Description of Changes

The discrepancy in login limits—where the older implementation allowed 10 attempts despite a deny=2 policy—was caused by UI synchronization bugs rather than the PAM configuration itself. The previous code frequently sent empty strings (which do not increment the failure counter) due to poorly managed input states, permitted race conditions by letting users submit multiple times while PAM was still processing in the background, and swallowed subsequent login attempts by overwriting input prompts with error messages. The updated code resolves this by strictly binding the text input, locking the UI during background processing to guarantee a perfect 1-to-1 mapping of keystrokes to PAM attempts, and properly isolating error states to ensure the 2-try limit is strictly enforced.

• Fix: https://jira.tii.ae/browse/SSRCSP-8128
• Now login screen behaviour is as per expectation.
• maxTries incremented to 5
• Issue was with the old cosmic-greeter(1.0.0-alpha.7), so we had the description of the config option. Now they have fixed it in 1.0.3(currently in Ghaf).
• Old(1.0.0-alpha.7): https://github.com/pop-os/cosmic-greeter/blob/epoch-1.0.0-alpha.7/src/locker.rs
• New(1.0.3): https://github.com/pop-os/cosmic-greeter/blob/epoch-1.0.3/src/locker.rs

Type of Change

• New Feature
• Bug Fix
• Improvement / Refactor

Related Issues / Tickets

Checklist

• Clear summary in PR description
• Detailed and meaningful commit message(s)
• Commits are logically organized and squashed if appropriate
• Contribution guidelines followed
• Ghaf documentation updated with the commit - https://tiiuae.github.io/ghaf/
• Author has run make-checks and it passes
• All automatic GitHub Action checks pass - see actions
• Author has added reviewers and removed PR draft status

Testing Instructions

Applicable Targets

• Orin AGX aarch64
• Orin NX aarch64
• Lenovo X1 x86_64
• Dell Latitude x86_64
• System 76 x86_64

Installation Method

• Requires full re-installation
• Can be updated with nixos-rebuild ... switch
• Other:

Test Steps To Verify:

1. Try to login with wrong five times using wrong password your account should get locked.