fedora-cosmic: add Kanidm Unix authentication

Install kanidm-unixd-clients/kanidm-clients, point /etc/kanidm/config at
auth.plabble.org, configure unixd (TPM-backed cache, pam_allowed_login_groups),
and set up PAM/nsswitch via an authselect custom profile (with a direct-file
fallback). Enable kanidm-unixd{,-tasks} and make unconfined_service_t
permissive until Kanidm ships an SELinux policy.

images/fedora-cosmic/custom.yaml

@@ -23,6 +23,10 @@ packages:
   - pam-u2f
   - token2-fido-bridge
 
+  # Kanidm Unix authentication (kanidm-unixd-clients pulls kanidm-clients).
+  - kanidm-unixd-clients
+  - kanidm-clients
+
 # Firefox is intentionally not part of the base system. It is preinstalled as a
 # per-user Flatpak on first login instead (see flatpaks.list).
 exclude-packages:
@@ -35,6 +39,13 @@ add-files:
   - ["flatpaks.list", "/usr/share/flatpak/flatpaks.list"]
   - ["50-token2-fido-bridge.preset", "/usr/lib/systemd/system-preset/50-token2-fido-bridge.preset"]
   - ["uhid.conf", "/usr/lib/modules-load.d/uhid.conf"]
+  # Kanidm client config and authselect profile sources.
+  - ["kanidm-config", "/etc/kanidm/config"]
+  - ["kanidm-unixd", "/etc/kanidm/unixd"]
+  - ["kanidm-system-auth", "/usr/share/fedora-cosmic/authselect/system-auth"]
+  - ["kanidm-password-auth", "/usr/share/fedora-cosmic/authselect/password-auth"]
+  - ["kanidm-nsswitch.conf", "/usr/share/fedora-cosmic/authselect/nsswitch.conf"]
+  - ["50-kanidm.preset", "/usr/lib/systemd/system-preset/50-kanidm.preset"]
 
 postprocess:
   # The upstream fedora.yaml removes the Google Chrome repo from the Fedora
@@ -52,3 +63,33 @@ postprocess:
     set -xeuo pipefail
     chmod 0755 /usr/libexec/flatpak-user-firstboot
     systemctl --user --global preset-all
+
+  # Kanidm PAM/nsswitch integration. Prefer an authselect profile; fall back to
+  # installing the files directly (and dropping the authselect symlinks) if
+  # authselect is unavailable in the compose environment.
+  - |
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+    if ! (
+      set -euo pipefail
+      authselect create-profile kanidm -b local
+      install -m 0644 /usr/share/fedora-cosmic/authselect/system-auth \
+        /etc/authselect/custom/kanidm/system-auth
+      install -m 0644 /usr/share/fedora-cosmic/authselect/password-auth \
+        /etc/authselect/custom/kanidm/password-auth
+      install -m 0644 /usr/share/fedora-cosmic/authselect/nsswitch.conf \
+        /etc/authselect/custom/kanidm/nsswitch.conf
+      authselect select custom/kanidm --force
+    ); then
+      echo "authselect setup failed, installing PAM/nsswitch directly" >&2
+      rm -f /etc/pam.d/system-auth /etc/pam.d/password-auth /etc/nsswitch.conf
+      install -m 0644 /usr/share/fedora-cosmic/authselect/system-auth /etc/pam.d/system-auth
+      install -m 0644 /usr/share/fedora-cosmic/authselect/password-auth /etc/pam.d/password-auth
+      install -m 0644 /usr/share/fedora-cosmic/authselect/nsswitch.conf /etc/nsswitch.conf
+    fi
+
+  # Kanidm does not ship an SELinux policy yet; let the unixd daemons run.
+  - |
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+    semanage permissive -a unconfined_service_t || true