first commit

debian-pkg/yourdev-session-pki_1.0_all/DEBIAN/postinst

@@ -0,0 +1,46 @@
+#!/bin/sh
+set -e
+
+case "$1" in
+  configure)
+    # Enable the pam-auth-update profile for smartcard+password
+    if command -v pam-auth-update >/dev/null 2>&1; then
+      pam-auth-update --package --enable yourdev-smartcard 2>/dev/null || true
+    fi
+
+    # Ensure SSSD CA bundle permissions
+    if [ -f /etc/sssd/pki/sssd_auth_ca_db.pem ]; then
+      chown root:sssd /etc/sssd/pki/sssd_auth_ca_db.pem 2>/dev/null || true
+    fi
+
+    # Ensure conf.d permissions (strict SSSD requirements)
+    for f in /etc/sssd/conf.d/*.conf; do
+      [ -f "$f" ] && chown root:sssd "$f" 2>/dev/null && chmod 0640 "$f" 2>/dev/null || true
+    done
+
+    if [ -f /etc/sssd/sssd.conf ]; then
+      chown root:sssd /etc/sssd/sssd.conf 2>/dev/null || true
+      chmod 0600 /etc/sssd/sssd.conf 2>/dev/null || true
+    fi
+
+    # Compile dconf database to apply GDM smartcard setting
+    if command -v dconf >/dev/null 2>&1; then
+      dconf update 2>/dev/null || true
+    fi
+
+    # Restart SSSD to pick up new config
+    if command -v systemctl >/dev/null 2>&1; then
+      systemctl restart sssd 2>/dev/null || true
+    fi
+    ;;
+
+  abort-upgrade|abort-remove|abort-deconfigure)
+    ;;
+
+  *)
+    echo "postinst called with unknown argument '$1'" >&2
+    exit 1
+    ;;
+esac
+
+exit 0