Name:           pinpam
Version:        0.0.5
Release:        4%{?dist}
Summary:        TPM2 backed PAM module and utility for pin-based authentication

License:        GPL-3.0-or-later
URL:            https://github.com/RazeLighter777/pinpam
Source0:        %{url}/archive/v%{version}/%{name}-%{version}.tar.gz
Source1:        pinpam-policy.conf
Source2:        pinpam_gdm.te
Source3:        pinpam-configure-gdm

%global selinuxtype targeted
%global modulename pinpam_gdm

BuildRequires:  cargo
BuildRequires:  clang-devel
BuildRequires:  pkgconf-pkg-config
BuildRequires:  openssl-devel
BuildRequires:  tpm2-tss-devel
BuildRequires:  pam-devel
# For udev rules and tss group management
BuildRequires:  systemd-devel
BuildRequires:  selinux-policy-devel

# Ensure TPM2 TSS libraries are available at runtime
Requires:       tpm2-tss
# PAM is required
Requires:       pam
Requires:       (%{name}-selinux if selinux-policy-targeted)

%description
TPM2 backed PAM module and utility for pin-based authentication.
It uses TPM2 to store and verify PINs, providing a secure way
to authenticate users.

%package selinux
Summary:        SELinux policy for pinpam GDM authentication
BuildArch:      noarch
Requires:       %{name} = %{version}-%{release}
%{?selinux_requires}

%description selinux
SELinux policy allowing GDM's xdm_t domain to access TPM devices
required for PIN authentication with pinpam.

%prep
%autosetup -n %{name}-%{version}
mkdir -p SELinux
cp -p %{SOURCE2} SELinux/%{modulename}.te

%build
export CARGO_HOME=$(pwd)/.cargo
cargo build --release --locked

make -C SELinux -f /usr/share/selinux/devel/Makefile %{modulename}.pp

%install
# Install the utility
install -Dpm 0755 target/release/pinutil %{buildroot}%{_bindir}/pinutil

# Install the PAM module
install -Dpm 0755 target/release/libpinpam.so %{buildroot}%{_libdir}/security/libpinpam.so

# Install the optional master-key PAM module for keyring integration
install -Dpm 0755 target/release/libpinpam_master_key.so %{buildroot}%{_libdir}/security/libpinpam_master_key.so

# Install the policy configuration (NOTE: filename must be 'policy' not 'policy.conf')
install -Dpm 0644 %{SOURCE1} %{buildroot}%{_sysconfdir}/pinpam/policy

install -Dpm 0755 %{SOURCE3} %{buildroot}%{_sbindir}/pinpam-configure-gdm

install -Dpm 0644 SELinux/%{modulename}.pp \
    %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}/%{modulename}.pp

# Install udev rules for TPM access (Setgid method support)
mkdir -p %{buildroot}%{_udevrulesdir}
cat > %{buildroot}%{_udevrulesdir}/70-pinpam-tpm.rules <<EOF
# TPM device access for tss group (required for pinpam)
KERNEL=="tpm[0-9]*", TAG+="systemd", MODE="0660", GROUP="tss"
KERNEL=="tpmrm[0-9]*", TAG+="systemd", MODE="0660", GROUP="tss"
EOF

%check
export TSS2_LOG=all+NONE
export CARGO_HOME=$(pwd)/.cargo
cargo test --release --locked -- --test-threads=1

%post
# Reload udev rules and trigger for TPM devices specifically
udevadm control --reload-rules >/dev/null 2>&1 || :
udevadm trigger --subsystem-match=tpm >/dev/null 2>&1 || :

%postun
# Reload udev rules when the package is removed
udevadm control --reload-rules >/dev/null 2>&1 || :

%files
%license LICENSE.txt
%doc README.md
# Setgid tss allows regular users to interact with the TPM via pinutil
%attr(2755, root, tss) %{_bindir}/pinutil
%{_sbindir}/pinpam-configure-gdm
%{_libdir}/security/libpinpam.so
%{_libdir}/security/libpinpam_master_key.so
%dir %{_sysconfdir}/pinpam
%config(noreplace) %{_sysconfdir}/pinpam/policy
%{_udevrulesdir}/70-pinpam-tpm.rules

%pre selinux
%selinux_relabel_pre -s %{selinuxtype}

%post selinux
%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/%{modulename}.pp

%postun selinux
%selinux_modules_uninstall -s %{selinuxtype} %{modulename}

%posttrans selinux
%selinux_relabel_post -s %{selinuxtype}

%files selinux
%{_datadir}/selinux/packages/%{selinuxtype}/%{modulename}.pp
%ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{modulename}

%changelog
* Sat Aug 29 2026 Herwig Koeck <herwig.koeck@gmail.com> - 0.0.5-4
- Add optional GDM configuration helper
- Keep PAM configuration as an explicit administrator action

* Sat Aug 29 2026 Herwig Koeck <herwig.koeck@gmail.com> - 0.0.5-3
- Add SELinux policy subpackage for GDM TPM access
- Allow xdm_t to access TPM devices for PIN authentication
* Sat Aug 29 2026 Herwig Koeck <herwig.koeck@gmail.com> - 0.0.5-2
- Package the optional master-key PAM module
- Enable downstream integration with userspace keyrings

* Sat Aug 29 2026 Herwig Koeck <herwig.koeck@gmail.com> - 0.0.5-1
- Update to pinpam 0.0.5
- Add explicit clang and pkg-config build dependencies

* Sat Mar 28 2026 Bernhard Friedreich <friesoft@gmail.com> - 0.0.4-1
- Fix policy filename to match code expectations
- Add setuid bit to pinutil for TPM access