Handle sysmaint account password when autologin is disabled

[assisted-by-ai]

Summary

This PR adds logic to manage the sysmaint account password when autologin is disabled. When autologin is turned off, the display manager greeter requires manual authentication. If the sysmaint account has an empty password, PAM will reject login attempts on security-hardened systems. This change detects that condition and sets a temporary password to allow login.

Key Changes

• Password detection and temporary setup: Added ensure_sysmaint_has_password() function in sysmaint-boot that:

  • Checks if autologin is disabled
  • Detects if sysmaint account has no password (NP status)
  • Sets a temporary password 'changeme' if needed
  • Creates a flag file to track that a temporary password was set

• Password restoration on shutdown: Added restore_sysmaint_empty_password() function that:

  • Removes the temporary password on system shutdown
  • Restores the account to its original empty password state
  • Cleans up the flag file

• Cleanup script integration: Updated sysmaint-boot-cleanup to also restore the empty password state during shutdown, ensuring idempotent behavior

• Bug fix: Corrected X11_Xsession.d_15_sysmaint_no_desktop to use ${DESKTOP_SESSION:-} instead of hardcoded string literal, allowing proper desktop session detection

Implementation Details

• Uses passwd -S to detect empty password status (NP flag)
• Temporary password flag stored at /run/user-sysmaint-split/temp-password-set
• Warnings are logged to stderr to inform users about the temporary password and prompt them to change it
• The restoration logic is called both in the main boot script and the cleanup script for robustness

https://claude.ai/code/session_013aeZmbWvCMJxAPDcHYiBqS

[ArrayBolt3]

I don't think we should integrate this patch. Kicksecure intentionally allows users to log into passwordless accounts, the assumption about empty password rejection is mistaken.

(Even if we did want to integrate this, we would need to make some changes, because it currently unconditionally deletes the temporary password it set up upon shutdown, which would make it very difficult for the user to set a real password since any real password they set would get deleted on shutdown.)