From 0bf317b62035156ada7fbcd228a51c93d86dd295 Mon Sep 17 00:00:00 2001
From: Jonathan Conder <jono.conder@gmail.com>
Date: Thu, 18 Apr 2024 07:56:52 +1200
Subject: [PATCH 1/2] man: add pam_gnome_keyring to auth section after
 pam_systemd_loadkey

This is required because pam_sm_open_session [1] only looks at
gkr_system_authtok, which is copied from the kernel keyring in
pam_sm_authenticate.

[1] https://gitlab.gnome.org/GNOME/gnome-keyring/-/blob/46.1/pam/gkr-pam-module.c?ref_type=tags
---
 man/pam_systemd_loadkey.xml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/man/pam_systemd_loadkey.xml b/man/pam_systemd_loadkey.xml
index becb32adcd0..ab99b1e7523 100644
--- a/man/pam_systemd_loadkey.xml
+++ b/man/pam_systemd_loadkey.xml
@@ -78,6 +78,7 @@
 
     <programlisting>
 -auth       optional    pam_systemd_loadkey.so
+-auth       optional    pam_gnome_keyring.so
 -session    optional    pam_gnome_keyring.so auto_start
 -session    optional    pam_kwallet5.so auto_start
     </programlisting>

From 08ef6998e3381b7b9d093f12c3928b2d3d95eca8 Mon Sep 17 00:00:00 2001
From: Jonathan Conder <jono.conder@gmail.com>
Date: Thu, 18 Apr 2024 08:01:27 +1200
Subject: [PATCH 2/2] man: document other keyname options for
 pam_systemd_loadkey

---
 man/pam_systemd_loadkey.xml | 42 +++++++++++++++++++++++++++++++++++--
 1 file changed, 40 insertions(+), 2 deletions(-)

diff --git a/man/pam_systemd_loadkey.xml b/man/pam_systemd_loadkey.xml
index ab99b1e7523..13d1686bd1e 100644
--- a/man/pam_systemd_loadkey.xml
+++ b/man/pam_systemd_loadkey.xml
@@ -49,9 +49,47 @@
         <term><varname>keyname=</varname></term>
 
         <listitem><para>Takes a string argument which sets the keyname to read.
-        The default is <literal>cryptsetup</literal>, which is used by
+        The default is <literal>cryptsetup</literal>.
+        During boot,
         <citerefentry><refentrytitle>systemd-cryptsetup@.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
-        to store LUKS passphrase during boot.</para>
+        stores a passphrase or PIN in the keyring.
+        The LUKS2 volume key can also be used, via the <option>link-volume-key</option> option in
+        <citerefentry><refentrytitle>crypttab</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
+
+        <table>
+          <title>
+            Possible values for <varname>keyname</varname>.
+          </title>
+
+          <tgroup cols='2'>
+            <colspec colname='value' />
+            <colspec colname='description' />
+            <thead>
+              <row>
+                <entry>Value</entry>
+                <entry>Description</entry>
+              </row>
+            </thead>
+            <tbody>
+              <row>
+                <entry>cryptsetup</entry>
+                <entry>Passphrase or recovery key</entry>
+              </row>
+              <row>
+                <entry>fido2-pin</entry>
+                <entry>Security token PIN</entry>
+              </row>
+              <row>
+                <entry>luks2-pin</entry>
+                <entry>LUKS2 token PIN</entry>
+              </row>
+              <row>
+                <entry>tpm2-pin</entry>
+                <entry>TPM2 PIN</entry>
+              </row>
+            </tbody>
+          </tgroup>
+        </table>
 
         <xi:include href="version-info.xml" xpointer="v255"/></listitem>
       </varlistentry>