From bd685faa1a3d08598322dc6e256ac585cffcdbac Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Wed, 6 May 2020 22:25:34 +0200
Subject: [PATCH 1/3] login: include pam_systemd_home.so in the default PAM
 snippet we ship for user@.service

Let's make sure systemd-homed works out-of-the box as well as possible.
---
 src/login/systemd-user.m4 | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/src/login/systemd-user.m4 b/src/login/systemd-user.m4
index 4f85b4b7fe..f6313f79fe 100644
--- a/src/login/systemd-user.m4
+++ b/src/login/systemd-user.m4
@@ -2,11 +2,19 @@
 #
 # Used by systemd --user instances.
 
-account required pam_unix.so
+m4_ifdef(`ENABLE_HOMED',
+-account sufficient pam_systemd_home.so
+)m4_dnl
+account sufficient pam_unix.so
+account required pam_permit.so
+
 m4_ifdef(`HAVE_SELINUX',
 session required pam_selinux.so close
 session required pam_selinux.so nottys open
 )m4_dnl
 session required pam_loginuid.so
 session optional pam_keyinit.so force revoke
+m4_ifdef(`ENABLE_HOMED',
+-session optional pam_systemd_home.so
+)m4_dnl
 session optional pam_systemd.so

From c6472bb019d57af5b9c4a95456885f097d7e87a5 Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Wed, 6 May 2020 22:26:54 +0200
Subject: [PATCH 2/3] man: highlight relevant lines in pam_systemd_home.so
 example PAM snippet

let's do this like we do in the NSS module man pages.
---
 man/pam_systemd_home.xml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/man/pam_systemd_home.xml b/man/pam_systemd_home.xml
index d952c98dc1..e0e24e5888 100644
--- a/man/pam_systemd_home.xml
+++ b/man/pam_systemd_home.xml
@@ -116,21 +116,21 @@
 
     <programlisting>#%PAM-1.0
 auth      sufficient pam_unix.so
--auth     sufficient pam_systemd_home.so
+<command>-auth     sufficient pam_systemd_home.so</command>
 auth      required   pam_deny.so
 
 account   required   pam_nologin.so
--account  sufficient pam_systemd_home.so
+<command>-account  sufficient pam_systemd_home.so</command>
 account   sufficient pam_unix.so
 account   required   pam_permit.so
 
--password sufficient pam_systemd_home.so
+<command>-password sufficient pam_systemd_home.so</command>
 password  sufficient pam_unix.so sha512 shadow try_first_pass try_authtok
 password  required   pam_deny.so
 
 -session  optional   pam_keyinit.so revoke
 -session  optional   pam_loginuid.so
--session  optional   pam_systemd_home.so
+<command>-session  optional   pam_systemd_home.so</command>
 -session  optional   pam_systemd.so
 session   required   pam_unix.so</programlisting>
   </refsect1>

From 4ad5bf78655415b17550050bb7011420da7ff95b Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Wed, 6 May 2020 22:28:37 +0200
Subject: [PATCH 3/3] man: bring example PAM snippet of pam_systemd and
 pam_systemd_home back in sync

Let's make it the same snippet, just highlight different lines.
---
 man/pam_systemd.xml | 25 +++++++++++++++----------
 1 file changed, 15 insertions(+), 10 deletions(-)

diff --git a/man/pam_systemd.xml b/man/pam_systemd.xml
index 694371c2c4..c823faaaed 100644
--- a/man/pam_systemd.xml
+++ b/man/pam_systemd.xml
@@ -308,19 +308,24 @@ pam_set_data(handle, "systemd.runtime_max_sec", (void *)"3600", cleanup);
     <filename>systemd-logind.service</filename>:</para>
 
     <programlisting>#%PAM-1.0
-auth     sufficient pam_unix.so
-auth     required   pam_deny.so
+auth      sufficient pam_unix.so
+-auth     sufficient pam_systemd_home.so
+auth      required   pam_deny.so
 
-account  required   pam_nologin.so
-account  sufficient pam_unix.so
-account  required   pam_permit.so
+account   required   pam_nologin.so
+-account  sufficient pam_systemd_home.so
+account   sufficient pam_unix.so
+account   required   pam_permit.so
 
-password sufficient pam_unix.so sha512 shadow try_first_pass try_authtok
-password required   pam_deny.so
+-password sufficient pam_systemd_home.so
+password  sufficient pam_unix.so sha512 shadow try_first_pass try_authtok
+password  required   pam_deny.so
 
--session optional   pam_loginuid.so
--session optional   pam_systemd.so
-session  required   pam_unix.so</programlisting>
+-session  optional   pam_keyinit.so revoke
+-session  optional   pam_loginuid.so
+-session  optional   pam_systemd_home.so
+<command>-session  optional   pam_systemd.so</command>
+session   required   pam_unix.so</programlisting>
   </refsect1>
 
   <refsect1>