%define pam_redhat_version 0.99.10-1

Summary: An extensible library which provides authentication for applications

Name: pam

Version: 1.1.8

Release: 1%{?dist}

# The library is BSD licensed with option to relicense as GPLv2+

# - this option is redundant as the BSD license allows that anyway.

# pam_timestamp, pam_loginuid, and pam_console modules are GPLv2+.

License: BSD and GPLv2+

Group: System Environment/Base

Source0: http://www.linux-pam.org/library/Linux-PAM-%{version}.tar.bz2

# This is the old location that might be revived in future:

#Source0: http://ftp.us.kernel.org/pub/linux/libs/pam/library/Linux-PAM-%{version}.tar.bz2

#Source1: http://ftp.us.kernel.org/pub/linux/libs/pam/library/Linux-PAM-%{version}.tar.bz2.sign

Source2: https://fedorahosted.org/releases/p/a/pam-redhat/pam-redhat-%{pam_redhat_version}.tar.bz2

Source5: other.pamd

Source6: system-auth.pamd

Source7: password-auth.pamd

Source8: fingerprint-auth.pamd

Source9: smartcard-auth.pamd

Source10: config-util.pamd

Source11: dlopen.sh

Source12: system-auth.5

Source13: config-util.5

Source14: 90-nproc.conf

Source15: pamtmp.conf

Source16: postlogin.pamd

Source17: postlogin.5

Patch1:  pam-1.0.90-redhat-modules.patch

Patch2:  pam-1.1.6-std-noclose.patch

Patch4:  pam-1.1.0-console-nochmod.patch

Patch5:  pam-1.1.0-notally.patch

Patch7:  pam-1.1.0-console-fixes.patch

Patch8:  pam-1.1.1-faillock.patch

Patch9:  pam-1.1.6-noflex.patch

Patch10: pam-1.1.3-nouserenv.patch

Patch11: pam-1.1.3-console-abstract.patch

Patch12: pam-1.1.3-faillock-screensaver.patch

Patch13: pam-1.1.6-limits-user.patch

Patch15: pam-1.1.6-full-relro.patch

# FIPS related - non upstreamable

Patch20: pam-1.1.5-unix-no-fallback.patch

# Upstreamed partially

Patch29: pam-1.1.6-pwhistory-helper.patch

Patch31: pam-1.1.6-use-links.patch

Patch32: pam-1.1.7-tty-audit-init.patch

%define _pamlibdir %{_libdir}

%define _moduledir %{_libdir}/security

%define _secconfdir %{_sysconfdir}/security

%define _pamconfdir %{_sysconfdir}/pam.d

%if %{?WITH_SELINUX:0}%{!?WITH_SELINUX:1}

%define WITH_SELINUX 1

%endif

%if %{?WITH_AUDIT:0}%{!?WITH_AUDIT:1}

%define WITH_AUDIT 1

%endif

Requires: cracklib-dicts >= 2.8

Requires: libpwquality >= 0.9.9

Requires(post): coreutils, /sbin/ldconfig

BuildRequires: autoconf >= 2.60

BuildRequires: automake, libtool

BuildRequires: bison, flex, sed

BuildRequires: cracklib-devel, cracklib-dicts >= 2.8

BuildRequires: perl, pkgconfig, gettext-devel

%if %{WITH_AUDIT}

BuildRequires: audit-libs-devel >= 1.0.8

Requires: audit-libs >= 1.0.8

%endif

%if %{WITH_SELINUX}

BuildRequires: libselinux-devel >= 1.33.2

Requires: libselinux >= 1.33.2

%endif

Requires: glibc >= 2.3.90-37

BuildRequires: libdb-devel

# Following deps are necessary only to build the pam library documentation.

BuildRequires: linuxdoc-tools, elinks, libxslt

BuildRequires: docbook-style-xsl, docbook-dtds

URL: http://www.linux-pam.org/

%description

PAM (Pluggable Authentication Modules) is a system security tool that

allows system administrators to set authentication policy without

having to recompile programs that handle authentication.

%package devel

Group: Development/Libraries

Summary: Files needed for developing PAM-aware applications and modules for PAM

Requires: pam%{?_isa} = %{version}-%{release}

%description devel

PAM (Pluggable Authentication Modules) is a system security tool that

allows system administrators to set authentication policy without

having to recompile programs that handle authentication. This package

contains header files used for building both PAM-aware applications

and modules for use with the PAM system.

%prep

%setup -q -n Linux-PAM-%{version} -a 2

perl -pi -e "s/ppc64-\*/ppc64-\* \| ppc64p7-\*/" build-aux/config.sub

# Add custom modules.

mv pam-redhat-%{pam_redhat_version}/* modules

%patch1 -p1 -b .redhat-modules

%patch2 -p1 -b .std-noclose

%patch4 -p1 -b .nochmod

%patch5 -p1 -b .notally

%patch7 -p1 -b .console-fixes

%patch8 -p1 -b .faillock

%patch9 -p1 -b .noflex

%patch10 -p1 -b .nouserenv

%patch11 -p1 -b .abstract

%patch12 -p1 -b .screensaver

%patch13 -p1 -b .limits

%patch15 -p1 -b .relro

%patch20 -p1 -b .no-fallback

%patch29 -p1 -b .pwhhelper

%patch31 -p1 -b .links

%patch32 -p1 -b .tty-audit-init

%build

autoreconf -i

%configure \

	--libdir=%{_pamlibdir} \

	--includedir=%{_includedir}/security \

%if ! %{WITH_SELINUX}

	--disable-selinux \

%endif

%if ! %{WITH_AUDIT}

	--disable-audit \

%endif

	--disable-static \

	--disable-prelude

make

# we do not use _smp_mflags because the build of sources in yacc/flex fails

%install

mkdir -p doc/txts

for readme in modules/pam_*/README ; do

	cp -f ${readme} doc/txts/README.`dirname ${readme} | sed -e 's|^modules/||'`

done

# Install the binaries, libraries, and modules.

make install DESTDIR=$RPM_BUILD_ROOT LDCONFIG=:

%if %{WITH_SELINUX}

# Temporary compat link

ln -sf pam_sepermit.so $RPM_BUILD_ROOT%{_moduledir}/pam_selinux_permit.so

%endif

# RPM uses docs from source tree

rm -rf $RPM_BUILD_ROOT%{_datadir}/doc/Linux-PAM

# Included in setup package

rm -f $RPM_BUILD_ROOT%{_sysconfdir}/environment

# Install default configuration files.

install -d -m 755 $RPM_BUILD_ROOT%{_pamconfdir}

install -m 644 %{SOURCE5} $RPM_BUILD_ROOT%{_pamconfdir}/other

install -m 644 %{SOURCE6} $RPM_BUILD_ROOT%{_pamconfdir}/system-auth

install -m 644 %{SOURCE7} $RPM_BUILD_ROOT%{_pamconfdir}/password-auth

install -m 644 %{SOURCE8} $RPM_BUILD_ROOT%{_pamconfdir}/fingerprint-auth

install -m 644 %{SOURCE9} $RPM_BUILD_ROOT%{_pamconfdir}/smartcard-auth

install -m 644 %{SOURCE10} $RPM_BUILD_ROOT%{_pamconfdir}/config-util

install -m 644 %{SOURCE16} $RPM_BUILD_ROOT%{_pamconfdir}/postlogin

install -m 644 %{SOURCE14} $RPM_BUILD_ROOT%{_secconfdir}/limits.d/90-nproc.conf

install -m 600 /dev/null $RPM_BUILD_ROOT%{_secconfdir}/opasswd

install -d -m 755 $RPM_BUILD_ROOT/var/log

install -m 600 /dev/null $RPM_BUILD_ROOT/var/log/tallylog

install -d -m 755 $RPM_BUILD_ROOT/var/run/faillock

# Install man pages.

install -m 644 %{SOURCE12} %{SOURCE13} %{SOURCE17} $RPM_BUILD_ROOT%{_mandir}/man5/

ln -sf system-auth.5 $RPM_BUILD_ROOT%{_mandir}/man5/password-auth.5

ln -sf system-auth.5 $RPM_BUILD_ROOT%{_mandir}/man5/fingerprint-auth.5

ln -sf system-auth.5 $RPM_BUILD_ROOT%{_mandir}/man5/smartcard-auth.5

for phase in auth acct passwd session ; do

	ln -sf pam_unix.so $RPM_BUILD_ROOT%{_moduledir}/pam_unix_${phase}.so 

done

# Remove .la files and make new .so links -- this depends on the value

# of _libdir not changing, and *not* being /usr/lib.

for lib in libpam libpamc libpam_misc ; do

rm -f $RPM_BUILD_ROOT%{_pamlibdir}/${lib}.la

done

rm -f $RPM_BUILD_ROOT%{_moduledir}/*.la

%if "%{_pamlibdir}" != "%{_libdir}"

install -d -m 755 $RPM_BUILD_ROOT%{_libdir}

for lib in libpam libpamc libpam_misc ; do

pushd $RPM_BUILD_ROOT%{_libdir}

ln -sf %{_pamlibdir}/${lib}.so.*.* ${lib}.so

popd

rm -f $RPM_BUILD_ROOT%{_pamlibdir}/${lib}.so

done

%endif

# Duplicate doc file sets.

rm -fr $RPM_BUILD_ROOT/usr/share/doc/pam

# Install the file for autocreation of /var/run subdirectories on boot

install -m644 -D %{SOURCE15} $RPM_BUILD_ROOT%{_prefix}/lib/tmpfiles.d/pam.conf

%find_lang Linux-PAM

%check

# Make sure every module subdirectory gave us a module.  Yes, this is hackish.

for dir in modules/pam_* ; do

if [ -d ${dir} ] ; then

%if ! %{WITH_SELINUX}

	[ ${dir} = "modules/pam_selinux" ] && continue

	[ ${dir} = "modules/pam_sepermit" ] && continue

%endif

%if ! %{WITH_AUDIT}

	[ ${dir} = "modules/pam_tty_audit" ] && continue

%endif

	[ ${dir} = "modules/pam_tally" ] && continue

	if ! ls -1 $RPM_BUILD_ROOT%{_moduledir}/`basename ${dir}`*.so ; then

		echo ERROR `basename ${dir}` did not build a module.

		exit 1

	fi

fi

done

# Check for module problems.  Specifically, check that every module we just

# installed can actually be loaded by a minimal PAM-aware application.

/sbin/ldconfig -n $RPM_BUILD_ROOT%{_pamlibdir}

for module in $RPM_BUILD_ROOT%{_moduledir}/pam*.so ; do

	if ! env LD_LIBRARY_PATH=$RPM_BUILD_ROOT%{_pamlibdir} \

		 %{SOURCE11} -ldl -lpam -L$RPM_BUILD_ROOT%{_libdir} ${module} ; then

		echo ERROR module: ${module} cannot be loaded.

		exit 1

	fi

done

%post

/sbin/ldconfig

if [ ! -e /var/log/tallylog ] ; then

	install -m 600 /dev/null /var/log/tallylog

fi

%postun -p /sbin/ldconfig

%files -f Linux-PAM.lang

%defattr(-,root,root)

%dir %{_pamconfdir}

%config(noreplace) %{_pamconfdir}/other

%config(noreplace) %{_pamconfdir}/system-auth

%config(noreplace) %{_pamconfdir}/password-auth

%config(noreplace) %{_pamconfdir}/fingerprint-auth

%config(noreplace) %{_pamconfdir}/smartcard-auth

%config(noreplace) %{_pamconfdir}/config-util

%config(noreplace) %{_pamconfdir}/postlogin

%doc Copyright

%doc doc/txts

%doc doc/sag/*.txt doc/sag/html

%doc doc/specs/rfc86.0.txt

%{_pamlibdir}/libpam.so.*

%{_pamlibdir}/libpamc.so.*

%{_pamlibdir}/libpam_misc.so.*

%{_sbindir}/pam_console_apply

%{_sbindir}/pam_tally2

%{_sbindir}/faillock

%attr(4755,root,root) %{_sbindir}/pam_timestamp_check

%attr(4755,root,root) %{_sbindir}/unix_chkpwd

%attr(0700,root,root) %{_sbindir}/unix_update

%attr(0755,root,root) %{_sbindir}/mkhomedir_helper

%attr(0755,root,root) %{_sbindir}/pwhistory_helper

%dir %{_moduledir}

%{_moduledir}/pam_access.so

%{_moduledir}/pam_chroot.so

%{_moduledir}/pam_console.so

%{_moduledir}/pam_cracklib.so

%{_moduledir}/pam_debug.so

%{_moduledir}/pam_deny.so

%{_moduledir}/pam_echo.so

%{_moduledir}/pam_env.so

%{_moduledir}/pam_exec.so

%{_moduledir}/pam_faildelay.so

%{_moduledir}/pam_faillock.so

%{_moduledir}/pam_filter.so

%{_moduledir}/pam_ftp.so

%{_moduledir}/pam_group.so

%{_moduledir}/pam_issue.so

%{_moduledir}/pam_keyinit.so

%{_moduledir}/pam_lastlog.so

%{_moduledir}/pam_limits.so

%{_moduledir}/pam_listfile.so

%{_moduledir}/pam_localuser.so

%{_moduledir}/pam_loginuid.so

%{_moduledir}/pam_mail.so

%{_moduledir}/pam_mkhomedir.so

%{_moduledir}/pam_motd.so

%{_moduledir}/pam_namespace.so

%{_moduledir}/pam_nologin.so

%{_moduledir}/pam_permit.so

%{_moduledir}/pam_postgresok.so

%{_moduledir}/pam_pwhistory.so

%{_moduledir}/pam_rhosts.so

%{_moduledir}/pam_rootok.so

%if %{WITH_SELINUX}

%{_moduledir}/pam_selinux.so

%{_moduledir}/pam_selinux_permit.so

%{_moduledir}/pam_sepermit.so

%endif

%{_moduledir}/pam_securetty.so

%{_moduledir}/pam_shells.so

%{_moduledir}/pam_stress.so

%{_moduledir}/pam_succeed_if.so

%{_moduledir}/pam_tally2.so

%{_moduledir}/pam_time.so

%{_moduledir}/pam_timestamp.so

%if %{WITH_AUDIT}

%{_moduledir}/pam_tty_audit.so

%endif

%{_moduledir}/pam_umask.so

%{_moduledir}/pam_unix.so

%{_moduledir}/pam_unix_acct.so

%{_moduledir}/pam_unix_auth.so

%{_moduledir}/pam_unix_passwd.so

%{_moduledir}/pam_unix_session.so

%{_moduledir}/pam_userdb.so

%{_moduledir}/pam_warn.so

%{_moduledir}/pam_wheel.so

%{_moduledir}/pam_xauth.so

%{_moduledir}/pam_filter

%dir %{_secconfdir}

%config(noreplace) %{_secconfdir}/access.conf

%config(noreplace) %{_secconfdir}/chroot.conf

%config %{_secconfdir}/console.perms

%config(noreplace) %{_secconfdir}/console.handlers

%config(noreplace) %{_secconfdir}/group.conf

%config(noreplace) %{_secconfdir}/limits.conf

%dir %{_secconfdir}/limits.d

%config(noreplace) %{_secconfdir}/limits.d/90-nproc.conf

%config(noreplace) %{_secconfdir}/namespace.conf

%dir %{_secconfdir}/namespace.d

%attr(755,root,root) %config(noreplace) %{_secconfdir}/namespace.init

%config(noreplace) %{_secconfdir}/pam_env.conf

%config(noreplace) %{_secconfdir}/time.conf

%config(noreplace) %{_secconfdir}/opasswd

%dir %{_secconfdir}/console.apps

%dir %{_secconfdir}/console.perms.d

%dir /var/run/console

%if %{WITH_SELINUX}

%config(noreplace) %{_secconfdir}/sepermit.conf

%dir /var/run/sepermit

%endif

%ghost %verify(not md5 size mtime) /var/log/tallylog

%dir /var/run/faillock

%{_prefix}/lib/tmpfiles.d/pam.conf

%{_mandir}/man5/*

%{_mandir}/man8/*

%files devel

%defattr(-,root,root)

%{_includedir}/security

%{_mandir}/man3/*

%{_libdir}/libpam.so

%{_libdir}/libpamc.so

%{_libdir}/libpam_misc.so

%doc doc/mwg/*.txt doc/mwg/html

%doc doc/adg/*.txt doc/adg/html

%changelog

* Mon Oct 14 2013 Tomáš Mráz <tmraz@redhat.com> 1.1.8-1

- new upstream release

* Sat Oct  5 2013 Tomáš Mráz <tmraz@redhat.com> 1.1.7-4

- pam_tty_audit: proper initialization of the tty_audit_status struct

* Mon Sep 30 2013 Tomáš Mráz <tmraz@redhat.com> 1.1.7-2

- add "local_users_only" to pam_pwquality in default configuration

* Fri Sep 13 2013 Tomáš Mráz <tmraz@redhat.com> 1.1.7-1

- new upstream release

* Wed Aug  7 2013 Tomáš Mráz <tmraz@redhat.com> 1.1.6-14

- use links instead of w3m to create txt documentation

- recognize login session in pam_sepermit to prevent gdm from locking (#969174)

- add support for disabling password logging in pam_tty_audit

* Thu Jul 11 2013 Tomáš Mráz <tmraz@redhat.com> 1.1.6-13

- add auditing of SELinux policy violation in pam_rootok (#965723)

- add SELinux helper to pam_pwhistory

* Wed Jun 12 2013 Tomáš Mráz <tmraz@redhat.com> 1.1.6-12

- lastlog must be updated also for su

* Tue May  7 2013 Tomáš Mráz <tmraz@redhat.com> 1.1.6-11

- the default isadir is more correct

* Wed Apr 24 2013 Tomáš Mráz <tmraz@redhat.com> 1.1.6-10

- pam_unix: do not fail with bad ld.so.preload

* Fri Mar 22 2013 Tomáš Mráz <tmraz@redhat.com> 1.1.6-9

- do not fail if btmp file is corrupted (#906852)

- fix strict aliasing warnings in build

- UsrMove

- use authtok_type with pam_pwquality in system-auth

- remove manual_context handling from pam_selinux (#876976)

- other minor specfile cleanups

* Tue Mar 19 2013 Tomáš Mráz <tmraz@redhat.com> 1.1.6-8

- check NULL return from crypt() calls (#915316)

* Thu Mar 14 2013 Tomáš Mráz <tmraz@redhat.com> 1.1.6-7

- add workaround for low nproc limit for confined root user (#432903)

* Thu Feb 21 2013 Karsten Hopp <karsten@redhat.com> 1.1.6-6

- add support for ppc64p7 arch (Power7 optimized)

* Thu Feb 14 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.1.6-5

- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild

* Tue Jan 22 2013 Tomas Mraz <tmraz@redhat.com> 1.1.6-4

- fix build with current autotools

* Mon Oct 15 2012 Tomas Mraz <tmraz@redhat.com> 1.1.6-3

- add support for tmpfs mount options in pam_namespace

* Mon Sep  3 2012 Tomas Mraz <tmraz@redhat.com> 1.1.6-2

- link setuid binaries with full relro (#853158)

- add rhost and tty to auditing data in modules (#677664)

* Fri Aug 17 2012 Tomas Mraz <tmraz@redhat.com> - 1.1.6-1

- new upstream release

* Thu Aug  9 2012 Tomas Mraz <tmraz@redhat.com> - 1.1.5-9

- make the pam_lastlog module in postlogin 'optional' (#846843)

* Mon Aug  6 2012 Tomas Mraz <tmraz@redhat.com> - 1.1.5-8

- fix build failure in pam_unix

- add display of previous bad login attempts to postlogin.pamd

- put the tmpfiles.d config to /usr/lib and rename it to pam.conf

- build against libdb-5

* Wed May  9 2012 Tomas Mraz <tmraz@redhat.com> 1.1.5-7

- add inactive account lock out functionality to pam_lastlog

- fix pam_unix remember user name matching

- add gecoscheck and maxclassrepeat functionality to pam_cracklib

- correctly check for crypt() returning NULL in pam_unix

- pam_unix - do not fallback to MD5 on password change

  if requested algorithm not supported by crypt() (#818741)

- install empty directories

* Wed May  9 2012 Tomas Mraz <tmraz@redhat.com> 1.1.5-6

- add pam_systemd to session modules

* Tue Jan 31 2012 Tomas Mraz <tmraz@redhat.com> 1.1.5-5

- fix pam_namespace leaking the protect mounts to parent namespace (#755216)

* Fri Jan 13 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.1.5-4

- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild

* Wed Dec 21 2011 Tomas Mraz <tmraz@redhat.com> 1.1.5-3

- add a note to limits.conf (#754285)

* Thu Nov 24 2011 Tomas Mraz <tmraz@redhat.com> 1.1.5-2

- use pam_pwquality instead of pam_cracklib

* Thu Nov 24 2011 Tomas Mraz <tmraz@redhat.com> 1.1.5-1

- upgrade to new upstream release

* Thu Aug 25 2011 Tomas Mraz <tmraz@redhat.com> 1.1.4-4

- fix dereference in pam_env

- fix wrong parse of user@host pattern in pam_access (#732081)

* Sat Jul 23 2011 Ville Skyttä <ville.skytta@iki.fi> - 1.1.4-3

- Rebuild to fix trailing slashes in provided dirs added by rpm 4.9.1.

* Fri Jul 15 2011 Tomas Mraz <tmraz@redhat.com> 1.1.4-2

- clear supplementary groups in pam_console handler execution

* Mon Jun 27 2011 Tomas Mraz <tmraz@redhat.com> 1.1.4-1

- upgrade to new upstream release

* Tue Jun  7 2011 Tomas Mraz <tmraz@redhat.com> 1.1.3-10

- detect the shared / and make the polydir mounts private based on that

- fix memory leak and other small errors in pam_namespace

* Thu Jun  2 2011 Tomas Mraz <tmraz@redhat.com> 1.1.3-9

- add support for explicit marking of the polydir mount private (#623522)

* Tue Feb 08 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.1.3-8

- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild

* Wed Dec 22 2010 Tomas Mraz <tmraz@redhat.com> 1.1.3-7

- add postlogin common PAM configuration file (#665059)

* Tue Dec 14 2010 Tomas Mraz <tmraz@redhat.com> 1.1.3-6

- include patches recently submitted and applied to upstream CVS

* Thu Nov 25 2010 Tomas Mraz <tmraz@redhat.com> 1.1.3-5

- add config for autocreation of subdirectories in /var/run (#656655)

- automatically enable kernel console in pam_securetty

* Wed Nov 10 2010 Tomas Mraz <tmraz@redhat.com> 1.1.3-4

- fix memory leak in pam_faillock

* Wed Nov 10 2010 Tomas Mraz <tmraz@redhat.com> 1.1.3-3

- fix segfault in faillock utility

- remove some cases where the information of existence of

  an user account could be leaked by the pam_faillock,

  document the remaining case

* Fri Nov  5 2010 Tomas Mraz <tmraz@redhat.com> 1.1.3-2

- fix a mistake in the abstract X-socket connect

- make pam_faillock work with screensaver

* Mon Nov  1 2010 Tomas Mraz <tmraz@redhat.com> 1.1.3-1

- upgrade to new upstream release fixing CVE-2010-3316 CVE-2010-3435

  CVE-2010-3853

- try to connect to an abstract X-socket first to verify we are

  at real console (#647191)

* Wed Sep 29 2010 jkeating - 1.1.2-2

- Rebuilt for gcc bug 634757

* Mon Sep 20 2010 Tomas Mraz <tmraz@redhat.com> 1.1.2-1

- add pam_faillock module implementing temporary account lock out based

  on authentication failures during a specified interval

- do not build some auxiliary tools that are not installed that require

  flex-static to build

- upgrade to new upstream release

* Thu Jul 15 2010 Tomas Mraz <tmraz@redhat.com> 1.1.1-5

- do not overwrite tallylog with empty file on upgrade

* Mon Feb 15 2010 Tomas Mraz <tmraz@redhat.com> 1.1.1-4

- change the default password hash to sha512

* Fri Jan 22 2010 Tomas Mraz <tmraz@redhat.com> 1.1.1-3

- fix wrong prompt when pam_get_authtok is used for new password

* Mon Jan 18 2010 Tomas Mraz <tmraz@redhat.com> 1.1.1-2

- fix build with disabled audit and SELinux (#556211, #556212)

* Thu Dec 17 2009 Tomas Mraz <tmraz@redhat.com> 1.1.1-1

- new upstream version with minor changes

* Mon Nov  2 2009 Tomas Mraz <tmraz@redhat.com> 1.1.0-7

- pam_console: fix memory corruption when executing handlers (patch by

  Stas Sergeev) and a few more fixes in the handler execution code (#532302)

* Thu Oct 29 2009 Tomas Mraz <tmraz@redhat.com> 1.1.0-6

- pam_xauth: set the approprate context when creating .xauth files (#531530)

* Tue Sep  1 2009 Tomas Mraz <tmraz@redhat.com> 1.1.0-5

- do not change permissions with pam_console_apply

- drop obsolete pam_tally module and the faillog file (#461258)

* Wed Aug 19 2009 Tomas Mraz <tmraz@redhat.com> 1.1.0-4

- rebuild with new libaudit

* Mon Jul 27 2009 Tomas Mraz <tmraz@redhat.com> 1.1.0-3

- fix for pam_cracklib from upstream

* Sat Jul 25 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.1.0-2

- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild

* Tue Jun 23 2009 Tomas Mraz <tmraz@redhat.com> 1.1.0-1

- update to new upstream version

* Wed May 13 2009 Tomas Mraz <tmraz@redhat.com> 1.0.92-1

- update to new upstream version

* Fri Apr 10 2009 Tomas Mraz <tmraz@redhat.com> 1.0.91-6

- add password-auth, fingerprint-auth, and smartcard-auth

  for applications which can use them namely gdm (#494874)

  patch by Ray Strode

* Thu Mar 26 2009 Tomas Mraz <tmraz@redhat.com> 1.0.91-5

- replace also other std descriptors (#491471)

* Tue Mar 17 2009 Tomas Mraz <tmraz@redhat.com> 1.0.91-3

- we must replace the stdin when execing the helper (#490644)

* Mon Mar 16 2009 Tomas Mraz <tmraz@redhat.com> 1.0.91-2

- do not close stdout/err when execing the helpers (#488147)

* Mon Mar  9 2009 Tomas Mraz <tmraz@redhat.com> 1.0.91-1

- upgrade to new upstream release

* Fri Feb 27 2009 Tomas Mraz <tmraz@redhat.com> 1.0.90-4

- fix parsing of config files containing non-ASCII characters

- fix CVE-2009-0579 (mininimum days for password change ignored) (#487216)

- pam_access: improve handling of hostname resolution

* Thu Feb 26 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.0.90-3

- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild

* Mon Jan 19 2009 Tomas Mraz <tmraz@redhat.com> 1.0.90-2

- add helper to pam_mkhomedir for proper SELinux confinement (#476784)

* Tue Dec 16 2008 Tomas Mraz <tmraz@redhat.com> 1.0.90-1

- upgrade to new upstream release

- add --disable-prelude (#466242)

* Tue Sep 23 2008 Tomas Mraz <tmraz@redhat.com> 1.0.2-2

- new password quality checks in pam_cracklib

- report failed logins from btmp in pam_lastlog

- allow larger groups in modutil functions

- fix leaked file descriptor in pam_tally

* Mon Sep  8 2008 Tomas Mraz <tmraz@redhat.com> 1.0.2-1

- pam_loginuid: uids are unsigned (#460241)

- new minor upstream release

- use external db4

- drop tests for not pulling in libpthread (as NPTL should

  be safe)

* Wed Jul  9 2008 Tomas Mraz <tmraz@redhat.com> 1.0.1-5

- update internal db4

* Wed May 21 2008 Tomas Mraz <tmraz@redhat.com> 1.0.1-4

- pam_namespace: allow safe creation of directories owned by user (#437116)

- pam_unix: fix multiple error prompts on password change (#443872)

* Tue May 20 2008 Tomas Mraz <tmraz@redhat.com> 1.0.1-3

- pam_selinux: add env_params option which will be used by OpenSSH

- fix build with new autoconf

* Tue Apr 22 2008 Tomas Mraz <tmraz@redhat.com> 1.0.1-2

- pam_selinux: restore execcon properly (#443667)

* Fri Apr 18 2008 Tomas Mraz <tmraz@redhat.com> 1.0.1-1

- upgrade to new upstream release (one bugfix only)

- fix pam_sepermit use in screensavers

* Mon Apr  7 2008 Tomas Mraz <tmraz@redhat.com> 1.0.0-2

- fix regression in pam_set_item

* Fri Apr  4 2008 Tomas Mraz <tmraz@redhat.com> 1.0.0-1

- upgrade to new upstream release (bugfix only)

* Thu Mar 20 2008 Tomas Mraz <tmraz@redhat.com> 0.99.10.0-4

- pam_namespace: fix problem with level polyinst (#438264)

- pam_namespace: improve override checking for umount

- pam_selinux: fix syslogging a context after free() (#438338)

* Thu Feb 28 2008 Tomas Mraz <tmraz@redhat.com> 0.99.10.0-3

- update pam-redhat module tarball

- update internal db4

* Fri Feb 22 2008 Tomas Mraz <tmraz@redhat.com> 0.99.10.0-2

- if shadow is readable for an user do not prevent him from

  authenticating any user with unix_chkpwd (#433459)

- call audit from unix_chkpwd when appropriate

* Fri Feb 15 2008 Tomas Mraz <tmraz@redhat.com> 0.99.10.0-1

- new upstream release

- add default soft limit for nproc of 1024 to prevent

  accidental fork bombs (#432903)

* Mon Feb  4 2008 Tomas Mraz <tmraz@redhat.com> 0.99.8.1-18

- allow the package to build without SELinux and audit support (#431415)

- macro usage cleanup

* Mon Jan 28 2008 Tomas Mraz <tmraz@redhat.com> 0.99.8.1-17

- test for setkeycreatecon correctly

- add exclusive login mode of operation to pam_selinux_permit (original

  patch by Dan Walsh)

* Tue Jan 22 2008 Tomas Mraz <tmraz@redhat.com> 0.99.8.1-16

- add auditing to pam_access, pam_limits, and pam_time

- moved sanity testing code to check script

* Mon Jan 14 2008 Tomas Mraz <tmraz@redhat.com> 0.99.8.1-15

- merge review fixes (#226228)

* Tue Jan  8 2008 Tomas Mraz <tmraz@redhat.com> 0.99.8.1-14

- support for sha256 and sha512 password hashes

- account expiry checks moved to unix_chkpwd helper

* Wed Jan  2 2008 Tomas Mraz <tmraz@redhat.com> 0.99.8.1-13

- wildcard match support in pam_tty_audit (by Miloslav Trmač)

* Thu Nov 29 2007 Tomas Mraz <tmraz@redhat.com> 0.99.8.1-12

- add pam_tty_audit module (#244352) - written by Miloslav Trmač

* Wed Nov  7 2007 Tomas Mraz <tmraz@redhat.com> 0.99.8.1-11

- add substack support

* Tue Sep 25 2007 Tomas Mraz <tmraz@redhat.com> 0.99.8.1-10

- update db4 to 4.6.19 (#274661)

* Fri Sep 21 2007 Tomas Mraz <tmraz@redhat.com> 0.99.8.1-9

- do not preserve contexts when copying skel and other namespace.init

  fixes (#298941)

- do not free memory sent to putenv (#231698)

* Wed Sep 19 2007 Tomas Mraz <tmraz@redhat.com> 0.99.8.1-8

- add pam_selinux_permit module

- pam_succeed_if: fix in operator (#295151)

* Tue Sep 18 2007 Tomas Mraz <tmraz@redhat.com> 0.99.8.1-7

- when SELinux enabled always run the helper binary instead of

  direct shadow access (#293181)

* Fri Aug 24 2007 Tomas Mraz <tmraz@redhat.com> 0.99.8.1-6

- do not ask for blank password when SELinux confined (#254044)

- initialize homedirs in namespace init script (original patch by dwalsh)

* Wed Aug 22 2007 Tomas Mraz <tmraz@redhat.com> 0.99.8.1-5

- most devices are now handled by HAL and not pam_console (patch by davidz)

- license tag fix

- multifunction scanner device support (#251468)

* Mon Aug 13 2007 Tomas Mraz <tmraz@redhat.com> 0.99.8.1-4

- fix auth regression when uid != 0 from previous build (#251804)

* Mon Aug  6 2007 Tomas Mraz <tmraz@redhat.com> 0.99.8.1-3