Start firewalld when -exam user logs in

roles/lmn_fvs/tasks/main.yml

@@ -150,6 +150,7 @@
     - pwroff
     - bootorder.sh
     - reporter
+    - pam-exec.sh
 
 - name: Provide services and timers for some scripts
   copy:
@@ -306,6 +307,12 @@
          font.pointSize: config.fontSize
       }
 
+- name: enable login script via pam_exec.so
+  lineinfile:
+    dest: /etc/pam.d/common-auth
+    line: "auth    optional        pam_exec.so /usr/local/sbin/pam-exec.sh"
+  when: "'teacherlaptop' not in group_names"
+
 - name: Set git default-branch to main
   ansible.builtin.copy:
     dest: /etc/gitconfig