diff -up at-3.1.18/Makefile.in.make at-3.1.18/Makefile.in
--- at-3.1.18/Makefile.in.make	2015-12-06 16:45:10.000000000 +0100
+++ at-3.1.18/Makefile.in	2016-03-23 12:38:15.652898579 +0100
@@ -68,13 +68,13 @@ LIST = Filelist Filelist.asc
 all: at atd atd.service atrun
 
 at: $(ATOBJECTS)
-	$(CC) $(LDFLAGS) -o at $(ATOBJECTS) $(LIBS) $(LEXLIB)
+	$(CC) $(LDFLAGS) -pie -o at $(ATOBJECTS) $(LIBS) $(LEXLIB)
 	rm -f $(CLONES)
 	$(LN_S) -f at atq
 	$(LN_S) -f at atrm
 
 atd: $(RUNOBJECTS)
-	$(CC) $(LDFLAGS) -o atd $(RUNOBJECTS) $(LIBS) $(PAMLIB) $(SELINUXLIB)
+	$(CC) $(LDFLAGS) -pie -o atd $(RUNOBJECTS) $(LIBS) $(PAMLIB) $(SELINUXLIB)
 
 y.tab.c y.tab.h: parsetime.y
 	$(YACC) -d parsetime.y
@@ -89,38 +89,41 @@ atrun: atrun.in
 	configure
 
 .c.o:
-	$(CC) -c $(CFLAGS) $(DEFS) $*.c
+	$(CC) -c $(CFLAGS) -fPIE $(DEFS) $*.c
 
 install: all
-	$(INSTALL) -g root -o root -m 755 -d $(IROOT)$(etcdir)
-	$(INSTALL) -g root -o root -m 755 -d $(IROOT)$(bindir)
-	$(INSTALL) -g root -o root -m 755 -d $(IROOT)$(sbindir)
-	$(INSTALL) -g root -o root -m 755 -d $(IROOT)$(docdir)
-	$(INSTALL) -g root -o root -m 755 -d $(IROOT)$(atdocdir)
-	$(INSTALL) -g $(DAEMON_GROUPNAME) -o $(DAEMON_USERNAME) -m 755 -d $(IROOT)$(ATSPOOL_DIR) $(IROOT)$(ATJOB_DIR)
-	chmod 1770 $(IROOT)$(ATSPOOL_DIR) $(IROOT)$(ATJOB_DIR)
+	$(INSTALL) -m 755 -d $(IROOT)$(etcdir)
+	$(INSTALL) -m 755 -d $(IROOT)$(bindir)
+	$(INSTALL) -m 755 -d $(IROOT)$(sbindir)
+	$(INSTALL) -m 755 -d $(IROOT)$(docdir)
+	$(INSTALL) -m 755 -d $(IROOT)$(atdocdir)
+	$(INSTALL) -m 755 -d $(IROOT)$(etcdir)/pam.d/
+	$(INSTALL) -g $(DAEMON_GROUPNAME) -o $(DAEMON_USERNAME) -m 755 -d $(IROOT)$(ATSPOOL_DIR)
+	chmod 700 $(IROOT)$(ATJOB_DIR) $(IROOT)$(ATSPOOL_DIR)
+	chown $(DAEMON_USERNAME):$(DAEMON_GROUPNAME) $(IROOT)$(ATJOB_DIR) $(IROOT)$(ATSPOOL_DIR)
 	touch $(IROOT)$(LFILE)
 	chmod 600 $(IROOT)$(LFILE)
 	chown $(DAEMON_USERNAME):$(DAEMON_GROUPNAME) $(IROOT)$(LFILE)
-	test -f $(IROOT)$(etcdir)/at.allow || test -f $(IROOT)$(etcdir)/at.deny || $(INSTALL) -o root -g $(DAEMON_GROUPNAME) -m 640 at.deny $(IROOT)$(etcdir)/
-	$(INSTALL) -g $(DAEMON_GROUPNAME) -o $(DAEMON_USERNAME) -m 6755 at $(IROOT)$(bindir)
+	test -f $(IROOT)$(etcdir)/at.allow || test -f $(IROOT)$(etcdir)/at.deny || $(INSTALL) -m 600 at.deny $(IROOT)$(etcdir)/
+	$(INSTALL) -o $(INSTALL_ROOT_USER) -g $(DAEMON_GROUPNAME) pam_atd $(IROOT)$(etcdir)/pam.d/atd
+	$(INSTALL) -m 4755 at $(IROOT)$(bindir)
 	$(LN_S) -f at $(IROOT)$(bindir)/atq
 	$(LN_S) -f at $(IROOT)$(bindir)/atrm
-	$(INSTALL) -g root -o root -m 755 batch $(IROOT)$(bindir)
-	$(INSTALL) -d -o root -g root -m 755 $(IROOT)$(man1dir)
-	$(INSTALL) -d -o root -g root -m 755 $(IROOT)$(man5dir)
-	$(INSTALL) -d -o root -g root -m 755 $(IROOT)$(man8dir)
-	$(INSTALL) -g root -o root -m 755 atd $(IROOT)$(sbindir)
-	$(INSTALL) -g root -o root -m 755 atrun $(IROOT)$(sbindir)
-	$(INSTALL) -g root -o root -m 644 at.1 $(IROOT)$(man1dir)/
+	$(INSTALL) -m 755 batch $(IROOT)$(bindir)
+	$(INSTALL) -d -m 755 $(IROOT)$(man1dir)
+	$(INSTALL) -d -m 755 $(IROOT)$(man5dir)
+	$(INSTALL) -d -m 755 $(IROOT)$(man8dir)
+	$(INSTALL) -m 755 atd $(IROOT)$(sbindir)
+	$(INSTALL) -m 755 atrun $(IROOT)$(sbindir)
+	$(INSTALL) -m 644 at.1 $(IROOT)$(man1dir)/
 	cd $(IROOT)$(man1dir) && $(LN_S) -f at.1 atq.1 && $(LN_S) -f at.1 batch.1 && $(LN_S) -f at.1 atrm.1
-	$(INSTALL) -g root -o root -m 644 atd.8 $(IROOT)$(man8dir)/
+	$(INSTALL) -m 644 atd.8 $(IROOT)$(man8dir)/
 	sed "s,\$${exec_prefix},$(exec_prefix),g" <atrun.8>tmpman
-	$(INSTALL) -g root -o root -m 644 tmpman $(IROOT)$(man8dir)/atrun.8
+	$(INSTALL) -m 644 tmpman $(IROOT)$(man8dir)/atrun.8
 	rm -f tmpman
-	$(INSTALL) -g root -o root -m 644 at.allow.5 $(IROOT)$(man5dir)/
+	$(INSTALL) -m 644 at.allow.5 $(IROOT)$(man5dir)/
 	cd $(IROOT)$(man5dir) && $(LN_S) -f at.allow.5 at.deny.5
-	$(INSTALL) -g root -o root -m 644 $(DOCS) $(IROOT)$(atdocdir)
+	$(INSTALL) -m 644 $(DOCS) $(IROOT)$(atdocdir)
 	rm -f $(IROOT)$(mandir)/cat1/at.1* $(IROOT)$(mandir)/cat1/batch.1* \
 		$(IROOT)$(mandir)/cat1/atq.1*
 	rm -f $(IROOT)$(mandir)/cat1/atd.8*