diff --git a/.authselect.metadata b/.authselect.metadata
index d08bc58..d4b44bd 100644
--- a/.authselect.metadata
+++ b/.authselect.metadata
@@ -1 +1 @@
-3f004c30e9f07c0dd259403f1cd9f13c5ec297ce SOURCES/authselect-1.2.3.tar.gz
+4eb7fbb53b31d92f0fae17d6fd5e5da46bc8b434 SOURCES/authselect-1.2.5.tar.gz
diff --git a/.gitignore b/.gitignore
index 00d9be7..23c7894 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1 @@
-SOURCES/authselect-1.2.3.tar.gz
+SOURCES/authselect-1.2.5.tar.gz
diff --git a/SOURCES/0001-lib-avoid-freeing-uninitialized-variable-in-authsele.patch b/SOURCES/0001-lib-avoid-freeing-uninitialized-variable-in-authsele.patch
deleted file mode 100644
index 091d8f7..0000000
--- a/SOURCES/0001-lib-avoid-freeing-uninitialized-variable-in-authsele.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From 6924b8f8d82ecd32e897cf5f441e5c87f8816859 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>
-Date: Thu, 22 Jul 2021 11:29:20 +0200
-Subject: [PATCH] lib: avoid freeing uninitialized variable in
- authselect_apply_changes()
-
-If authselect_profile() fails, we goto done and try to free uninitialized
-variable.
-
-Resolves:
-https://github.com/authselect/authselect/issues/265
----
- src/lib/authselect.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/lib/authselect.c b/src/lib/authselect.c
-index 0f43e12202c16769dfc6ac7dee41812159cc1d3a..a901e02719713bd13d5a4fab606ee713b3d6ddca 100644
---- a/src/lib/authselect.c
-+++ b/src/lib/authselect.c
-@@ -163,7 +163,7 @@ authselect_uninstall(void)
- _PUBLIC_ int
- authselect_apply_changes(void)
- {
-- struct authselect_profile *profile;
-+ struct authselect_profile *profile = NULL;
- char **supported = NULL;
- char *profile_id;
- char **features;
---
-2.31.1
-
diff --git a/SOURCES/0901-rhel9-remove-mention-of-Fedora-Change-page-in-compat.patch b/SOURCES/0901-rhel9-remove-mention-of-Fedora-Change-page-in-compat.patch
new file mode 100644
index 0000000..5935de1
--- /dev/null
+++ b/SOURCES/0901-rhel9-remove-mention-of-Fedora-Change-page-in-compat.patch
@@ -0,0 +1,25 @@
+From c3c2c3b7ffe04dc2e810c9fffdd82689543a94df Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>
+Date: Tue, 30 Oct 2018 14:08:12 +0100
+Subject: [PATCH 1/4] rhel9: remove mention of Fedora Change page in compat
+ tool
+
+---
+ src/compat/authcompat.py.in.in | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/src/compat/authcompat.py.in.in b/src/compat/authcompat.py.in.in
+index 1a68d95c71b51beabe80e9b07c084ea9c2f3580d..8334293911d1d4c2d98a6d233b91fc348cf06575 100755
+--- a/src/compat/authcompat.py.in.in
++++ b/src/compat/authcompat.py.in.in
+@@ -471,7 +471,6 @@ class AuthCompat:
+ "It does not provide all capabilities of authconfig.\n"))
+ print(_("IMPORTANT: authconfig is replaced by authselect, "
+ "please update your scripts."))
+- print(_("See Fedora 28 Change Page: https://fedoraproject.org/wiki/Changes/AuthselectAsDefault"))
+ print(_("See man authselect-migration(7) to help you with migration to authselect"))
+
+ options = self.options.getSetButUnsupported()
+--
+2.34.1
+
diff --git a/SOURCES/0902-rhel9-remove-ecryptfs-support.patch b/SOURCES/0902-rhel9-remove-ecryptfs-support.patch
new file mode 100644
index 0000000..6f8dd13
--- /dev/null
+++ b/SOURCES/0902-rhel9-remove-ecryptfs-support.patch
@@ -0,0 +1,283 @@
+From 9da7355f1e2c8a148d4730fec4c4707c56e6dfa1 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>
+Date: Mon, 10 Jun 2019 10:53:15 +0200
+Subject: [PATCH 2/4] rhel9: remove ecryptfs support
+
+---
+ profiles/nis/README | 3 ---
+ profiles/nis/fingerprint-auth | 1 -
+ profiles/nis/password-auth | 1 -
+ profiles/nis/postlogin | 4 ----
+ profiles/nis/system-auth | 1 -
+ profiles/sssd/README | 3 ---
+ profiles/sssd/fingerprint-auth | 1 -
+ profiles/sssd/password-auth | 1 -
+ profiles/sssd/postlogin | 4 ----
+ profiles/sssd/smartcard-auth | 1 -
+ profiles/sssd/system-auth | 1 -
+ profiles/winbind/README | 3 ---
+ profiles/winbind/fingerprint-auth | 1 -
+ profiles/winbind/password-auth | 1 -
+ profiles/winbind/postlogin | 4 ----
+ profiles/winbind/system-auth | 1 -
+ src/compat/authcompat.py.in.in | 1 -
+ src/compat/authcompat_Options.py | 2 +-
+ src/man/authselect-migration.7.adoc | 5 ++---
+ 19 files changed, 3 insertions(+), 36 deletions(-)
+
+diff --git a/profiles/nis/README b/profiles/nis/README
+index 895e8fa8650c04d41bf8bc8d6e3cda18db9bf814..71e23d61a8c1ea773c98524256a5eaad5a75d197 100644
+--- a/profiles/nis/README
++++ b/profiles/nis/README
+@@ -21,9 +21,6 @@ with-mkhomedir::
+ Enable automatic creation of home directories for users on their
+ first login.
+
+-with-ecryptfs::
+- Enable automatic per-user ecryptfs.
+-
+ with-fingerprint::
+ Enable authentication with fingerprint reader through *pam_fprintd*.
+
+diff --git a/profiles/nis/fingerprint-auth b/profiles/nis/fingerprint-auth
+index 3a2609df4ca29cdfcbff84b37576bb7b840d72b2..0b2f583a2fcf164647f7de387e9be2982bdf36cb 100644
+--- a/profiles/nis/fingerprint-auth
++++ b/profiles/nis/fingerprint-auth
+@@ -15,7 +15,6 @@ password required pam_deny.so
+
+ session optional pam_keyinit.so revoke
+ session required pam_limits.so
+-session optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"}
+ -session optional pam_systemd.so
+ session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"}
+ session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
+diff --git a/profiles/nis/password-auth b/profiles/nis/password-auth
+index f181a58ab7792c7e1a4234e677cbb7e3d0a6548d..79fb521eb5dff4978203166491b185887d1ec744 100644
+--- a/profiles/nis/password-auth
++++ b/profiles/nis/password-auth
+@@ -18,7 +18,6 @@ password required pam_deny.so
+
+ session optional pam_keyinit.so revoke
+ session required pam_limits.so
+-session optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"}
+ -session optional pam_systemd.so
+ session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"}
+ session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
+diff --git a/profiles/nis/postlogin b/profiles/nis/postlogin
+index 137cd00dc65ee9ea83123f1d3a6f7ba04f0aea04..04a11f049bc1e220c9064fba7b46eb243ddd4996 100644
+--- a/profiles/nis/postlogin
++++ b/profiles/nis/postlogin
+@@ -1,7 +1,3 @@
+-auth optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"}
+-
+-password optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"}
+-
+ session optional pam_umask.so silent
+ session [success=1 default=ignore] pam_succeed_if.so service !~ gdm* service !~ su* quiet
+ session [default=1] pam_lastlog.so nowtmp {if "with-silent-lastlog":silent|showfailed}
+diff --git a/profiles/nis/system-auth b/profiles/nis/system-auth
+index bc3f402435aafb5294dbae94096b184af51cf914..38c10c1afcf936c1d24d8edef941ae849d1186fc 100644
+--- a/profiles/nis/system-auth
++++ b/profiles/nis/system-auth
+@@ -19,7 +19,6 @@ password required pam_deny.so
+
+ session optional pam_keyinit.so revoke
+ session required pam_limits.so
+-session optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"}
+ -session optional pam_systemd.so
+ session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"}
+ session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
+diff --git a/profiles/sssd/README b/profiles/sssd/README
+index 61d5aedf65b2351cf23cea0a6b6b0932e32f0e48..ab9af237442089ded86b63942dd856397108ccf0 100644
+--- a/profiles/sssd/README
++++ b/profiles/sssd/README
+@@ -40,9 +40,6 @@ with-mkhomedir::
+ Enable automatic creation of home directories for users on their
+ first login.
+
+-with-ecryptfs::
+- Enable automatic per-user ecryptfs.
+-
+ with-smartcard::
+ Enable authentication with smartcards through SSSD. Please note that
+ smartcard support must be also explicitly enabled within
+diff --git a/profiles/sssd/fingerprint-auth b/profiles/sssd/fingerprint-auth
+index 20ad3613e66ec85c7d2462d0449854e522383b3a..dc7befe7a4839a1ae5a4d21f4e5232126df55564 100644
+--- a/profiles/sssd/fingerprint-auth
++++ b/profiles/sssd/fingerprint-auth
+@@ -20,7 +20,6 @@ password required pam_deny.so
+
+ session optional pam_keyinit.so revoke
+ session required pam_limits.so
+-session optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"}
+ -session optional pam_systemd.so
+ session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"}
+ session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
+diff --git a/profiles/sssd/password-auth b/profiles/sssd/password-auth
+index 3e33dcc09f68055f2f87709e638005929bd577b3..858c6db357d07dc554806f4807f9b0858a649f44 100644
+--- a/profiles/sssd/password-auth
++++ b/profiles/sssd/password-auth
+@@ -28,7 +28,6 @@ password required pam_deny.so
+
+ session optional pam_keyinit.so revoke
+ session required pam_limits.so
+-session optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"}
+ -session optional pam_systemd.so
+ session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"}
+ session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
+diff --git a/profiles/sssd/postlogin b/profiles/sssd/postlogin
+index 137cd00dc65ee9ea83123f1d3a6f7ba04f0aea04..04a11f049bc1e220c9064fba7b46eb243ddd4996 100644
+--- a/profiles/sssd/postlogin
++++ b/profiles/sssd/postlogin
+@@ -1,7 +1,3 @@
+-auth optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"}
+-
+-password optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"}
+-
+ session optional pam_umask.so silent
+ session [success=1 default=ignore] pam_succeed_if.so service !~ gdm* service !~ su* quiet
+ session [default=1] pam_lastlog.so nowtmp {if "with-silent-lastlog":silent|showfailed}
+diff --git a/profiles/sssd/smartcard-auth b/profiles/sssd/smartcard-auth
+index 0d8bcab250633b09bce0232a5747f3a7e740d5d7..754847f2d8885ff35cbc57ec2364d82b963caa3b 100644
+--- a/profiles/sssd/smartcard-auth
++++ b/profiles/sssd/smartcard-auth
+@@ -18,7 +18,6 @@ account required pam_permit.so
+
+ session optional pam_keyinit.so revoke
+ session required pam_limits.so
+-session optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"}
+ -session optional pam_systemd.so
+ session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"}
+ session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
+diff --git a/profiles/sssd/system-auth b/profiles/sssd/system-auth
+index a43341120f55bad3fb07dfea1c04453d0a278329..88c49e2dd5b60847d1d19154622a8614a21e5e1f 100644
+--- a/profiles/sssd/system-auth
++++ b/profiles/sssd/system-auth
+@@ -35,7 +35,6 @@ password required pam_deny.so
+
+ session optional pam_keyinit.so revoke
+ session required pam_limits.so
+-session optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"}
+ -session optional pam_systemd.so
+ session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"}
+ session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
+diff --git a/profiles/winbind/README b/profiles/winbind/README
+index 0048c29256f5d4064edfb84a2f4b761fd09e90f6..6f7a7cab1efc768c4c82791d6a8f00def1771d37 100644
+--- a/profiles/winbind/README
++++ b/profiles/winbind/README
+@@ -33,9 +33,6 @@ with-mkhomedir::
+ Enable automatic creation of home directories for users on their
+ first login.
+
+-with-ecryptfs::
+- Enable automatic per-user ecryptfs.
+-
+ with-fingerprint::
+ Enable authentication with fingerprint reader through *pam_fprintd*.
+
+diff --git a/profiles/winbind/fingerprint-auth b/profiles/winbind/fingerprint-auth
+index e8997c6c78ce7305fa7068fb169c05c68167880d..c5485ab848989a252e4ff4b1376a41202d21fd67 100644
+--- a/profiles/winbind/fingerprint-auth
++++ b/profiles/winbind/fingerprint-auth
+@@ -19,7 +19,6 @@ password required pam_deny.so
+
+ session optional pam_keyinit.so revoke
+ session required pam_limits.so
+-session optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"}
+ -session optional pam_systemd.so
+ session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"}
+ session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
+diff --git a/profiles/winbind/password-auth b/profiles/winbind/password-auth
+index 58705f3b15165c8d8bd4938889e3fb4d89c1a528..e84e2fcbb2bad9af6156e6e6db23f089f2b5d210 100644
+--- a/profiles/winbind/password-auth
++++ b/profiles/winbind/password-auth
+@@ -25,7 +25,6 @@ password required pam_deny.so
+
+ session optional pam_keyinit.so revoke
+ session required pam_limits.so
+-session optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"}
+ -session optional pam_systemd.so
+ session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"}
+ session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
+diff --git a/profiles/winbind/postlogin b/profiles/winbind/postlogin
+index 137cd00dc65ee9ea83123f1d3a6f7ba04f0aea04..04a11f049bc1e220c9064fba7b46eb243ddd4996 100644
+--- a/profiles/winbind/postlogin
++++ b/profiles/winbind/postlogin
+@@ -1,7 +1,3 @@
+-auth optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"}
+-
+-password optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"}
+-
+ session optional pam_umask.so silent
+ session [success=1 default=ignore] pam_succeed_if.so service !~ gdm* service !~ su* quiet
+ session [default=1] pam_lastlog.so nowtmp {if "with-silent-lastlog":silent|showfailed}
+diff --git a/profiles/winbind/system-auth b/profiles/winbind/system-auth
+index 994c342441a0ed2738765a9fa7f6cc84f692d1d8..b5c5cfaa964a31b1cd8ac4cb62998c0a0a53a03e 100644
+--- a/profiles/winbind/system-auth
++++ b/profiles/winbind/system-auth
+@@ -26,7 +26,6 @@ password required pam_deny.so
+
+ session optional pam_keyinit.so revoke
+ session required pam_limits.so
+-session optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"}
+ -session optional pam_systemd.so
+ session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"}
+ session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
+diff --git a/src/compat/authcompat.py.in.in b/src/compat/authcompat.py.in.in
+index 8334293911d1d4c2d98a6d233b91fc348cf06575..55e205bae2c0b1f7892f8b286c288dfeaa26a60d 100755
+--- a/src/compat/authcompat.py.in.in
++++ b/src/compat/authcompat.py.in.in
+@@ -523,7 +523,6 @@ class AuthCompat:
+ 'smartcard': 'with-smartcard',
+ 'requiresmartcard': 'with-smartcard-required',
+ 'fingerprint': 'with-fingerprint',
+- 'ecryptfs': 'with-ecryptfs',
+ 'mkhomedir': 'with-mkhomedir',
+ 'faillock': 'with-faillock',
+ 'pamaccess': 'with-pamaccess',
+diff --git a/src/compat/authcompat_Options.py b/src/compat/authcompat_Options.py
+index d26dedabdfb9519861076b58cddd0dd0eb04b7cb..5c8b21b55014198d6d9dfc98bd807c3c922b06f4 100644
+--- a/src/compat/authcompat_Options.py
++++ b/src/compat/authcompat_Options.py
+@@ -93,7 +93,6 @@ class Options:
+ Option.Valued("smartcardaction", _("<0=Lock|1=Ignore>"), _("action to be taken on smart card removal")),
+ Option.Feature("requiresmartcard", _("require smart card for authentication by default")),
+ Option.Feature("fingerprint", _("authentication with fingerprint readers by default")),
+- Option.Feature("ecryptfs", _("automatic per-user ecryptfs")),
+ Option.Feature("krb5", _("Kerberos authentication by default")),
+ Option.Valued("krb5kdc", _("<server>"), _("default Kerberos KDC")),
+ Option.Valued("krb5adminserver", _("<server>"), _("default Kerberos admin server")),
+@@ -141,6 +140,7 @@ class Options:
+ # layers and will produce warning when used. They will not affect
+ # the system.
+ Option.UnsupportedFeature("cache"),
++ Option.UnsupportedFeature("ecryptfs"),
+ Option.UnsupportedFeature("shadow"),
+ Option.UnsupportedSwitch("useshadow"),
+ Option.UnsupportedFeature("md5"),
+diff --git a/src/man/authselect-migration.7.adoc b/src/man/authselect-migration.7.adoc
+index 3513a7e7cd3d7cc0045167e8224248c5be90ab2c..888cd4e5a0750d4e1aa5898887f5f7fd42472741 100644
+--- a/src/man/authselect-migration.7.adoc
++++ b/src/man/authselect-migration.7.adoc
+@@ -80,7 +80,6 @@ configuration file for required services.
+ |*Authconfig options* |*Authselect profile feature*
+ |--enablesmartcard |with-smartcard
+ |--enablefingerprint |with-fingerprint
+-|--enableecryptfs |with-ecryptfs
+ |--enablemkhomedir |with-mkhomedir
+ |--enablefaillock |with-faillock
+ |--enablepamaccess |with-pamaccess
+@@ -103,8 +102,8 @@ authselect select sssd with-faillock
+ authconfig --enablesssd --enablesssdauth --enablesmartcard --smartcardmodule=sssd --updateall
+ authselect select sssd with-smartcard
+
+-authconfig --enableecryptfs --enablepamaccess --updateall
+-authselect select sssd with-ecryptfs with-pamaccess
++authconfig --enablepamaccess --updateall
++authselect select sssd with-pamaccess
+
+ authconfig --enablewinbind --enablewinbindauth --winbindjoin=Administrator --updateall
+ realm join -U Administrator --client-software=winbind WINBINDDOMAIN
+--
+2.34.1
+
diff --git a/SOURCES/0903-rhel9-Revert-profiles-add-support-for-resolved.patch b/SOURCES/0903-rhel9-Revert-profiles-add-support-for-resolved.patch
new file mode 100644
index 0000000..a3e5c50
--- /dev/null
+++ b/SOURCES/0903-rhel9-Revert-profiles-add-support-for-resolved.patch
@@ -0,0 +1,42 @@
+From 6381b49e90b3850fade68c8af03b17d0cc016d3c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>
+Date: Wed, 25 Nov 2020 14:05:00 +0100
+Subject: [PATCH 3/4] rhel9: Revert "profiles: add support for resolved"
+
+systemd-resolved should not be enabled by default on rhel8.
+
+This reverts commit c5294c508a940291440eb32d5d750f33baf1ae54.
+---
+ profiles/minimal/nsswitch.conf | 2 +-
+ profiles/nis/nsswitch.conf | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/profiles/minimal/nsswitch.conf b/profiles/minimal/nsswitch.conf
+index a9e4bc79a1090304542ccd8b43d1107eeb5304df..a39e4d32ebf79e8bf05f2db5753b01596222dc35 100644
+--- a/profiles/minimal/nsswitch.conf
++++ b/profiles/minimal/nsswitch.conf
+@@ -2,7 +2,7 @@ aliases: files {exclude if "with-custom
+ automount: files {exclude if "with-custom-automount"}
+ ethers: files {exclude if "with-custom-ethers"}
+ group: files {if "with-altfiles":altfiles }systemd {exclude if "with-custom-group"}
+-hosts: resolve [!UNAVAIL=return] files myhostname dns {exclude if "with-custom-hosts"}
++hosts: files dns myhostname {exclude if "with-custom-hosts"}
+ initgroups: files {exclude if "with-custom-initgroups"}
+ netgroup: files {exclude if "with-custom-netgroup"}
+ networks: files {exclude if "with-custom-networks"}
+diff --git a/profiles/nis/nsswitch.conf b/profiles/nis/nsswitch.conf
+index 50a3ffb7431a91b88b4bfef4c09df19310fac7e7..9bee7d839f84ff39d54cb6ead9dea38e51736b4d 100644
+--- a/profiles/nis/nsswitch.conf
++++ b/profiles/nis/nsswitch.conf
+@@ -2,7 +2,7 @@ aliases: files nis {exclude if "with-custom-aliases"}
+ automount: files nis {exclude if "with-custom-automount"}
+ ethers: files nis {exclude if "with-custom-ethers"}
+ group: files nis systemd {exclude if "with-custom-group"}
+-hosts: resolve [!UNAVAIL=return] files nis myhostname dns {exclude if "with-custom-hosts"}
++hosts: files nis dns myhostname {exclude if "with-custom-hosts"}
+ initgroups: files nis {exclude if "with-custom-initgroups"}
+ netgroup: files nis {exclude if "with-custom-netgroup"}
+ networks: files nis {exclude if "with-custom-networks"}
+--
+2.34.1
+
diff --git a/SOURCES/0904-rhel9-remove-nis-support.patch b/SOURCES/0904-rhel9-remove-nis-support.patch
new file mode 100644
index 0000000..79be754
--- /dev/null
+++ b/SOURCES/0904-rhel9-remove-nis-support.patch
@@ -0,0 +1,297 @@
+From fde1c60f1e87383596ee7060f4d748675b2efae9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>
+Date: Wed, 9 Jun 2021 13:59:01 +0200
+Subject: [PATCH 4/4] rhel9: remove nis support
+
+NIS is no longer supported in RHEL9.
+---
+ profiles/Makefile.am | 14 -----
+ profiles/nis/dconf-db | 3 -
+ profiles/nis/dconf-locks | 2 -
+ profiles/nis/nsswitch.conf | 14 -----
+ profiles/nis/postlogin | 4 --
+ rpm/authselect.spec.in | 11 ----
+ src/compat/authcompat.py.in.in | 95 -----------------------------
+ src/compat/authcompat_Options.py | 8 ++-
+ src/man/authselect-migration.7.adoc | 2 +-
+ 9 files changed, 6 insertions(+), 147 deletions(-)
+ delete mode 100644 profiles/nis/dconf-db
+ delete mode 100644 profiles/nis/dconf-locks
+ delete mode 100644 profiles/nis/nsswitch.conf
+ delete mode 100644 profiles/nis/postlogin
+
+diff --git a/profiles/Makefile.am b/profiles/Makefile.am
+index 7191b2604ca2c9ebaba3a4f1beb950e7d0e03970..4ab613f42a581df02c427636a0070092b58ec418 100644
+--- a/profiles/Makefile.am
++++ b/profiles/Makefile.am
+@@ -15,20 +15,6 @@ dist_profile_minimal_DATA = \
+ $(top_srcdir)/profiles/minimal/dconf-locks \
+ $(NULL)
+
+-profile_nisdir = $(authselect_profile_dir)/nis
+-dist_profile_nis_DATA = \
+- $(top_srcdir)/profiles/nis/nsswitch.conf \
+- $(top_srcdir)/profiles/nis/password-auth \
+- $(top_srcdir)/profiles/nis/postlogin \
+- $(top_srcdir)/profiles/nis/README \
+- $(top_srcdir)/profiles/nis/REQUIREMENTS \
+- $(top_srcdir)/profiles/nis/smartcard-auth \
+- $(top_srcdir)/profiles/nis/system-auth \
+- $(top_srcdir)/profiles/nis/fingerprint-auth \
+- $(top_srcdir)/profiles/nis/dconf-db \
+- $(top_srcdir)/profiles/nis/dconf-locks \
+- $(NULL)
+-
+ profile_sssddir = $(authselect_profile_dir)/sssd
+ dist_profile_sssd_DATA = \
+ $(top_srcdir)/profiles/sssd/nsswitch.conf \
+diff --git a/profiles/nis/dconf-db b/profiles/nis/dconf-db
+deleted file mode 100644
+index bd32b2819f66acdc75ab0fc522ec85673d10ed72..0000000000000000000000000000000000000000
+--- a/profiles/nis/dconf-db
++++ /dev/null
+@@ -1,3 +0,0 @@
+-[org/gnome/login-screen]
+-enable-smartcard-authentication=false
+-enable-fingerprint-authentication={if "with-fingerprint":true|false}
+diff --git a/profiles/nis/dconf-locks b/profiles/nis/dconf-locks
+deleted file mode 100644
+index 8a36fa9568344338272786394aece872185d0ab3..0000000000000000000000000000000000000000
+--- a/profiles/nis/dconf-locks
++++ /dev/null
+@@ -1,2 +0,0 @@
+-/org/gnome/login-screen/enable-smartcard-authentication
+-/org/gnome/login-screen/enable-fingerprint-authentication
+diff --git a/profiles/nis/nsswitch.conf b/profiles/nis/nsswitch.conf
+deleted file mode 100644
+index 9bee7d839f84ff39d54cb6ead9dea38e51736b4d..0000000000000000000000000000000000000000
+--- a/profiles/nis/nsswitch.conf
++++ /dev/null
+@@ -1,14 +0,0 @@
+-aliases: files nis {exclude if "with-custom-aliases"}
+-automount: files nis {exclude if "with-custom-automount"}
+-ethers: files nis {exclude if "with-custom-ethers"}
+-group: files nis systemd {exclude if "with-custom-group"}
+-hosts: files nis dns myhostname {exclude if "with-custom-hosts"}
+-initgroups: files nis {exclude if "with-custom-initgroups"}
+-netgroup: files nis {exclude if "with-custom-netgroup"}
+-networks: files nis {exclude if "with-custom-networks"}
+-passwd: files nis systemd {exclude if "with-custom-passwd"}
+-protocols: files nis {exclude if "with-custom-protocols"}
+-publickey: files nis {exclude if "with-custom-publickey"}
+-rpc: files nis {exclude if "with-custom-rpc"}
+-services: files nis {exclude if "with-custom-services"}
+-shadow: files nis {exclude if "with-custom-shadow"}
+diff --git a/profiles/nis/postlogin b/profiles/nis/postlogin
+deleted file mode 100644
+index 04a11f049bc1e220c9064fba7b46eb243ddd4996..0000000000000000000000000000000000000000
+--- a/profiles/nis/postlogin
++++ /dev/null
+@@ -1,4 +0,0 @@
+-session optional pam_umask.so silent
+-session [success=1 default=ignore] pam_succeed_if.so service !~ gdm* service !~ su* quiet
+-session [default=1] pam_lastlog.so nowtmp {if "with-silent-lastlog":silent|showfailed}
+-session optional pam_lastlog.so silent noupdate showfailed
+diff --git a/rpm/authselect.spec.in b/rpm/authselect.spec.in
+index f8539d5a028da1a7184b47609a8efdb5ce0be14e..95da183a41a29f7913a0a255a94070908ed9a66c 100644
+--- a/rpm/authselect.spec.in
++++ b/rpm/authselect.spec.in
+@@ -165,7 +165,6 @@ find $RPM_BUILD_ROOT -name "*.a" -exec %__rm -f {} \;
+ %dir %{_datadir}/authselect/vendor
+ %dir %{_datadir}/authselect/default
+ %dir %{_datadir}/authselect/default/minimal/
+-%dir %{_datadir}/authselect/default/nis/
+ %dir %{_datadir}/authselect/default/sssd/
+ %dir %{_datadir}/authselect/default/winbind/
+ %{_datadir}/authselect/default/minimal/dconf-db
+@@ -178,16 +177,6 @@ find $RPM_BUILD_ROOT -name "*.a" -exec %__rm -f {} \;
+ %{_datadir}/authselect/default/minimal/REQUIREMENTS
+ %{_datadir}/authselect/default/minimal/smartcard-auth
+ %{_datadir}/authselect/default/minimal/system-auth
+-%{_datadir}/authselect/default/nis/dconf-db
+-%{_datadir}/authselect/default/nis/dconf-locks
+-%{_datadir}/authselect/default/nis/fingerprint-auth
+-%{_datadir}/authselect/default/nis/nsswitch.conf
+-%{_datadir}/authselect/default/nis/password-auth
+-%{_datadir}/authselect/default/nis/postlogin
+-%{_datadir}/authselect/default/nis/README
+-%{_datadir}/authselect/default/nis/REQUIREMENTS
+-%{_datadir}/authselect/default/nis/smartcard-auth
+-%{_datadir}/authselect/default/nis/system-auth
+ %{_datadir}/authselect/default/sssd/dconf-db
+ %{_datadir}/authselect/default/sssd/dconf-locks
+ %{_datadir}/authselect/default/sssd/fingerprint-auth
+diff --git a/src/compat/authcompat.py.in.in b/src/compat/authcompat.py.in.in
+index 55e205bae2c0b1f7892f8b286c288dfeaa26a60d..c6d1f2786c233f7ebdbfe5f2503aa0016012aee0 100755
+--- a/src/compat/authcompat.py.in.in
++++ b/src/compat/authcompat.py.in.in
+@@ -243,20 +243,6 @@ class Configuration:
+
+ config.write(keys)
+
+- class Network(Base):
+- def __init__(self, options):
+- super(Configuration.Network, self).__init__(options)
+-
+- def write(self):
+- nisdomain = self.get("nisdomain")
+- config = EnvironmentFile(Path.System('network'))
+-
+- if nisdomain is None:
+- return
+-
+- config.set("NISDOMAIN", nisdomain)
+- config.write()
+-
+ class SSSD(Base):
+ def __init__(self, options):
+ super(Configuration.SSSD, self).__init__(options, ServiceName="sssd")
+@@ -378,83 +364,6 @@ class Configuration:
+ # other applications may depend on it.
+ return
+
+- class NIS(Base):
+- def __init__(self, options):
+- super(Configuration.NIS, self).__init__(options)
+- self.rpcbind = Service("rpcbind")
+- self.ypbind = Service("ypbind")
+-
+- def isEnabled(self):
+- if not self.isset("nis"):
+- return None
+-
+- return self.getBool("nis")
+-
+- def enableService(self, nostart):
+- if not self.isset("nisdomain"):
+- return
+-
+- nisdom = self.get("nisdomain")
+-
+- if not nostart:
+- cmd = Command(Path.System('cmd-domainname'), [nisdom])
+- cmd.run()
+-
+- cmd = Command(Path.System('cmd-setsebool'),
+- ['-P', 'allow_ypbind', '1'])
+- cmd.run()
+-
+- self.rpcbind.enable()
+- self.ypbind.enable()
+-
+- if not nostart:
+- self.rpcbind.start(Restart=False)
+- self.ypbind.start()
+-
+- def disableService(self, nostop):
+- if not nostop:
+- cmd = Command(Path.System('cmd-domainname'), ["(none)"])
+- cmd.run()
+-
+- cmd = Command(Path.System('cmd-setsebool'),
+- ['-P', 'allow_ypbind', '0'])
+- cmd.run()
+-
+- self.rpcbind.disable()
+- self.ypbind.disable()
+-
+- if not nostop:
+- self.rpcbind.stop()
+- self.ypbind.stop()
+-
+- def write(self):
+- if not self.isset("nisdomain"):
+- return
+-
+- output = "domain " + self.get("nisdomain")
+-
+- additional_servers = []
+- if self.isset("nisserver"):
+- servers = self.get("nisserver").split(",")
+- additional_servers = servers[1:]
+- output += " server " + servers[0] + "\n"
+- else:
+- output += " broadcast\n"
+-
+- for server in additional_servers:
+- output += "ypserver " + server + "\n"
+-
+- filename = Path.System('yp.conf')
+- if self.getBool("test-call"):
+- print("========== BEGIN Content of [%s] ==========" % filename)
+- print(output)
+- print("========== END Content of [%s] ==========\n" % filename)
+- return
+-
+- with open(filename, "w") as f:
+- f.write(output)
+-
+-
+ class AuthCompat:
+ def __init__(self):
+ self.sysconfig = EnvironmentFile(Path.System('authconfig'))
+@@ -538,8 +447,6 @@ class AuthCompat:
+ or self.options.getBool("sssd")
+ or self.options.getBool("sssdauth")):
+ profile = "sssd"
+- elif self.options.getBool("nis"):
+- profile = "nis"
+ elif self.options.getBool("winbind"):
+ profile = "winbind"
+
+@@ -596,13 +503,11 @@ class AuthCompat:
+ def writeConfiguration(self):
+ configs = [
+ Configuration.LDAP(self.options),
+- Configuration.Network(self.options),
+ Configuration.Kerberos(self.options),
+ Configuration.SSSD(self.options),
+ Configuration.Winbind(self.options),
+ Configuration.PWQuality(self.options),
+ Configuration.MakeHomedir(self.options),
+- Configuration.NIS(self.options)
+ ]
+
+ for config in configs:
+diff --git a/src/compat/authcompat_Options.py b/src/compat/authcompat_Options.py
+index 5c8b21b55014198d6d9dfc98bd807c3c922b06f4..79ead60fa9edc1244227e3b69df025471b7c7991 100644
+--- a/src/compat/authcompat_Options.py
++++ b/src/compat/authcompat_Options.py
+@@ -79,9 +79,6 @@ class Options:
+ # However, they will just make sure that an authentication against
+ # expected service is working. They may not result in the exact same
+ # configuration as authconfig would generate.
+- Option.Feature("nis", _("NIS for user information by default")),
+- Option.Valued("nisdomain", _("<domain>"), _("default NIS domain")),
+- Option.Valued("nisserver", _("<server>"), _("default NIS server")),
+ Option.Feature("ldap", _("LDAP for user information by default")),
+ Option.Feature("ldapauth", _("LDAP for authentication by default")),
+ Option.Valued("ldapserver", _("<server>"), _("default LDAP server hostname or URI")),
+@@ -164,6 +161,11 @@ class Options:
+ Option.UnsupportedFeature("locauthorize"),
+ Option.UnsupportedFeature("sysnetauth"),
+ Option.UnsupportedValued("faillockargs", _("<options>")),
++
++ # NIS is no longer supported
++ Option.UnsupportedFeature("nis"),
++ Option.UnsupportedValued("nisdomain", _("<domain>")),
++ Option.UnsupportedValued("nisserver", _("<server>")),
+ ]
+
+ Map = {
+diff --git a/src/man/authselect-migration.7.adoc b/src/man/authselect-migration.7.adoc
+index 888cd4e5a0750d4e1aa5898887f5f7fd42472741..d9777b9b473859d7ec532f39f7e14bd81c4f1b90 100644
+--- a/src/man/authselect-migration.7.adoc
++++ b/src/man/authselect-migration.7.adoc
+@@ -72,7 +72,7 @@ configuration file for required services.
+ |--enablesssd --enablesssdauth |sssd
+ |--enablekrb5 |sssd
+ |--enablewinbind --enablewinbindauth |winbind
+-|--enablenis |nis
++|--enablenis |none
+ |=========================================================
+
+ .Relation of authconfig options to authselect profile features
+--
+2.34.1
+
diff --git a/SOURCES/9001-rhel9-remove-mention-of-Fedora-Change-page-in-compat.patch b/SOURCES/9001-rhel9-remove-mention-of-Fedora-Change-page-in-compat.patch
deleted file mode 100644
index 007679c..0000000
--- a/SOURCES/9001-rhel9-remove-mention-of-Fedora-Change-page-in-compat.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From 2e2a7143cbfa719905cb130a5e67313c65bf3b65 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>
-Date: Tue, 30 Oct 2018 14:08:12 +0100
-Subject: [PATCH 1/3] rhel9: remove mention of Fedora Change page in compat
- tool
-
----
- src/compat/authcompat.py.in.in | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/src/compat/authcompat.py.in.in b/src/compat/authcompat.py.in.in
-index f879e08eb94e9620dfc28f245b0ea5815df7e4f2..e4b8c05c6a11a215529ba66f8b36b72a6ac18448 100755
---- a/src/compat/authcompat.py.in.in
-+++ b/src/compat/authcompat.py.in.in
-@@ -468,7 +468,6 @@ class AuthCompat:
- "It does not provide all capabilities of authconfig.\n"))
- print(_("IMPORTANT: authconfig is replaced by authselect, "
- "please update your scripts."))
-- print(_("See Fedora 28 Change Page: https://fedoraproject.org/wiki/Changes/AuthselectAsDefault"))
- print(_("See man authselect-migration(7) to help you with migration to authselect"))
-
- options = self.options.getSetButUnsupported()
---
-2.29.2
-
diff --git a/SOURCES/9002-rhel9-remove-ecryptfs-support.patch b/SOURCES/9002-rhel9-remove-ecryptfs-support.patch
deleted file mode 100644
index 9a43bca..0000000
--- a/SOURCES/9002-rhel9-remove-ecryptfs-support.patch
+++ /dev/null
@@ -1,283 +0,0 @@
-From 6de7d2e033d67f23b33620a2b80f5a6c106bd6f5 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>
-Date: Mon, 10 Jun 2019 10:53:15 +0200
-Subject: [PATCH 2/3] rhel9: remove ecryptfs support
-
----
- profiles/nis/README | 3 ---
- profiles/nis/fingerprint-auth | 1 -
- profiles/nis/password-auth | 1 -
- profiles/nis/postlogin | 4 ----
- profiles/nis/system-auth | 1 -
- profiles/sssd/README | 3 ---
- profiles/sssd/fingerprint-auth | 1 -
- profiles/sssd/password-auth | 1 -
- profiles/sssd/postlogin | 4 ----
- profiles/sssd/smartcard-auth | 1 -
- profiles/sssd/system-auth | 1 -
- profiles/winbind/README | 3 ---
- profiles/winbind/fingerprint-auth | 1 -
- profiles/winbind/password-auth | 1 -
- profiles/winbind/postlogin | 4 ----
- profiles/winbind/system-auth | 1 -
- src/compat/authcompat.py.in.in | 1 -
- src/compat/authcompat_Options.py | 2 +-
- src/man/authselect-migration.7.adoc | 5 ++---
- 19 files changed, 3 insertions(+), 36 deletions(-)
-
-diff --git a/profiles/nis/README b/profiles/nis/README
-index 5dbb9b49fb7708ef3b073aff7e1883e3f9a0bd06..cac3428bf844b0a9d251015988583f4c1b15c3c9 100644
---- a/profiles/nis/README
-+++ b/profiles/nis/README
-@@ -21,9 +21,6 @@ with-mkhomedir::
- Enable automatic creation of home directories for users on their
- first login.
-
--with-ecryptfs::
-- Enable automatic per-user ecryptfs.
--
- with-fingerprint::
- Enable authentication with fingerprint reader through *pam_fprintd*.
-
-diff --git a/profiles/nis/fingerprint-auth b/profiles/nis/fingerprint-auth
-index 756993cf1b2095f505208df19dd739dcaed1af31..eebec6d0d6edeae6a3eb224f0ff284016b0fc642 100644
---- a/profiles/nis/fingerprint-auth
-+++ b/profiles/nis/fingerprint-auth
-@@ -13,7 +13,6 @@ password required pam_deny.so
-
- session optional pam_keyinit.so revoke
- session required pam_limits.so
--session optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"}
- -session optional pam_systemd.so
- session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"}
- session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
-diff --git a/profiles/nis/password-auth b/profiles/nis/password-auth
-index 7997ea8de61ad6392ed01c39727f70253b5cc0ca..9a8ae9cde644a4ac981f4b9553af2f0f428bfebb 100644
---- a/profiles/nis/password-auth
-+++ b/profiles/nis/password-auth
-@@ -17,7 +17,6 @@ password required pam_deny.so
-
- session optional pam_keyinit.so revoke
- session required pam_limits.so
--session optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"}
- -session optional pam_systemd.so
- session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"}
- session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
-diff --git a/profiles/nis/postlogin b/profiles/nis/postlogin
-index 137cd00dc65ee9ea83123f1d3a6f7ba04f0aea04..04a11f049bc1e220c9064fba7b46eb243ddd4996 100644
---- a/profiles/nis/postlogin
-+++ b/profiles/nis/postlogin
-@@ -1,7 +1,3 @@
--auth optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"}
--
--password optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"}
--
- session optional pam_umask.so silent
- session [success=1 default=ignore] pam_succeed_if.so service !~ gdm* service !~ su* quiet
- session [default=1] pam_lastlog.so nowtmp {if "with-silent-lastlog":silent|showfailed}
-diff --git a/profiles/nis/system-auth b/profiles/nis/system-auth
-index 057b31e074f29c46b492fa310a954e281631800e..2e7462983d35e4a2f5cef8151ed53baaf7e5c790 100644
---- a/profiles/nis/system-auth
-+++ b/profiles/nis/system-auth
-@@ -18,7 +18,6 @@ password required pam_deny.so
-
- session optional pam_keyinit.so revoke
- session required pam_limits.so
--session optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"}
- -session optional pam_systemd.so
- session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"}
- session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
-diff --git a/profiles/sssd/README b/profiles/sssd/README
-index 95ef5dc785ed0530122837b5e08d03590ed1ada5..ac063e8d065d0488279dc2381bdd7f8ac361bfcb 100644
---- a/profiles/sssd/README
-+++ b/profiles/sssd/README
-@@ -40,9 +40,6 @@ with-mkhomedir::
- Enable automatic creation of home directories for users on their
- first login.
-
--with-ecryptfs::
-- Enable automatic per-user ecryptfs.
--
- with-smartcard::
- Enable authentication with smartcards through SSSD. Please note that
- smartcard support must be also explicitly enabled within
-diff --git a/profiles/sssd/fingerprint-auth b/profiles/sssd/fingerprint-auth
-index fe3cac7a976845017d034ac1158a38f889926ce8..ad0a95440ebd006ff88264177598c77afc472dda 100644
---- a/profiles/sssd/fingerprint-auth
-+++ b/profiles/sssd/fingerprint-auth
-@@ -18,7 +18,6 @@ password required pam_deny.so
-
- session optional pam_keyinit.so revoke
- session required pam_limits.so
--session optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"}
- -session optional pam_systemd.so
- session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"}
- session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
-diff --git a/profiles/sssd/password-auth b/profiles/sssd/password-auth
-index d6953428cca7d6518f63c3fdbaabc4746c35f91b..6d87cbe0a805bf5d3ab2a6192d570b9e5c6dc143 100644
---- a/profiles/sssd/password-auth
-+++ b/profiles/sssd/password-auth
-@@ -27,7 +27,6 @@ password required pam_deny.so
-
- session optional pam_keyinit.so revoke
- session required pam_limits.so
--session optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"}
- -session optional pam_systemd.so
- session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"}
- session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
-diff --git a/profiles/sssd/postlogin b/profiles/sssd/postlogin
-index 137cd00dc65ee9ea83123f1d3a6f7ba04f0aea04..04a11f049bc1e220c9064fba7b46eb243ddd4996 100644
---- a/profiles/sssd/postlogin
-+++ b/profiles/sssd/postlogin
-@@ -1,7 +1,3 @@
--auth optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"}
--
--password optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"}
--
- session optional pam_umask.so silent
- session [success=1 default=ignore] pam_succeed_if.so service !~ gdm* service !~ su* quiet
- session [default=1] pam_lastlog.so nowtmp {if "with-silent-lastlog":silent|showfailed}
-diff --git a/profiles/sssd/smartcard-auth b/profiles/sssd/smartcard-auth
-index 230269c42508a50ad5b4677ab6514b9afe4d5fbf..874ffaca1b2c15c81adc4ca130c15834154bdc0e 100644
---- a/profiles/sssd/smartcard-auth
-+++ b/profiles/sssd/smartcard-auth
-@@ -16,7 +16,6 @@ account required pam_permit.so
-
- session optional pam_keyinit.so revoke
- session required pam_limits.so
--session optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"}
- -session optional pam_systemd.so
- session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"}
- session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
-diff --git a/profiles/sssd/system-auth b/profiles/sssd/system-auth
-index 6f914ea91eb7782d60959ced56112f9cc1365347..dfc53b4ce55a0d575dc4fe68004a846f43360ccc 100644
---- a/profiles/sssd/system-auth
-+++ b/profiles/sssd/system-auth
-@@ -32,7 +32,6 @@ password required pam_deny.so
-
- session optional pam_keyinit.so revoke
- session required pam_limits.so
--session optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"}
- -session optional pam_systemd.so
- session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"}
- session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
-diff --git a/profiles/winbind/README b/profiles/winbind/README
-index 40a1a459355d2ee8ab98e31d2868cb24261e2c17..0e80bb697f8050ac8eb3c78d4f41945b9bcbba29 100644
---- a/profiles/winbind/README
-+++ b/profiles/winbind/README
-@@ -33,9 +33,6 @@ with-mkhomedir::
- Enable automatic creation of home directories for users on their
- first login.
-
--with-ecryptfs::
-- Enable automatic per-user ecryptfs.
--
- with-fingerprint::
- Enable authentication with fingerprint reader through *pam_fprintd*.
-
-diff --git a/profiles/winbind/fingerprint-auth b/profiles/winbind/fingerprint-auth
-index c4b8261ca45d4f6b9eda03ea96850bb32d605d30..6262549af2ca8aed540e7a7e1d97e0ba3b2ef088 100644
---- a/profiles/winbind/fingerprint-auth
-+++ b/profiles/winbind/fingerprint-auth
-@@ -17,7 +17,6 @@ password required pam_deny.so
-
- session optional pam_keyinit.so revoke
- session required pam_limits.so
--session optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"}
- -session optional pam_systemd.so
- session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"}
- session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
-diff --git a/profiles/winbind/password-auth b/profiles/winbind/password-auth
-index bbeca057d49102889e3eeee040ea256dbd751eef..aef4d5ce6a6ec9496deabc1010cde0370a3ecba7 100644
---- a/profiles/winbind/password-auth
-+++ b/profiles/winbind/password-auth
-@@ -24,7 +24,6 @@ password required pam_deny.so
-
- session optional pam_keyinit.so revoke
- session required pam_limits.so
--session optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"}
- -session optional pam_systemd.so
- session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"}
- session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
-diff --git a/profiles/winbind/postlogin b/profiles/winbind/postlogin
-index 137cd00dc65ee9ea83123f1d3a6f7ba04f0aea04..04a11f049bc1e220c9064fba7b46eb243ddd4996 100644
---- a/profiles/winbind/postlogin
-+++ b/profiles/winbind/postlogin
-@@ -1,7 +1,3 @@
--auth optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"}
--
--password optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"}
--
- session optional pam_umask.so silent
- session [success=1 default=ignore] pam_succeed_if.so service !~ gdm* service !~ su* quiet
- session [default=1] pam_lastlog.so nowtmp {if "with-silent-lastlog":silent|showfailed}
-diff --git a/profiles/winbind/system-auth b/profiles/winbind/system-auth
-index 8e6026b782f8bd7e64632a9acedf304bd95f29e1..e4bdd0bf1c315c86cc8064625b80161baa5c455f 100644
---- a/profiles/winbind/system-auth
-+++ b/profiles/winbind/system-auth
-@@ -25,7 +25,6 @@ password required pam_deny.so
-
- session optional pam_keyinit.so revoke
- session required pam_limits.so
--session optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"}
- -session optional pam_systemd.so
- session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"}
- session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
-diff --git a/src/compat/authcompat.py.in.in b/src/compat/authcompat.py.in.in
-index e4b8c05c6a11a215529ba66f8b36b72a6ac18448..4e39b7ec66d0e2ba911c7280467ba78fd29c196c 100755
---- a/src/compat/authcompat.py.in.in
-+++ b/src/compat/authcompat.py.in.in
-@@ -520,7 +520,6 @@ class AuthCompat:
- 'smartcard' : 'with-smartcard',
- 'requiresmartcard' : 'with-smartcard-required',
- 'fingerprint' : 'with-fingerprint',
-- 'ecryptfs' : 'with-ecryptfs',
- 'mkhomedir' : 'with-mkhomedir',
- 'faillock' : 'with-faillock',
- 'pamaccess' : 'with-pamaccess',
-diff --git a/src/compat/authcompat_Options.py b/src/compat/authcompat_Options.py
-index c8f52ab6773c4cd5371f32121dba8053f3443261..433a3340bac29739174e78928701214c08ec6f3c 100644
---- a/src/compat/authcompat_Options.py
-+++ b/src/compat/authcompat_Options.py
-@@ -93,7 +93,6 @@ class Options:
- Option.Valued ("smartcardaction", _("<0=Lock|1=Ignore>"), _("action to be taken on smart card removal")),
- Option.Feature("requiresmartcard",_("require smart card for authentication by default")),
- Option.Feature("fingerprint", _("authentication with fingerprint readers by default")),
-- Option.Feature("ecryptfs", _("automatic per-user ecryptfs")),
- Option.Feature("krb5", _("Kerberos authentication by default")),
- Option.Valued ("krb5kdc", _("<server>"), _("default Kerberos KDC")),
- Option.Valued ("krb5adminserver", _("<server>"), _("default Kerberos admin server")),
-@@ -141,6 +140,7 @@ class Options:
- # layers and will produce warning when used. They will not affect
- # the system.
- Option.UnsupportedFeature("cache"),
-+ Option.UnsupportedFeature("ecryptfs"),
- Option.UnsupportedFeature("shadow"),
- Option.UnsupportedSwitch ("useshadow"),
- Option.UnsupportedFeature("md5"),
-diff --git a/src/man/authselect-migration.7.adoc b/src/man/authselect-migration.7.adoc
-index 35ba484d576ab8a3d923a124f6b1577085deedd4..a27af036738274d8d392f7fe1f7d59c89e9c4ffb 100644
---- a/src/man/authselect-migration.7.adoc
-+++ b/src/man/authselect-migration.7.adoc
-@@ -80,7 +80,6 @@ configuration file for required services.
- |*Authconfig options* |*Authselect profile feature*
- |--enablesmartcard |with-smartcard
- |--enablefingerprint |with-fingerprint
--|--enableecryptfs |with-ecryptfs
- |--enablemkhomedir |with-mkhomedir
- |--enablefaillock |with-faillock
- |--enablepamaccess |with-pamaccess
-@@ -95,8 +94,8 @@ authselect select sssd with-faillock
- authconfig --enablesssd --enablesssdauth --enablesmartcard --smartcardmodule=sssd --updateall
- authselect select sssd with-smartcard
-
--authconfig --enableecryptfs --enablepamaccess --updateall
--authselect select sssd with-ecryptfs with-pamaccess
-+authconfig --enablepamaccess --updateall
-+authselect select sssd with-pamaccess
-
- authconfig --enablewinbind --enablewinbindauth --winbindjoin=Administrator --updateall
- realm join -U Administrator --client-software=winbind WINBINDDOMAIN
---
-2.29.2
-
diff --git a/SOURCES/9003-rhel9-sssd-default-to-files-first-for-users-and-grou.patch b/SOURCES/9003-rhel9-sssd-default-to-files-first-for-users-and-grou.patch
deleted file mode 100644
index 1d8c8fa..0000000
--- a/SOURCES/9003-rhel9-sssd-default-to-files-first-for-users-and-grou.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-From 9fc2d8061c811c4522484f4cb62a2025fe9282b2 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>
-Date: Thu, 18 Feb 2021 13:38:53 +0100
-Subject: [PATCH 3/3] rhel9: sssd: default to files first for users and groups
-
-The passwd and group databases will now default to files first.
-The order "sss files" can be enabled with "with-files-provider"
-feature.
----
- profiles/sssd/README | 5 +++++
- profiles/sssd/REQUIREMENTS | 4 ++++
- profiles/sssd/nsswitch.conf | 4 ++--
- 3 files changed, 11 insertions(+), 2 deletions(-)
-
-diff --git a/profiles/sssd/README b/profiles/sssd/README
-index ac063e8d065d0488279dc2381bdd7f8ac361bfcb..699d490b90710a53c3959f196b9ef435149a4bd0 100644
---- a/profiles/sssd/README
-+++ b/profiles/sssd/README
-@@ -76,6 +76,11 @@ with-sudo::
- with-pamaccess::
- Check access.conf during account authorization.
-
-+with-files-domain::
-+ If set, SSSD will be contacted before "files" when resolving users and
-+ groups. The order in nsswitch.conf will be set to "sss files" instead of
-+ "files sss" for passwd and group maps.
-+
- with-files-access-provider::
- If set, account management for local users is handled also by pam_sss. This
- is needed if there is an explicitly configured domain with id_provider=files
-diff --git a/profiles/sssd/REQUIREMENTS b/profiles/sssd/REQUIREMENTS
-index cbffac54bbd2598c2a53cd3014ebeb271dad9c57..ba3b3bd0fa143c3cc74d00faaf6ff94a2b4aaf84 100644
---- a/profiles/sssd/REQUIREMENTS
-+++ b/profiles/sssd/REQUIREMENTS
-@@ -14,3 +14,7 @@ Make sure that SSSD service is configured and enabled. See SSSD documentation fo
- - with-mkhomedir is selected, make sure pam_oddjob_mkhomedir module {include if "with-mkhomedir"}
- is present and oddjobd service is enabled and active {include if "with-mkhomedir"}
- - systemctl enable --now oddjobd.service {include if "with-mkhomedir"}
-+ {include if "with-files-domain"}
-+- with-files-domain is selected, make sure the files provider is enabled in SSSD {include if "with-files-domain"}
-+ - set enable_files_domain=true in [sssd] section of /etc/sssd/sssd.conf {include if "with-files-domain"}
-+ - or create a custom domain with id_provider=files {include if "with-files-domain"}
-\ No newline at end of file
-diff --git a/profiles/sssd/nsswitch.conf b/profiles/sssd/nsswitch.conf
-index 9734bbbe68e7cf73a4a560e3573162d353e551e8..91c9fe9ef60fde07d55269247c885db0f738c776 100644
---- a/profiles/sssd/nsswitch.conf
-+++ b/profiles/sssd/nsswitch.conf
-@@ -1,5 +1,5 @@
--passwd: sss files systemd {exclude if "with-custom-passwd"}
--group: sss files systemd {exclude if "with-custom-group"}
-+passwd: {if "with-files-domain":sss files|files sss} systemd {exclude if "with-custom-passwd"}
-+group: {if "with-files-domain":sss files|files sss} systemd {exclude if "with-custom-group"}
- netgroup: sss files {exclude if "with-custom-netgroup"}
- automount: sss files {exclude if "with-custom-automount"}
- services: sss files {exclude if "with-custom-services"}
---
-2.29.2
-
diff --git a/SOURCES/9004-rhel9-remove-support-for-for-resolved.patch b/SOURCES/9004-rhel9-remove-support-for-for-resolved.patch
deleted file mode 100644
index a009f8d..0000000
--- a/SOURCES/9004-rhel9-remove-support-for-for-resolved.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From 259e4e50a97a5196436e3d7ed42d2ecf0be3203f Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>
-Date: Mon, 31 May 2021 15:42:49 +0200
-Subject: [PATCH] rhel9: remove support for for resolved
-
-systemd-resolved is an experimental feature at this point and it
-should not be enabled by default. Steps to switch this feature on
-will be documented in RHEL guide.
-
-This reverts commit c5294c508a940291440eb32d5d750f33baf1ae54.
----
- profiles/minimal/nsswitch.conf | 2 +-
- profiles/nis/nsswitch.conf | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/profiles/minimal/nsswitch.conf b/profiles/minimal/nsswitch.conf
-index a9e4bc79a1090304542ccd8b43d1107eeb5304df..a39e4d32ebf79e8bf05f2db5753b01596222dc35 100644
---- a/profiles/minimal/nsswitch.conf
-+++ b/profiles/minimal/nsswitch.conf
-@@ -2,7 +2,7 @@ aliases: files {exclude if "with-custom
- automount: files {exclude if "with-custom-automount"}
- ethers: files {exclude if "with-custom-ethers"}
- group: files {if "with-altfiles":altfiles }systemd {exclude if "with-custom-group"}
--hosts: resolve [!UNAVAIL=return] files myhostname dns {exclude if "with-custom-hosts"}
-+hosts: files dns myhostname {exclude if "with-custom-hosts"}
- initgroups: files {exclude if "with-custom-initgroups"}
- netgroup: files {exclude if "with-custom-netgroup"}
- networks: files {exclude if "with-custom-networks"}
-diff --git a/profiles/nis/nsswitch.conf b/profiles/nis/nsswitch.conf
-index 50a3ffb7431a91b88b4bfef4c09df19310fac7e7..9bee7d839f84ff39d54cb6ead9dea38e51736b4d 100644
---- a/profiles/nis/nsswitch.conf
-+++ b/profiles/nis/nsswitch.conf
-@@ -2,7 +2,7 @@ aliases: files nis {exclude if "with-custom-aliases"}
- automount: files nis {exclude if "with-custom-automount"}
- ethers: files nis {exclude if "with-custom-ethers"}
- group: files nis systemd {exclude if "with-custom-group"}
--hosts: resolve [!UNAVAIL=return] files nis myhostname dns {exclude if "with-custom-hosts"}
-+hosts: files nis dns myhostname {exclude if "with-custom-hosts"}
- initgroups: files nis {exclude if "with-custom-initgroups"}
- netgroup: files nis {exclude if "with-custom-netgroup"}
- networks: files nis {exclude if "with-custom-networks"}
---
-2.31.1
-
diff --git a/SOURCES/9005-rhel9-remove-nis-support.patch b/SOURCES/9005-rhel9-remove-nis-support.patch
deleted file mode 100644
index 6fe3cdb..0000000
--- a/SOURCES/9005-rhel9-remove-nis-support.patch
+++ /dev/null
@@ -1,435 +0,0 @@
-From 7236f7a303215805de7195a8fdef7567543e8b0b Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>
-Date: Wed, 9 Jun 2021 13:59:01 +0200
-Subject: [PATCH] rhel9: remove nis support
-
-NIS is no longer supported in RHEL9.
----
- profiles/Makefile.am | 13 ----
- profiles/nis/README | 111 ----------------------------
- profiles/nis/REQUIREMENTS | 13 ----
- profiles/nis/dconf-db | 3 -
- profiles/nis/dconf-locks | 2 -
- profiles/nis/nsswitch.conf | 14 ----
- profiles/nis/postlogin | 4 -
- rpm/authselect.spec.in | 10 ---
- src/compat/authcompat.py.in.in | 95 ------------------------
- src/compat/authcompat_Options.py | 8 +-
- src/man/authselect-migration.7.adoc | 2 +-
- 11 files changed, 6 insertions(+), 269 deletions(-)
- delete mode 100644 profiles/nis/README
- delete mode 100644 profiles/nis/REQUIREMENTS
- delete mode 100644 profiles/nis/dconf-db
- delete mode 100644 profiles/nis/dconf-locks
- delete mode 100644 profiles/nis/nsswitch.conf
- delete mode 100644 profiles/nis/postlogin
-
-diff --git a/profiles/Makefile.am b/profiles/Makefile.am
-index 95e27147b2b0a229a76a293884d605484d3fa841..c658521de01130f19f669fe0a6cb86c11043a406 100644
---- a/profiles/Makefile.am
-+++ b/profiles/Makefile.am
-@@ -13,19 +13,6 @@ dist_profile_minimal_DATA = \
- $(top_srcdir)/profiles/minimal/dconf-locks \
- $(NULL)
-
--profile_nisdir = $(authselect_profile_dir)/nis
--dist_profile_nis_DATA = \
-- $(top_srcdir)/profiles/nis/nsswitch.conf \
-- $(top_srcdir)/profiles/nis/password-auth \
-- $(top_srcdir)/profiles/nis/postlogin \
-- $(top_srcdir)/profiles/nis/README \
-- $(top_srcdir)/profiles/nis/REQUIREMENTS \
-- $(top_srcdir)/profiles/nis/system-auth \
-- $(top_srcdir)/profiles/nis/fingerprint-auth \
-- $(top_srcdir)/profiles/nis/dconf-db \
-- $(top_srcdir)/profiles/nis/dconf-locks \
-- $(NULL)
--
- profile_sssddir = $(authselect_profile_dir)/sssd
- dist_profile_sssd_DATA = \
- $(top_srcdir)/profiles/sssd/nsswitch.conf \
-diff --git a/profiles/nis/README b/profiles/nis/README
-deleted file mode 100644
-index cac3428bf844b0a9d251015988583f4c1b15c3c9..0000000000000000000000000000000000000000
---- a/profiles/nis/README
-+++ /dev/null
-@@ -1,111 +0,0 @@
--Enable NIS for system authentication
--====================================
--
--Selecting this profile will enable Network Information Services as the source
--of identity and authentication providers.
--
--NIS CONFIGURATION
-------------------
--
--Authselect does not touch NIS configuration. Please, read NIS' documentation
--to see how to configure it manually.
--
--AVAILABLE OPTIONAL FEATURES
-----------------------------
--
--with-faillock::
-- Enable account locking in case of too many consecutive
-- authentication failures.
--
--with-mkhomedir::
-- Enable automatic creation of home directories for users on their
-- first login.
--
--with-fingerprint::
-- Enable authentication with fingerprint reader through *pam_fprintd*.
--
--with-pam-u2f::
-- Enable authentication via u2f dongle through *pam_u2f*.
--
--with-pam-u2f-2fa::
-- Enable 2nd factor authentication via u2f dongle through *pam_u2f*.
--
--without-pam-u2f-nouserok::
-- Module argument nouserok is omitted if also with-pam-u2f-2fa is used.
-- *WARNING*: Omitting nouserok argument means that users without pam-u2f
-- authentication configured will not be able to log in *INCLUDING* root.
-- Make sure you are able to log in before losing root privileges.
--
--with-silent-lastlog::
-- Do not produce pam_lastlog message during login.
--
--with-pamaccess::
-- Check access.conf during account authorization.
--
--with-nispwquality::
-- If this option is set pam_pwquality module will check password quality
-- for NIS users as well as local users during password change. Without this
-- option only local users passwords are checked.
--
--without-nullok::
-- Do not add nullok parameter to pam_unix.
--
--DISABLE SPECIFIC NSSWITCH DATABASES
-------------------------------------
--
--Normally, nsswitch databases set by the profile overwrites values set in
--user-nsswitch.conf. The following options can force authselect to
--ignore value set by the profile and use the one set in user-nsswitch.conf
--instead.
--
--with-custom-aliases::
--Ignore "aliases" map set by the profile.
--
--with-custom-automount::
--Ignore "automount" map set by the profile.
--
--with-custom-ethers::
--Ignore "ethers" map set by the profile.
--
--with-custom-group::
--Ignore "group" map set by the profile.
--
--with-custom-hosts::
--Ignore "hosts" map set by the profile.
--
--with-custom-initgroups::
--Ignore "initgroups" map set by the profile.
--
--with-custom-netgroup::
--Ignore "netgroup" map set by the profile.
--
--with-custom-networks::
--Ignore "networks" map set by the profile.
--
--with-custom-passwd::
--Ignore "passwd" map set by the profile.
--
--with-custom-protocols::
--Ignore "protocols" map set by the profile.
--
--with-custom-publickey::
--Ignore "publickey" map set by the profile.
--
--with-custom-rpc::
--Ignore "rpc" map set by the profile.
--
--with-custom-services::
--Ignore "services" map set by the profile.
--
--with-custom-shadow::
--Ignore "shadow" map set by the profile.
--
--EXAMPLES
----------
--* Enable NIS with no additional modules
--
-- authselect select nis
--
--* Enable NIS and create home directories for users on their first login
--
-- authselect select nis with-mkhomedir
-diff --git a/profiles/nis/REQUIREMENTS b/profiles/nis/REQUIREMENTS
-deleted file mode 100644
-index c58aa2789f4ef064b7904cacf4fc3158dce7ad41..0000000000000000000000000000000000000000
---- a/profiles/nis/REQUIREMENTS
-+++ /dev/null
-@@ -1,13 +0,0 @@
--Make sure that NIS service is configured and enabled. See NIS documentation for more information.
-- {include if "with-fingerprint"}
--- with-fingerprint is selected, make sure fprintd service is configured and enabled {include if "with-fingerprint"}
-- {include if "with-pam-u2f"}
--- with-pam-u2f is selected, make sure that the pam u2f module is installed {include if "with-pam-u2f"}
-- - users can then configure keys using the pamu2fcfg tool {include if "with-pam-u2f"}
-- {include if "with-pam-u2f-2fa"}
--- with-pam-u2f-2fa is selected, make sure that the pam u2f module is installed {include if "with-pam-u2f-2fa"}
-- - users can then configure keys using the pamu2fcfg tool {include if "with-pam-u2f-2fa"}
-- {include if "with-mkhomedir"}
--- with-mkhomedir is selected, make sure pam_oddjob_mkhomedir module {include if "with-mkhomedir"}
-- is present and oddjobd service is enabled and active {include if "with-mkhomedir"}
-- - systemctl enable --now oddjobd.service {include if "with-mkhomedir"}
-diff --git a/profiles/nis/dconf-db b/profiles/nis/dconf-db
-deleted file mode 100644
-index bd32b2819f66acdc75ab0fc522ec85673d10ed72..0000000000000000000000000000000000000000
---- a/profiles/nis/dconf-db
-+++ /dev/null
-@@ -1,3 +0,0 @@
--[org/gnome/login-screen]
--enable-smartcard-authentication=false
--enable-fingerprint-authentication={if "with-fingerprint":true|false}
-diff --git a/profiles/nis/dconf-locks b/profiles/nis/dconf-locks
-deleted file mode 100644
-index 8a36fa9568344338272786394aece872185d0ab3..0000000000000000000000000000000000000000
---- a/profiles/nis/dconf-locks
-+++ /dev/null
-@@ -1,2 +0,0 @@
--/org/gnome/login-screen/enable-smartcard-authentication
--/org/gnome/login-screen/enable-fingerprint-authentication
-diff --git a/profiles/nis/nsswitch.conf b/profiles/nis/nsswitch.conf
-deleted file mode 100644
-index 9bee7d839f84ff39d54cb6ead9dea38e51736b4d..0000000000000000000000000000000000000000
---- a/profiles/nis/nsswitch.conf
-+++ /dev/null
-@@ -1,14 +0,0 @@
--aliases: files nis {exclude if "with-custom-aliases"}
--automount: files nis {exclude if "with-custom-automount"}
--ethers: files nis {exclude if "with-custom-ethers"}
--group: files nis systemd {exclude if "with-custom-group"}
--hosts: files nis dns myhostname {exclude if "with-custom-hosts"}
--initgroups: files nis {exclude if "with-custom-initgroups"}
--netgroup: files nis {exclude if "with-custom-netgroup"}
--networks: files nis {exclude if "with-custom-networks"}
--passwd: files nis systemd {exclude if "with-custom-passwd"}
--protocols: files nis {exclude if "with-custom-protocols"}
--publickey: files nis {exclude if "with-custom-publickey"}
--rpc: files nis {exclude if "with-custom-rpc"}
--services: files nis {exclude if "with-custom-services"}
--shadow: files nis {exclude if "with-custom-shadow"}
-diff --git a/profiles/nis/postlogin b/profiles/nis/postlogin
-deleted file mode 100644
-index 04a11f049bc1e220c9064fba7b46eb243ddd4996..0000000000000000000000000000000000000000
---- a/profiles/nis/postlogin
-+++ /dev/null
-@@ -1,4 +0,0 @@
--session optional pam_umask.so silent
--session [success=1 default=ignore] pam_succeed_if.so service !~ gdm* service !~ su* quiet
--session [default=1] pam_lastlog.so nowtmp {if "with-silent-lastlog":silent|showfailed}
--session optional pam_lastlog.so silent noupdate showfailed
-diff --git a/rpm/authselect.spec.in b/rpm/authselect.spec.in
-index 628d6c91e9b3b4448787915fc1f9ac42f445bfc6..a0d508a716603771878781a62168fe0a71207f66 100644
---- a/rpm/authselect.spec.in
-+++ b/rpm/authselect.spec.in
-@@ -155,7 +155,6 @@ find $RPM_BUILD_ROOT -name "*.a" -exec %__rm -f {} \;
- %dir %{_datadir}/authselect/vendor
- %dir %{_datadir}/authselect/default
- %dir %{_datadir}/authselect/default/minimal/
--%dir %{_datadir}/authselect/default/nis/
- %dir %{_datadir}/authselect/default/sssd/
- %dir %{_datadir}/authselect/default/winbind/
- %{_datadir}/authselect/default/minimal/nsswitch.conf
-@@ -164,15 +163,6 @@ find $RPM_BUILD_ROOT -name "*.a" -exec %__rm -f {} \;
- %{_datadir}/authselect/default/minimal/README
- %{_datadir}/authselect/default/minimal/REQUIREMENTS
- %{_datadir}/authselect/default/minimal/system-auth
--%{_datadir}/authselect/default/nis/dconf-db
--%{_datadir}/authselect/default/nis/dconf-locks
--%{_datadir}/authselect/default/nis/fingerprint-auth
--%{_datadir}/authselect/default/nis/nsswitch.conf
--%{_datadir}/authselect/default/nis/password-auth
--%{_datadir}/authselect/default/nis/postlogin
--%{_datadir}/authselect/default/nis/README
--%{_datadir}/authselect/default/nis/REQUIREMENTS
--%{_datadir}/authselect/default/nis/system-auth
- %{_datadir}/authselect/default/sssd/dconf-db
- %{_datadir}/authselect/default/sssd/dconf-locks
- %{_datadir}/authselect/default/sssd/fingerprint-auth
-diff --git a/src/compat/authcompat.py.in.in b/src/compat/authcompat.py.in.in
-index 4e39b7ec66d0e2ba911c7280467ba78fd29c196c..7c0fdf341212250f03dc14ddf6680e90da8e217e 100755
---- a/src/compat/authcompat.py.in.in
-+++ b/src/compat/authcompat.py.in.in
-@@ -240,20 +240,6 @@ class Configuration:
-
- config.write(keys)
-
-- class Network(Base):
-- def __init__(self, options):
-- super(Configuration.Network, self).__init__(options)
--
-- def write(self):
-- nisdomain = self.get("nisdomain")
-- config = EnvironmentFile(Path.System('network'))
--
-- if nisdomain is None:
-- return
--
-- config.set("NISDOMAIN", nisdomain)
-- config.write()
--
- class SSSD(Base):
- def __init__(self, options):
- super(Configuration.SSSD, self).__init__(options, ServiceName="sssd")
-@@ -375,83 +361,6 @@ class Configuration:
- # other applications may depend on it.
- return
-
-- class NIS(Base):
-- def __init__(self, options):
-- super(Configuration.NIS, self).__init__(options)
-- self.rpcbind = Service("rpcbind")
-- self.ypbind = Service("ypbind")
--
-- def isEnabled(self):
-- if not self.isset("nis"):
-- return None
--
-- return self.getBool("nis")
--
-- def enableService(self, nostart):
-- if not self.isset("nisdomain"):
-- return
--
-- nisdom = self.get("nisdomain")
--
-- if not nostart:
-- cmd = Command(Path.System('cmd-domainname'), [nisdom])
-- cmd.run()
--
-- cmd = Command(Path.System('cmd-setsebool'),
-- ['-P', 'allow_ypbind', '1'])
-- cmd.run()
--
-- self.rpcbind.enable()
-- self.ypbind.enable()
--
-- if not nostart:
-- self.rpcbind.start(Restart=False)
-- self.ypbind.start()
--
-- def disableService(self, nostop):
-- if not nostop:
-- cmd = Command(Path.System('cmd-domainname'), ["(none)"])
-- cmd.run()
--
-- cmd = Command(Path.System('cmd-setsebool'),
-- ['-P', 'allow_ypbind', '0'])
-- cmd.run()
--
-- self.rpcbind.disable()
-- self.ypbind.disable()
--
-- if not nostop:
-- self.rpcbind.stop()
-- self.ypbind.stop()
--
-- def write(self):
-- if not self.isset("nisdomain"):
-- return
--
-- output = "domain " + self.get("nisdomain")
--
-- additional_servers = []
-- if self.isset("nisserver"):
-- servers = self.get("nisserver").split(",")
-- additional_servers = servers[1:]
-- output += " server " + servers[0] + "\n"
-- else:
-- output += " broadcast\n"
--
-- for server in additional_servers:
-- output += "ypserver " + server + "\n"
--
-- filename = Path.System('yp.conf')
-- if self.getBool("test-call"):
-- print("========== BEGIN Content of [%s] ==========" % filename)
-- print(output)
-- print("========== END Content of [%s] ==========\n" % filename)
-- return
--
-- with open(filename, "w") as f:
-- f.write(output)
--
--
- class AuthCompat:
- def __init__(self):
- self.sysconfig = EnvironmentFile(Path.System('authconfig'))
-@@ -533,8 +442,6 @@ class AuthCompat:
- if (self.options.getBool("ldap") or self.options.getBool("ldapauth") or
- self.options.getBool("sssd") or self.options.getBool("sssdauth")):
- profile = "sssd"
-- elif self.options.getBool("nis"):
-- profile = "nis"
- elif self.options.getBool("winbind"):
- profile = "winbind"
-
-@@ -591,13 +498,11 @@ class AuthCompat:
- def writeConfiguration(self):
- configs = [
- Configuration.LDAP(self.options),
-- Configuration.Network(self.options),
- Configuration.Kerberos(self.options),
- Configuration.SSSD(self.options),
- Configuration.Winbind(self.options),
- Configuration.PWQuality(self.options),
- Configuration.MakeHomedir(self.options),
-- Configuration.NIS(self.options)
- ]
-
- for config in configs:
-diff --git a/src/compat/authcompat_Options.py b/src/compat/authcompat_Options.py
-index 433a3340bac29739174e78928701214c08ec6f3c..2712d85a377ee92c7816e3d2284302307084b0c4 100644
---- a/src/compat/authcompat_Options.py
-+++ b/src/compat/authcompat_Options.py
-@@ -79,9 +79,6 @@ class Options:
- # However, they will just make sure that an authentication against
- # expected service is working. They may not result in the exact same
- # configuration as authconfig would generate.
-- Option.Feature("nis", _("NIS for user information by default")),
-- Option.Valued ("nisdomain", _("<domain>"), _("default NIS domain")),
-- Option.Valued ("nisserver", _("<server>"), _("default NIS server")),
- Option.Feature("ldap", _("LDAP for user information by default")),
- Option.Feature("ldapauth", _("LDAP for authentication by default")),
- Option.Valued ("ldapserver", _("<server>"), _("default LDAP server hostname or URI")),
-@@ -164,6 +161,11 @@ class Options:
- Option.UnsupportedFeature("locauthorize"),
- Option.UnsupportedFeature("sysnetauth"),
- Option.UnsupportedValued ("faillockargs", _("<options>")),
-+
-+ # NIS is no longer supported
-+ Option.UnsupportedFeature("nis"),
-+ Option.UnsupportedValued ("nisdomain", _("<domain>")),
-+ Option.UnsupportedValued ("nisserver", _("<server>")),
- ]
-
- Map = {
-diff --git a/src/man/authselect-migration.7.adoc b/src/man/authselect-migration.7.adoc
-index a27af036738274d8d392f7fe1f7d59c89e9c4ffb..515104b160d956d04b9ec8cacd25d166983e02d5 100644
---- a/src/man/authselect-migration.7.adoc
-+++ b/src/man/authselect-migration.7.adoc
-@@ -72,7 +72,7 @@ configuration file for required services.
- |--enablesssd --enablesssdauth |sssd
- |--enablekrb5 |sssd
- |--enablewinbind --enablewinbindauth |winbind
--|--enablenis |nis
-+|--enablenis |none
- |=========================================================
-
- .Relation of authconfig options to authselect profile features
---
-2.20.1
-
diff --git a/SPECS/authselect.spec b/SPECS/authselect.spec
index 9c7ecbb..6ed5ad2 100644
--- a/SPECS/authselect.spec
+++ b/SPECS/authselect.spec
@@ -2,24 +2,19 @@
%define _empty_manifest_terminate_build 0
Name: authselect
-Version: 1.2.3
-Release: 7%{?dist}
+Version: 1.2.5
+Release: 1%{?dist}
Summary: Configures authentication and identity sources from supported profiles
URL: https://github.com/authselect/authselect
License: GPLv3+
Source0: %{url}/archive/%{version}/%{name}-%{version}.tar.gz
-Patch0001: 0001-lib-avoid-freeing-uninitialized-variable-in-authsele.patch
-
### Downstream Patches ###
-%if 0%{?rhel}
-Patch9001: 9001-rhel9-remove-mention-of-Fedora-Change-page-in-compat.patch
-Patch9002: 9002-rhel9-remove-ecryptfs-support.patch
-Patch9003: 9003-rhel9-sssd-default-to-files-first-for-users-and-grou.patch
-Patch9004: 9004-rhel9-remove-support-for-for-resolved.patch
-Patch0005: 9005-rhel9-remove-nis-support.patch
-%endif
+Patch0901: 0901-rhel9-remove-mention-of-Fedora-Change-page-in-compat.patch
+Patch0902: 0902-rhel9-remove-ecryptfs-support.patch
+Patch0903: 0903-rhel9-Revert-profiles-add-support-for-resolved.patch
+Patch0904: 0904-rhel9-remove-nis-support.patch
%global makedir %{_builddir}/%{name}-%{version}
@@ -36,6 +31,7 @@ BuildRequires: po4a
BuildRequires: %{_bindir}/a2x
BuildRequires: libcmocka-devel >= 1.0.0
BuildRequires: libselinux-devel
+BuildRequires: python3-devel
Requires: authselect-libs%{?_isa} = %{version}-%{release}
Suggests: sssd
Suggests: samba-winbind
@@ -70,8 +66,6 @@ command line tool and any other potential front-ends.
Summary: Tool to provide minimum backwards compatibility with authconfig
Obsoletes: authconfig < 7.0.1-6
Provides: authconfig
-BuildRequires: python3-devel
-BuildRequires: make
Requires: authselect%{?_isa} = %{version}-%{release}
Recommends: oddjob-mkhomedir
Suggests: sssd
@@ -104,7 +98,7 @@ done
%build
autoreconf -if
-%configure --with-pythonbin="%{__python3}"
+%configure --with-pythonbin="%{__python3}" --with-compat
%make_build
%check
@@ -160,11 +154,13 @@ find $RPM_BUILD_ROOT -name "*.a" -exec %__rm -f {} \;
%dir %{_datadir}/authselect/default/winbind/
%{_datadir}/authselect/default/minimal/dconf-db
%{_datadir}/authselect/default/minimal/dconf-locks
+%{_datadir}/authselect/default/minimal/fingerprint-auth
%{_datadir}/authselect/default/minimal/nsswitch.conf
%{_datadir}/authselect/default/minimal/password-auth
%{_datadir}/authselect/default/minimal/postlogin
%{_datadir}/authselect/default/minimal/README
%{_datadir}/authselect/default/minimal/REQUIREMENTS
+%{_datadir}/authselect/default/minimal/smartcard-auth
%{_datadir}/authselect/default/minimal/system-auth
%{_datadir}/authselect/default/sssd/dconf-db
%{_datadir}/authselect/default/sssd/dconf-locks
@@ -184,6 +180,7 @@ find $RPM_BUILD_ROOT -name "*.a" -exec %__rm -f {} \;
%{_datadir}/authselect/default/winbind/postlogin
%{_datadir}/authselect/default/winbind/README
%{_datadir}/authselect/default/winbind/REQUIREMENTS
+%{_datadir}/authselect/default/winbind/smartcard-auth
%{_datadir}/authselect/default/winbind/system-auth
%{_libdir}/libauthselect.so.*
%{_mandir}/man5/authselect-profiles.5*
@@ -293,6 +290,12 @@ exit 0
exit 0
%changelog
+* Thu May 5 2022 Pavel Březina <pbrezina@redhat.com> - 1.2.5-1
+- Rebase to 1.2.5 (RHBZ #2080239)
+- backup-restore now works correctly (RHBZ #2070541)
+- add with-subid to sssd profile (RHBZ #2075192)
+- add with-gssapi to sssd profile (RHBZ #2077893)
+
* Thu Aug 26 2021 Pavel Březina <pbrezina@redhat.com> - 1.2.3-7
- Avoid freeing uninitialized variable in authselect_apply_changes (rhbz#1970871)