals config.security.tpm2.enable [ "tss" ]
             ++ optionals config.ghaf.virtualization.docker.daemon.enable [ "docker" ];
         };

modules/common/users/desktop.nix

@@ -137,12 +137,6 @@ in
               members = [ cfg.appUser.name ];
             };
           })
-          {
-            "desktop" = {
-              name = "desktop";
-              members = [ ];
-            };
-          }
         ];
       };
     }
@@ -177,9 +171,9 @@ in
                 echo -n "Enter your user name: "
                 read -e -r USERNAME
                 USERNAME=''${USERNAME// /_}
-                USERNAME=''${USERNAME//[^a-zA-Z0-9_]/}
+                USERNAME=''${USERNAME//[^a-zA-Z0-9_-]/}
                 USERNAME=''$(echo -n "$USERNAME" | tr '[:upper:]' '[:lower:]')
-                if grep -q -w "$USERNAME:" /etc/passwd; then
+                if grep -q "$USERNAME:" /etc/passwd; then
                   echo "User $USERNAME already exists. Please choose another user name."
                 else
                   ACCEPTABLE_USER=true

modules/desktop/graphics/labwc.nix

@@ -166,8 +166,24 @@ in
       };
     };
 
-    # It will create a /etc/pam.d/ file for authentication
-    security.pam.services.gtklock = { };
+    # Create custom PAM rules
+    security.pam.services = {
+      gtklock = { };
+      greetd = {
+        fprintAuth = false; # User needs to enter password to decrypt home
+        rules.account.group = {
+          enable = true;
+          control = "required";
+          modulePath = "${pkgs.linux-pam}/lib/security/pam_succeed_if.so";
+          order = 10000;
+          args = [
+            "user"
+            "ingroup"
+            "video"
+          ];
+        };
+      };
+    };
 
     # Needed for power commands
     security.polkit.enable = true;
@@ -179,7 +195,6 @@ in
         BindsTo = [ "graphical-session.target" ];
         After = [ "graphical-session-pre.target" ];
         Wants = [ "graphical-session-pre.target" ];
-        ConditionGroup = "desktop";
       };
     };
 

modules/microvm/virtualization/microvm/audiovm.nix

@@ -44,7 +44,6 @@ let
               enable = true;
               extraGroups = [
                 "audio"
-                "video"
                 "pipewire"
               ];
             };

modules/microvm/virtualization/microvm/guivm.nix

@@ -78,7 +78,6 @@ let
                 extraGroups = [
                   "audio"
                   "video"
-                  "desktop"
                 ];
               };
             };

modules/microvm/virtualization/microvm/microvm-host.nix

@@ -141,8 +141,6 @@ in
           unitConfig.ConditionPathExists = "/storagevm/gui-vm/var/lib/nixos/user.lock";
           serviceConfig = {
             Type = "oneshot";
-            StandardOutput = "journal";
-            StandardError = "journal";
             ExecStart = "${userRemovalScript}/bin/remove-users";
           };
         };