%global pam_redhat_version 1.1.4

Summary: An extensible library which provides authentication for applications

Name: pam

Version: 1.5.1

Release: 9%{?dist}

# The library is BSD licensed with option to relicense as GPLv2+

# - this option is redundant as the BSD license allows that anyway.

# pam_timestamp, pam_loginuid, and pam_console modules are GPLv2+.

License: BSD and GPLv2+

Source0: https://github.com/linux-pam/linux-pam/releases/download/v%{version}/Linux-PAM-%{version}.tar.xz

Source1: https://github.com/linux-pam/linux-pam/releases/download/v%{version}/Linux-PAM-%{version}.tar.xz.asc

Source2: https://releases.pagure.org/pam-redhat/pam-redhat-%{pam_redhat_version}.tar.bz2

Source5: other.pamd

Source6: system-auth.pamd

Source7: password-auth.pamd

Source8: fingerprint-auth.pamd

Source9: smartcard-auth.pamd

Source10: config-util.pamd

Source11: dlopen.sh

Source12: system-auth.5

Source13: config-util.5

Source15: pamtmp.conf

Source16: postlogin.pamd

Source17: postlogin.5

Source18: https://www.gnu.org/licenses/old-licenses/gpl-2.0.txt

Patch1:  pam-1.5.0-redhat-modules.patch

Patch2:  pam-1.5.0-noflex.patch

Patch3:  pam-1.3.0-unix-nomsg.patch

Patch4:  pam-1.5.1-timestamp-openssl-hmac-authentication.patch

# https://github.com/linux-pam/linux-pam/commit/ec0e724fe53188c5c762c34ca9db6681c0de01b8

Patch5:  pam-1.5.1-pam_filter_close_file_after_controlling_tty.patch

# https://github.com/linux-pam/linux-pam/commit/3234488f2c52a021eec87df1990d256314c21bff

Patch6:  pam-1.5.1-pam-limits-unlimited-value.patch

%global _pamlibdir %{_libdir}

%global _moduledir %{_libdir}/security

%global _secconfdir %{_sysconfdir}/security

%global _pamconfdir %{_sysconfdir}/pam.d

%global _pamvendordir %{_datadir}/pam.d

%global _systemdlibdir /usr/lib/systemd/system

%if %{?WITH_SELINUX:0}%{!?WITH_SELINUX:1}

%global WITH_SELINUX 1

%endif

%if %{?WITH_AUDIT:0}%{!?WITH_AUDIT:1}

%global WITH_AUDIT 1

%endif

%global _performance_build 1

Requires: libpwquality >= 0.9.9

BuildRequires: make

BuildRequires: autoconf >= 2.60

BuildRequires: automake, libtool

BuildRequires: bison, flex, sed

BuildRequires: perl-interpreter, pkgconfig, gettext-devel

BuildRequires: libtirpc-devel

%if %{WITH_AUDIT}

BuildRequires: audit-libs-devel >= 1.0.8

Requires: audit-libs >= 1.0.8

%endif

%if %{WITH_SELINUX}

BuildRequires: libselinux-devel >= 1.33.2

Requires: libselinux >= 1.33.2

%endif

BuildRequires: libeconf-devel >= 0.3.5

Requires: libeconf >= 0.3.5

Requires: glibc >= 2.3.90-37

BuildRequires: libxcrypt-devel >= 4.3.3-2

BuildRequires: libdb-devel

# Following deps are necessary only to build the pam library documentation.

BuildRequires: linuxdoc-tools, elinks, libxslt

BuildRequires: docbook-style-xsl, docbook-dtds

BuildRequires: gcc

BuildRequires: openssl-devel >= 3.0.0

Requires: openssl >= 3.0.0

URL: http://www.linux-pam.org/

%description

PAM (Pluggable Authentication Modules) is a system security tool that

allows system administrators to set authentication policy without

having to recompile programs that handle authentication.

%package devel

Summary: Files needed for developing PAM-aware applications and modules for PAM

Requires: pam%{?_isa} = %{version}-%{release}

%description devel

PAM (Pluggable Authentication Modules) is a system security tool that

allows system administrators to set authentication policy without

having to recompile programs that handle authentication. This package

contains header files used for building both PAM-aware applications

and modules for use with the PAM system.

%package docs

Summary: Extra documentation for PAM.

Requires: pam%{?_isa} = %{version}-%{release}

%description docs

PAM (Pluggable Authentication Modules) is a system security tool that

allows system administrators to set authentication policy without

having to recompile programs that handle authentication. The pam-docs

contains extra documentation for PAM. Currently, this includes additional

documentation in txt and html format.

%prep

%setup -q -n Linux-PAM-%{version} -a 2

perl -pi -e "s/ppc64-\*/ppc64-\* \| ppc64p7-\*/" build-aux/config.sub

perl -pi -e "s/\/lib \/usr\/lib/\/lib \/usr\/lib \/lib64 \/usr\/lib64/" m4/libtool.m4

# Add custom modules.

mv pam-redhat-%{pam_redhat_version}/* modules

cp %{SOURCE18} .

%patch1 -p1 -b .redhat-modules

%patch2 -p1 -b .noflex

%patch3 -p1 -b .nomsg

%patch4 -p1 -b .timestamp-openssl-hmac-authentication

%patch5 -p1 -b .pam_filter_close_file_after_controlling_tty

%patch6 -p1 -b .pam-limits-unlimited-value

autoreconf -i

%build

%configure \

	--disable-rpath \

	--libdir=%{_pamlibdir} \

	--includedir=%{_includedir}/security \

	--enable-vendordir=%{_datadir} \

%if ! %{WITH_SELINUX}

	--disable-selinux \

%endif

%if ! %{WITH_AUDIT}

	--disable-audit \

%endif

	--disable-static \

	--disable-prelude \

	--disable-nis \

	--enable-openssl

make -C po update-gmo

make

# we do not use _smp_mflags because the build of sources in yacc/flex fails

%install

mkdir -p doc/txts

for readme in modules/pam_*/README ; do

	cp -f ${readme} doc/txts/README.`dirname ${readme} | sed -e 's|^modules/||'`

done

# Install the binaries, libraries, and modules.

make install DESTDIR=$RPM_BUILD_ROOT LDCONFIG=:

%if %{WITH_SELINUX}

# Temporary compat link

ln -sf pam_sepermit.so $RPM_BUILD_ROOT%{_moduledir}/pam_selinux_permit.so

%endif

# RPM uses docs from source tree

rm -rf $RPM_BUILD_ROOT%{_datadir}/doc/Linux-PAM

# Included in setup package

rm -f $RPM_BUILD_ROOT%{_sysconfdir}/environment

# Install default configuration files.

install -d -m 755 $RPM_BUILD_ROOT%{_pamconfdir}

install -d -m 755 $RPM_BUILD_ROOT%{_pamvendordir}

install -m 644 %{SOURCE5} $RPM_BUILD_ROOT%{_pamconfdir}/other

install -m 644 %{SOURCE6} $RPM_BUILD_ROOT%{_pamconfdir}/system-auth

install -m 644 %{SOURCE7} $RPM_BUILD_ROOT%{_pamconfdir}/password-auth

install -m 644 %{SOURCE8} $RPM_BUILD_ROOT%{_pamconfdir}/fingerprint-auth

install -m 644 %{SOURCE9} $RPM_BUILD_ROOT%{_pamconfdir}/smartcard-auth

install -m 644 %{SOURCE10} $RPM_BUILD_ROOT%{_pamconfdir}/config-util

install -m 644 %{SOURCE16} $RPM_BUILD_ROOT%{_pamconfdir}/postlogin

install -m 600 /dev/null $RPM_BUILD_ROOT%{_secconfdir}/opasswd

install -d -m 755 $RPM_BUILD_ROOT/var/log

install -d -m 755 $RPM_BUILD_ROOT/var/run/faillock

install -d -m 755 $RPM_BUILD_ROOT%{_sysconfdir}/motd.d

install -d -m 755 $RPM_BUILD_ROOT/usr/lib/motd.d

install -d -m 755 $RPM_BUILD_ROOT/run/motd.d

# Install man pages.

install -m 644 %{SOURCE12} %{SOURCE13} %{SOURCE17} $RPM_BUILD_ROOT%{_mandir}/man5/

ln -sf system-auth.5 $RPM_BUILD_ROOT%{_mandir}/man5/password-auth.5

ln -sf system-auth.5 $RPM_BUILD_ROOT%{_mandir}/man5/fingerprint-auth.5

ln -sf system-auth.5 $RPM_BUILD_ROOT%{_mandir}/man5/smartcard-auth.5

for phase in auth acct passwd session ; do

	ln -sf pam_unix.so $RPM_BUILD_ROOT%{_moduledir}/pam_unix_${phase}.so 

done

# Remove .la files and make new .so links -- this depends on the value

# of _libdir not changing, and *not* being /usr/lib.

for lib in libpam libpamc libpam_misc ; do

rm -f $RPM_BUILD_ROOT%{_pamlibdir}/${lib}.la

done

rm -f $RPM_BUILD_ROOT%{_moduledir}/*.la

%if "%{_pamlibdir}" != "%{_libdir}"

install -d -m 755 $RPM_BUILD_ROOT%{_libdir}

for lib in libpam libpamc libpam_misc ; do

pushd $RPM_BUILD_ROOT%{_libdir}

ln -sf %{_pamlibdir}/${lib}.so.*.* ${lib}.so

popd

rm -f $RPM_BUILD_ROOT%{_pamlibdir}/${lib}.so

done

%endif

# Duplicate doc file sets.

rm -fr $RPM_BUILD_ROOT/usr/share/doc/pam

# Install the file for autocreation of /var/run subdirectories on boot

install -m644 -D %{SOURCE15} $RPM_BUILD_ROOT%{_prefix}/lib/tmpfiles.d/pam.conf

%find_lang Linux-PAM

%check

# Make sure every module subdirectory gave us a module.  Yes, this is hackish.

for dir in modules/pam_* ; do

if [ -d ${dir} ] ; then

%if ! %{WITH_SELINUX}

	[ ${dir} = "modules/pam_selinux" ] && continue

	[ ${dir} = "modules/pam_sepermit" ] && continue

%endif

%if ! %{WITH_AUDIT}

	[ ${dir} = "modules/pam_tty_audit" ] && continue

%endif

	if ! ls -1 $RPM_BUILD_ROOT%{_moduledir}/`basename ${dir}`*.so ; then

		echo ERROR `basename ${dir}` did not build a module.

		exit 1

	fi

fi

done

# Check for module problems.  Specifically, check that every module we just

# installed can actually be loaded by a minimal PAM-aware application.

/sbin/ldconfig -n $RPM_BUILD_ROOT%{_pamlibdir}

for module in $RPM_BUILD_ROOT%{_moduledir}/pam*.so ; do

	if ! env LD_LIBRARY_PATH=$RPM_BUILD_ROOT%{_pamlibdir} \

		 %{SOURCE11} -ldl -lpam -L$RPM_BUILD_ROOT%{_libdir} ${module} ; then

		echo ERROR module: ${module} cannot be loaded.

		exit 1

	fi

done

%ldconfig_scriptlets

%files -f Linux-PAM.lang

%dir %{_pamconfdir}

%dir %{_pamvendordir}

%config(noreplace) %{_pamconfdir}/other

%config(noreplace) %{_pamconfdir}/system-auth

%config(noreplace) %{_pamconfdir}/password-auth

%config(noreplace) %{_pamconfdir}/fingerprint-auth

%config(noreplace) %{_pamconfdir}/smartcard-auth

%config(noreplace) %{_pamconfdir}/config-util

%config(noreplace) %{_pamconfdir}/postlogin

%{!?_licensedir:%global license %%doc}

%license Copyright

%license gpl-2.0.txt

%{_pamlibdir}/libpam.so.*

%{_pamlibdir}/libpamc.so.*

%{_pamlibdir}/libpam_misc.so.*

%{_sbindir}/pam_console_apply

%{_sbindir}/pam_namespace_helper

%{_sbindir}/faillock

%attr(4755,root,root) %{_sbindir}/pam_timestamp_check

%attr(4755,root,root) %{_sbindir}/unix_chkpwd

%attr(0700,root,root) %{_sbindir}/unix_update

%attr(0755,root,root) %{_sbindir}/mkhomedir_helper

%attr(0755,root,root) %{_sbindir}/pwhistory_helper

%dir %{_moduledir}

%{_moduledir}/pam_access.so

%{_moduledir}/pam_chroot.so

%{_moduledir}/pam_console.so

%{_moduledir}/pam_debug.so

%{_moduledir}/pam_deny.so

%{_moduledir}/pam_echo.so

%{_moduledir}/pam_env.so

%{_moduledir}/pam_exec.so

%{_moduledir}/pam_faildelay.so

%{_moduledir}/pam_faillock.so

%{_moduledir}/pam_filter.so

%{_moduledir}/pam_ftp.so

%{_moduledir}/pam_group.so

%{_moduledir}/pam_issue.so

%{_moduledir}/pam_keyinit.so

%{_moduledir}/pam_lastlog.so

%{_moduledir}/pam_limits.so

%{_moduledir}/pam_listfile.so

%{_moduledir}/pam_localuser.so

%{_moduledir}/pam_loginuid.so

%{_moduledir}/pam_mail.so

%{_moduledir}/pam_mkhomedir.so

%{_moduledir}/pam_motd.so

%{_moduledir}/pam_namespace.so

%{_moduledir}/pam_nologin.so

%{_moduledir}/pam_permit.so

%{_moduledir}/pam_postgresok.so

%{_moduledir}/pam_pwhistory.so

%{_moduledir}/pam_rhosts.so

%{_moduledir}/pam_rootok.so

%if %{WITH_SELINUX}

%{_moduledir}/pam_selinux.so

%{_moduledir}/pam_selinux_permit.so

%{_moduledir}/pam_sepermit.so

%endif

%{_moduledir}/pam_securetty.so

%{_moduledir}/pam_setquota.so

%{_moduledir}/pam_shells.so

%{_moduledir}/pam_stress.so

%{_moduledir}/pam_succeed_if.so

%{_moduledir}/pam_time.so

%{_moduledir}/pam_timestamp.so

%if %{WITH_AUDIT}

%{_moduledir}/pam_tty_audit.so

%endif

%{_moduledir}/pam_umask.so

%{_moduledir}/pam_unix.so

%{_moduledir}/pam_unix_acct.so

%{_moduledir}/pam_unix_auth.so

%{_moduledir}/pam_unix_passwd.so

%{_moduledir}/pam_unix_session.so

%{_moduledir}/pam_userdb.so

%{_moduledir}/pam_usertype.so

%{_moduledir}/pam_warn.so

%{_moduledir}/pam_wheel.so

%{_moduledir}/pam_xauth.so

%{_moduledir}/pam_filter

%{_systemdlibdir}/pam_namespace.service

%dir %{_secconfdir}

%config(noreplace) %{_secconfdir}/access.conf

%config(noreplace) %{_secconfdir}/chroot.conf

%config %{_secconfdir}/console.perms

%config(noreplace) %{_secconfdir}/console.handlers

%config(noreplace) %{_secconfdir}/faillock.conf

%config(noreplace) %{_secconfdir}/group.conf

%config(noreplace) %{_secconfdir}/limits.conf

%dir %{_secconfdir}/limits.d

%config(noreplace) %{_secconfdir}/namespace.conf

%dir %{_secconfdir}/namespace.d

%attr(755,root,root) %config(noreplace) %{_secconfdir}/namespace.init

%config(noreplace) %{_secconfdir}/pam_env.conf

%config(noreplace) %{_secconfdir}/time.conf

%config(noreplace) %{_secconfdir}/opasswd

%dir %{_secconfdir}/console.apps

%dir %{_secconfdir}/console.perms.d

%dir /var/run/console

%if %{WITH_SELINUX}

%config(noreplace) %{_secconfdir}/sepermit.conf

%dir /var/run/sepermit

%endif

%dir /var/run/faillock

%dir %{_sysconfdir}/motd.d

%dir /run/motd.d

%dir /usr/lib/motd.d

%{_prefix}/lib/tmpfiles.d/pam.conf

%{_mandir}/man5/*

%{_mandir}/man8/*

%files devel

%{_includedir}/security

%{_mandir}/man3/*

%{_libdir}/libpam.so

%{_libdir}/libpamc.so

%{_libdir}/libpam_misc.so

%doc doc/mwg/*.txt doc/mwg/html

%doc doc/adg/*.txt doc/adg/html

%doc doc/specs/rfc86.0.txt

%files docs

%doc doc/txts

%doc doc/sag/*.txt doc/sag/html

%changelog

* Thu Dec  2 2021 Iker Pedrosa <ipedrosa@redhat.com> - 1.5.1-9

- pam_limits: "Unlimited" is not a valid value for RLIMIT_NOFILE. Resolves: #1989900

* Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 1.5.1-8

- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags

  Related: rhbz#1991688

* Wed Jul 14 2021 Iker Pedrosa <ipedrosa@redhat.com> - 1.5.1-7

- Fix issues detected by covscan tool

* Fri Jul  2 2021 Iker Pedrosa <ipedrosa@redhat.com> - 1.5.1-6

- pam_timestamp: openssl hmac authentication. Resolves: #1934975

* Mon Apr 19 2021 Iker Pedrosa <ipedrosa@redhat.com> - 1.5.1-5

- Disable nis support. Resolves: #1942373

* Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 1.5.1-4

- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937

* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.5.1-3

- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild

* Mon Nov 30 2020 Iker Pedrosa <ipedrosa@redhat.com> - 1.5.1-2

- Add BuildRequires: make (#1902520)

* Thu Nov 26 2020 Iker Pedrosa <ipedrosa@redhat.com> - 1.5.1-1

- Rebase to release 1.5.1

- fix CVE-2020-27780: authentication bypass when the user doesn't exist

  and root password is blank (#1901173)

* Wed Nov 11 2020 Iker Pedrosa <ipedrosa@redhat.com> - 1.5.0-1

- Rebase to release 1.5.0

- Rebase to pam-redhat-1.1.4

- Remove pam_cracklib, pam_tally and pam_tally2

- spec file cleanup

* Fri Nov  6 2020 Iker Pedrosa <ipedrosa@redhat.com> - 1.4.0-7

- libpam: fix memory leak in pam_start (#1894630)

* Mon Oct 19 2020 Iker Pedrosa <ipedrosa@redhat.com> - 1.4.0-6

- pam_unix: fix missing initialization of daysleft  (#1887077)

- pam_motd: change privilege message prompt to default (#1861640)

* Wed Oct 14 2020 Iker Pedrosa <ipedrosa@redhat.com> - 1.4.0-5

- pam_motd: read motd files with target user credentials skipping unreadable ones (#1861640)

- Clarify upstreamed patches

* Tue Aug 04 2020 Tom Stellard <tstellar@redhat.com> - 1.4.0-4

- Add BuildRequires: gcc

- https://docs.fedoraproject.org/en-US/packaging-guidelines/C_and_C++/#_packaging

* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.0-3

- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild

* Thu Jul  2 2020 Iker Pedrosa <ipedrosa@redhat.com> - 1.4.0-2

- Enable layered configuration with distribution configs in /usr/share/pam.d

- Added new pam-redhat tarball to lookaside cache

* Wed Jun 24 2020 Iker Pedrosa <ipedrosa@redhat.com> - 1.4.0-1

- Rebased to release 1.4.0

- Rebased to pam-redhat-1.1.3

- Removed pam_cracklib as it has been deprecated

* Mon Jun 22 2020 Iker Pedrosa <ipedrosa@redhat.com> - 1.3.1-28

- pam_faillock: change /run/faillock/$USER permissions to 0660 (#1661822)

* Wed Jun 17 2020 Iker Pedrosa <ipedrosa@redhat.com> - 1.3.1-27

- pam_unix and pam_usertype: avoid determining if user exists (#1629598)

* Thu May 14 2020 Iker Pedrosa <ipedrosa@redhat.com> 1.3.1-26

- pam_tty_audit: if kernel audit is disabled return PAM_IGNORE (#1775357)

- pam_modutil_sanitize_helper_fds: fix SIGPIPE effect of PAM_MODUTIL_PIPE_FD (#1791970)

* Thu Apr 23 2020 Iker Pedrosa <ipedrosa@redhat.com> - 1.3.1-25

- docs: splitted documentation in subpackage -docs

* Mon Mar 9 2020 Iker Pedrosa <ipedrosa@redhat.com> - 1.3.1-24

- pam_selinux: check unknown object classes or permissions in current policy

* Tue Feb 4 2020 Pavel Březina <pbrezina@redhat.com> - 1.3.1-23

- Add pam_usertype.so

* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.3.1-22

- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild

* Wed Dec 18 2019 Tomáš Mráz <tmraz@redhat.com> 1.3.1-21

- pam_faillock: Fix regression in admin_group support

* Wed Oct 16 2019 Tomáš Mráz <tmraz@redhat.com> 1.3.1-20

- pam_namespace: Support noexec, nosuid and nodev flags for tmpfs mounts

- Drop tallylog and pam_tally documentation

- pam_faillock: Support local_users_only option

- pam_lastlog: Do not display failed attempts with PAM_SILENT flag

- pam_lastlog: Support unlimited option to override fsize limit

- pam_unix: Log if user authenticated without password

- pam_tty_audit: Improve manual page

- Optimize closing fds when spawning helpers

- Fix duplicate password verification in pam_authtok_verify()

* Mon Sep  9 2019 Tomáš Mráz <tmraz@redhat.com> 1.3.1-19

- pam_faillock: Support configuration file /etc/security/faillock.conf

* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.3.1-18

- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild

* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.3.1-17

- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild

* Mon Jan 14 2019 Björn Esser <besser82@fedoraproject.org> - 1.3.1-16

- Rebuilt for libcrypt.so.2 (#1666033)

* Thu Dec 20 2018 Tomáš Mráz <tmraz@redhat.com> 1.3.1-15

- Add the motd.d directories (empty) to silence warnings and to

  provide proper ownership for them (#1660935)

* Tue Dec  4 2018 Tomáš Mráz <tmraz@redhat.com> 1.3.1-14

- Update Red Hat PAM modules to version 1.0.0 which includes pam_faillock

- Drop also pam_tally2 which was obsoleted and deprecated long time ago

* Sun Dec 02 2018 Björn Esser <besser82@fedoraproject.org> - 1.3.1-13

- Backport upstream commit reporting disabled or invalid hashes to syslog

- Backport upstream commit fixing syslog for disabled or invalid hashes

* Wed Nov 28 2018 Robert Fairley <rfairley@redhat.com> 1.3.1-12

- Backport upstream commit pam_motd: Support multiple motd paths specified, with filename overrides (#69)

- Backport upstream commit pam_motd: Fix segmentation fault when no motd_dir specified (#76)

* Mon Nov 26 2018 Tomáš Mráz <tmraz@redhat.com> 1.3.1-11

- Completely drop the check of invalid or disabled salt via crypt_checksalt

* Sun Nov 25 2018 Björn Esser <besser82@fedoraproject.org> - 1.3.1-10

- Fix passphraseless sudo with crypt_checksalt (#1653023)

* Fri Nov 23 2018 Björn Esser <besser82@fedoraproject.org> - 1.3.1-9

- Backport upstream commit removing an obsolete prototype

- Backport upstream commit preferring bcrypt_b ($2b$) for blowfish

- Backport upstream commit preferring gensalt with autoentropy

- Backport upstream commit using crypt_checksalt for password aging

- Backport upstream commit adding support for (gost-)yescrypt

- Update the no-MD5-fallback patch for alignment

* Fri Nov 16 2018 Björn Esser <besser82@fedoraproject.org> - 1.3.1-8

- Use %%ldconfig_scriptlets

- Drop Requires(post), not needed anymore

- Prefer %%global over %%define

* Tue Nov 13 2018 Björn Esser <besser82@fedoraproject.org> - 1.3.1-7

- when building against libxcrypt >= 4.3.3-2, we can avoid the explicit

  dependency on libxcrypt >= 4.3.3-1

* Mon Nov 12 2018 Björn Esser <besser82@fedoraproject.org> - 1.3.1-6

- add explicit (Build)Requires for libxcrypt >= 4.3.3-1

* Mon Nov 12 2018 Björn Esser <besser82@fedoraproject.org> - 1.3.1-5

- rebuilt against libxcrypt-4.3.3 to enable the use of crypt_gensalt_r

* Mon Sep 10 2018 Tomáš Mráz <tmraz@redhat.com> 1.3.1-4

- add pam_umask to postlogin PAM configuration file

- fix some issues found by Coverity scan

* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.3.1-3

- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild

* Fri Jun  8 2018 Tomáš Mráz <tmraz@redhat.com> 1.3.1-1

- use /run instead of /var/run in pamtmp.conf (#1588612)

* Fri May 18 2018 Tomáš Mráz <tmraz@redhat.com> 1.3.1-1

- new upstream release 1.3.1 with multiple improvements

* Thu Feb 08 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.3.0-10

- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

* Tue Jan 30 2018 Tomáš Mráz <tmraz@redhat.com> 1.3.0-9

- and the NIS support now also requires libnsl2

* Sat Jan 20 2018 Björn Esser <besser82@fedoraproject.org> - 1.3.0-8

- Rebuilt for switch to libxcrypt

* Thu Jan 11 2018 Tomáš Mráz <tmraz@redhat.com> 1.3.0-7

- the NIS support now requires libtirpc

* Mon Aug 21 2017 Tomáš Mráz <tmraz@redhat.com> 1.3.0-6

- add admin_group option to pam_faillock (#1285550)

* Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.3.0-5

- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild

* Thu Jul 27 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.3.0-4

- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild

* Thu Apr 20 2017 Tomáš Mráz <tmraz@redhat.com> 1.3.0-3

- drop superfluous 'Changing password' message from pam_unix (#658289)

* Sat Feb 11 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.3.0-2

- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild

* Fri May  6 2016 Tomáš Mráz <tmraz@redhat.com> 1.3.0-1

- new upstream release with multiple improvements

* Mon Apr 11 2016 Tomáš Mráz <tmraz@redhat.com> 1.2.1-8

- make cracklib-dicts dependency weak (#1323172)

* Wed Apr  6 2016 Tomáš Mráz <tmraz@redhat.com> 1.2.1-7

- do not drop PAM_OLDAUTHTOK if mismatched - can be used by further modules

* Mon Apr  4 2016 Tomáš Mráz <tmraz@redhat.com> 1.2.1-6

- pam_unix: use pam_get_authtok() and improve prompting

* Fri Feb  5 2016 Tomáš Mráz <tmraz@redhat.com> 1.2.1-5

- fix console device name in console.handlers (#1270224)

* Thu Feb 04 2016 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.1-4

- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild

* Fri Oct 16 2015 Tomáš Mráz <tmraz@redhat.com> 1.2.1-3

- pam_faillock: add possibility to set unlock_time to never

* Wed Aug 12 2015 Tomáš Mráz <tmraz@redhat.com> 1.2.1-2

- drop the nproc limit setting, it is causing more harm than it solves

* Fri Jun 26 2015 Tomáš Mráz <tmraz@redhat.com> 1.2.1-1

- new upstream release fixing security issue with unlimited password length

* Thu Jun 18 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.2.0-2

- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild

* Fri May 15 2015 Tomáš Mráz <tmraz@redhat.com> 1.2.0-1

- new upstream release with multiple minor improvements

* Fri Oct 17 2014 Tomáš Mráz <tmraz@redhat.com> 1.1.8-18

- use USER_MGMT type for auditing in the pam_tally2 and faillock

  apps (#1151576)

* Thu Sep 11 2014 Tomáš Mráz <tmraz@redhat.com> 1.1.8-17

- update the audit-grantor patch with the upstream changes

- pam_userdb: correct the example in man page (#1078784)

- pam_limits: check whether the utmp login entry is valid (#1080023)

- pam_console_apply: do not print error if console.perms.d is empty

- pam_limits: nofile refers to open file descriptors (#1111220)

- apply PIE and full RELRO to all binaries built

* Sun Aug 17 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.1.8-16

- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild

* Wed Aug 13 2014 Tomáš Mráz <tmraz@redhat.com> 1.1.8-15

- audit the module names that granted access

- pam_faillock: update to latest version

* Wed Jul 30 2014 Tom Callaway <spot@fedoraproject.org> - 1.1.8-14

- fix license handling

* Wed Jul 16 2014 Tomáš Mráz <tmraz@redhat.com> 1.1.8-13

- be tolerant to corrupted opasswd file

* Fri Jun 06 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.1.8-12

- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild

* Thu May 22 2014 Tomáš Mráz <tmraz@redhat.com> 1.1.8-11

- pam_loginuid: make it return PAM_IGNORE in containers

* Mon Mar 31 2014 Tomáš Mráz <tmraz@redhat.com> 1.1.8-10

- fix CVE-2014-2583: potential path traversal issue in pam_timestamp

* Wed Mar 26 2014 Tomáš Mráz <tmraz@redhat.com> 1.1.8-9

- pam_pwhistory: call the helper if SELinux enabled

* Tue Mar 11 2014 Tomáš Mráz <tmraz@redhat.com> 1.1.8-8

- fix CVE-2013-7041: use case sensitive comparison in pam_userdb

* Mon Mar 10 2014 Tomáš Mráz <tmraz@redhat.com> 1.1.8-7

- rename the 90-nproc.conf to 20-nproc.conf (#1071618)

- canonicalize user name in pam_selinux (#1071010)

- refresh the pam-redhat tarball

* Mon Dec 16 2013 Tomáš Mráz <tmraz@redhat.com> 1.1.8-4

- raise the default soft nproc limit to 4096

* Mon Dec  2 2013 Tomáš Mráz <tmraz@redhat.com> 1.1.8-3

- updated translations

* Mon Oct 21 2013 Tomáš Mráz <tmraz@redhat.com> 1.1.8-2

- update lastlog with pam_lastlog also for su (#1021108)

* Mon Oct 14 2013 Tomáš Mráz <tmraz@redhat.com> 1.1.8-1

- new upstream release

- pam_tty_audit: allow the module to work with old kernels

* Fri Oct  4 2013 Tomáš Mráz <tmraz@redhat.com> 1.1.7-3

- pam_tty_audit: proper initialization of the tty_audit_status struct

* Mon Sep 30 2013 Tomáš Mráz <tmraz@redhat.com> 1.1.7-2

- add "local_users_only" to pam_pwquality in default configuration

* Fri Sep 13 2013 Tomáš Mráz <tmraz@redhat.com> 1.1.7-1

- new upstream release

* Wed Aug  7 2013 Tomáš Mráz <tmraz@redhat.com> 1.1.6-14

- use links instead of w3m to create txt documentation

- recognize login session in pam_sepermit to prevent gdm from locking (#969174)

- add support for disabling password logging in pam_tty_audit

* Sat Aug 03 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.1.6-13

- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild

* Thu Jul 11 2013 Tomáš Mráz <tmraz@redhat.com> 1.1.6-12

- add auditing of SELinux policy violation in pam_rootok (#965723)

- add SELinux helper to pam_pwhistory

* Tue May  7 2013 Tomáš Mráz <tmraz@redhat.com> 1.1.6-11

- the default isadir is more correct

* Wed Apr 24 2013 Tomáš Mráz <tmraz@redhat.com> 1.1.6-10

- pam_unix: do not fail with bad ld.so.preload

* Fri Mar 22 2013 Tomáš Mráz <tmraz@redhat.com> 1.1.6-9

- do not fail if btmp file is corrupted (#906852)

- fix strict aliasing warnings in build

- UsrMove

- use authtok_type with pam_pwquality in system-auth

- remove manual_context handling from pam_selinux (#876976)

- other minor specfile cleanups

* Tue Mar 19 2013 Tomáš Mráz <tmraz@redhat.com> 1.1.6-8

- check NULL return from crypt() calls (#915316)

* Thu Mar 14 2013 Tomáš Mráz <tmraz@redhat.com> 1.1.6-7

- add workaround for low nproc limit for confined root user (#432903)

* Thu Feb 21 2013 Karsten Hopp <karsten@redhat.com> 1.1.6-6

- add support for ppc64p7 arch (Power7 optimized)

* Thu Feb 14 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.1.6-5

- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild

* Tue Jan 22 2013 Tomas Mraz <tmraz@redhat.com> 1.1.6-4

- fix build with current autotools

* Mon Oct 15 2012 Tomas Mraz <tmraz@redhat.com> 1.1.6-3

- add support for tmpfs mount options in pam_namespace

* Mon Sep  3 2012 Tomas Mraz <tmraz@redhat.com> 1.1.6-2

- link setuid binaries with full relro (#853158)

- add rhost and tty to auditing data in modules (#677664)