%global so_ver 0

%global pam_redhat_version 1.2.0

Summary: An extensible library which provides authentication for applications

Name: pam

Version: 1.6.1

Release: 3%{?dist}

# The library is BSD licensed with option to relicense as GPLv2+

# - this option is redundant as the BSD license allows that anyway.

# pam_timestamp and pam_loginuid modules are GPLv2+.

License: BSD-3-Clause AND GPL-2.0-or-later

URL: http://www.linux-pam.org/

Source0: https://github.com/linux-pam/linux-pam/releases/download/v%{version}/Linux-PAM-%{version}.tar.xz

Source1: https://github.com/linux-pam/linux-pam/releases/download/v%{version}/Linux-PAM-%{version}.tar.xz.asc

Source2: https://releases.pagure.org/pam-redhat/pam-redhat-%{pam_redhat_version}.tar.xz

Source3: macros.%{name}

Source5: other.pamd

Source10: config-util.pamd

Source11: dlopen.sh

Source12: system-auth.5

Source13: config-util.5

Source15: pamtmp.conf

Source17: postlogin.5

Source18: https://www.gnu.org/licenses/old-licenses/gpl-2.0.txt

Patch1:  pam-1.6.0-redhat-modules.patch

Patch2:  pam-1.6.1-noflex.patch

Patch3:  pam-1.5.3-unix-nomsg.patch

# https://github.com/linux-pam/linux-pam/commit/bd2f695b3d89efe0c52bba975f9540634125178a

Patch4:  pam-1.6.1-sast-fixes.patch

# https://github.com/linux-pam/linux-pam/commit/aabd5314a6d76968c377969b49118a2df3f97003

Patch5:  pam-1.6.1-pam-env-econf-read-file-fixes.patch

%{load:%{SOURCE3}}

### Dependencies ###

Requires: authselect >= 1.3

Requires: gdbm

Requires: libpwquality%{?_isa}

Requires: pam-libs%{?_isa} = %{version}-%{release}

Requires: setup

Suggests: libdb-convert-util

### Build Dependencies ###

BuildRequires: audit-libs-devel

BuildRequires: autoconf

BuildRequires: automake

BuildRequires: bison

BuildRequires: flex

BuildRequires: gcc

BuildRequires: gdbm-devel

BuildRequires: gettext-devel

BuildRequires: libeconf-devel

BuildRequires: libnsl2-devel

BuildRequires: libselinux-devel

BuildRequires: libtirpc-devel

BuildRequires: libtool

BuildRequires: libxcrypt-devel

BuildRequires: make

BuildRequires: openssl-devel

BuildRequires: perl-interpreter

BuildRequires: pkgconfig

BuildRequires: sed

BuildRequires: systemd

%description

PAM (Pluggable Authentication Modules) is a system security tool that

allows system administrators to set authentication policy without

having to recompile programs that handle authentication.

%package devel

Summary: Files needed for developing PAM-aware applications and modules for PAM

Requires: pam-libs%{?_isa} = %{version}-%{release}

%description devel

PAM (Pluggable Authentication Modules) is a system security tool that

allows system administrators to set authentication policy without

having to recompile programs that handle authentication. This package

contains header files used for building both PAM-aware applications

and modules for use with the PAM system.

%package doc

Summary: Extra documentation for PAM.

Requires: pam = %{version}-%{release}

Obsoletes: pam-docs < 1.5.2-6

Provides: pam-docs = %{version}-%{release}

BuildArch: noarch

BuildRequires: docbook5-schemas

BuildRequires: docbook5-style-xsl

BuildRequires: elinks

BuildRequires: libxslt

BuildRequires: linuxdoc-tools

%description doc

PAM (Pluggable Authentication Modules) is a system security tool that

allows system administrators to set authentication policy without

having to recompile programs that handle authentication. The pam-doc

contains extra documentation for PAM. Currently, this includes additional

documentation in txt and html format.

%package libs

Summary: Shared libraries of the PAM package

# Make sure that if we don't try to upgrade -libs but not the

# main pam package and get file conflicts:

Conflicts: pam < 1.5.2-11

%description libs

PAM (Pluggable Authentication Modules) is a system security tool that

allows system administrators to set authentication policy without

having to recompile programs that handle authentication. The pam-libs

contains the shared libraries for PAM.

%prep

%setup -q -n Linux-PAM-%{version} -a 2

perl -pi -e "s/ppc64-\*/ppc64-\* \| ppc64p7-\*/" build-aux/config.sub

perl -pi -e "s/\/lib \/usr\/lib/\/lib \/usr\/lib \/lib64 \/usr\/lib64/" m4/libtool.m4

# Add custom modules.

mv pam-redhat-%{pam_redhat_version}/* modules

cp %{SOURCE18} .

%patch -P 1 -p1 -b .redhat-modules

%patch -P 2 -p1 -b .noflex

%patch -P 3 -p1 -b .nomsg

%patch -P 4 -p1 -b .static-analyzer

%patch -P 5 -p1 -b .pam-env-econf-read-file-fixes

autoreconf -i

%build

%configure \

  --libdir=%{_pam_libdir} \

  --includedir=%{_includedir}/security \

  --disable-rpath \

  --disable-static \

  --disable-prelude \

  --enable-audit \

  --enable-openssl \

  --enable-selinux \

  --enable-lastlog \

  --enable-db=gdbm

%make_build -C po update-gmo

%make_build

%install

mkdir -p doc/txts

for readme in modules/pam_*/README ; do

  cp -f ${readme} doc/txts/README.`dirname ${readme} | sed -e 's|^modules/||'`

done

# Install the macros file

install -D -m 644 %{SOURCE3} %{buildroot}%{_rpmconfigdir}/macros.d/macros.%{name}

# Install the binaries, libraries, and modules.

%make_install LDCONFIG=:

# Temporary compat link

ln -sf pam_sepermit.so %{buildroot}%{_pam_moduledir}/pam_selinux_permit.so

# RPM uses docs from source tree

rm -rf %{buildroot}%{_datadir}/doc/Linux-PAM

# Included in setup package

rm -f %{buildroot}%{_sysconfdir}/environment

# Install default configuration files.

install -d -m 755 %{buildroot}%{_pam_confdir}

install -d -m 755 %{buildroot}%{_pam_vendordir}

install -m 644 %{SOURCE5} %{buildroot}%{_pam_confdir}/other

install -m 644 %{SOURCE10} %{buildroot}%{_pam_confdir}/config-util

install -m 600 /dev/null %{buildroot}%{_pam_secconfdir}/opasswd

install -d -m 755 %{buildroot}/var/log

install -d -m 755 %{buildroot}/var/run/faillock

# Install man pages.

install -m 644 %{SOURCE12} %{SOURCE13} %{SOURCE17} %{buildroot}%{_mandir}/man5/

ln -sf system-auth.5 %{buildroot}%{_mandir}/man5/password-auth.5

ln -sf system-auth.5 %{buildroot}%{_mandir}/man5/fingerprint-auth.5

ln -sf system-auth.5 %{buildroot}%{_mandir}/man5/smartcard-auth.5

for phase in auth acct passwd session ; do

  ln -sf pam_unix.so %{buildroot}%{_pam_moduledir}/pam_unix_${phase}.so

done

# Remove .la files and make new .so links -- this depends on the value

# of _libdir not changing, and *not* being /usr/lib.

for lib in libpam libpamc libpam_misc ; do

  rm -f %{buildroot}%{_pam_libdir}/${lib}.la

done

rm -f %{buildroot}%{_pam_moduledir}/*.la

%if "%{_pam_libdir}" != "%{_libdir}"

install -d -m 755 %{buildroot}%{_libdir}

for lib in libpam libpamc libpam_misc ; do

  pushd %{buildroot}%{_libdir}

  ln -sf %{_pam_libdir}/${lib}.so.*.* ${lib}.so

  popd

  rm -f %{buildroot}%{_pam_libdir}/${lib}.so

done

%endif

# Duplicate doc file sets.

rm -fr %{buildroot}/usr/share/doc/pam

# Install the file for autocreation of /var/run subdirectories on boot

install -m644 -D %{SOURCE15} %{buildroot}%{_prefix}/lib/tmpfiles.d/pam.conf

# Install systemd unit file.

install -m644 -D modules/pam_namespace/pam_namespace.service \

  %{buildroot}%{_unitdir}/pam_namespace.service

# Install doc files to unified location.

install -d -m 755 %{buildroot}%{_pkgdocdir}/{adg/html,mwg/html,sag/html,txts}

install -p -m 644 doc/specs/rfc86.0.txt %{buildroot}%{_pkgdocdir}

install -p -m 644 doc/txts/* %{buildroot}%{_pkgdocdir}/txts

for i in adg mwg sag; do

  install -p -m 644 doc/$i/*.txt %{buildroot}%{_pkgdocdir}/$i

  cp -pr doc/$i/html/* %{buildroot}%{_pkgdocdir}/$i/html

done

find %{buildroot}%{_pkgdocdir} -type d | xargs chmod 755

find %{buildroot}%{_pkgdocdir} -type f | xargs chmod 644

%find_lang Linux-PAM

%check

# Make sure every module subdirectory gave us a module.  Yes, this is hackish.

for dir in modules/pam_* ; do

if [ -d ${dir} ] ; then

  [ ${dir} = "modules/pam_selinux" ] && continue

  [ ${dir} = "modules/pam_sepermit" ] && continue

  [ ${dir} = "modules/pam_tty_audit" ] && continue

  if ! ls -1 %{buildroot}%{_pam_moduledir}/`basename ${dir}`*.so ; then

    echo ERROR `basename ${dir}` did not build a module.

    exit 1

  fi

fi

done

# Check for module problems.  Specifically, check that every module we just

# installed can actually be loaded by a minimal PAM-aware application.

/sbin/ldconfig -n %{buildroot}%{_pam_libdir}

for module in %{buildroot}%{_pam_moduledir}/pam*.so ; do

  if ! env LD_LIBRARY_PATH=%{buildroot}%{_pam_libdir} \

       %{SOURCE11} -ldl -lpam -L%{buildroot}%{_libdir} ${module} ; then

    echo ERROR module: ${module} cannot be loaded.

    exit 1

  fi

done

%files -f Linux-PAM.lang

%license Copyright

%license gpl-2.0.txt

%dir %{_pam_confdir}

%dir %{_pam_vendordir}

%config(noreplace) %{_pam_confdir}/other

%config(noreplace) %{_pam_confdir}/config-util

%{_rpmconfigdir}/macros.d/macros.%{name}

%{_sbindir}/pam_namespace_helper

%{_sbindir}/faillock

%attr(4755,root,root) %{_sbindir}/pam_timestamp_check

%attr(4755,root,root) %{_sbindir}/unix_chkpwd

%attr(0700,root,root) %{_sbindir}/unix_update

%attr(0755,root,root) %{_sbindir}/mkhomedir_helper

%attr(0755,root,root) %{_sbindir}/pwhistory_helper

%dir %{_pam_moduledir}

%{_pam_moduledir}/pam_access.so

%{_pam_moduledir}/pam_canonicalize_user.so

%{_pam_moduledir}/pam_chroot.so

%{_pam_moduledir}/pam_debug.so

%{_pam_moduledir}/pam_deny.so

%{_pam_moduledir}/pam_echo.so

%{_pam_moduledir}/pam_env.so

%{_pam_moduledir}/pam_exec.so

%{_pam_moduledir}/pam_faildelay.so

%{_pam_moduledir}/pam_faillock.so

%{_pam_moduledir}/pam_filter.so

%{_pam_moduledir}/pam_ftp.so

%{_pam_moduledir}/pam_group.so

%{_pam_moduledir}/pam_issue.so

%{_pam_moduledir}/pam_keyinit.so

%{_pam_moduledir}/pam_lastlog.so

%{_pam_moduledir}/pam_limits.so

%{_pam_moduledir}/pam_listfile.so

%{_pam_moduledir}/pam_localuser.so

%{_pam_moduledir}/pam_loginuid.so

%{_pam_moduledir}/pam_mail.so

%{_pam_moduledir}/pam_mkhomedir.so

%{_pam_moduledir}/pam_motd.so

%{_pam_moduledir}/pam_namespace.so

%{_pam_moduledir}/pam_nologin.so

%{_pam_moduledir}/pam_permit.so

%{_pam_moduledir}/pam_postgresok.so

%{_pam_moduledir}/pam_pwhistory.so

%{_pam_moduledir}/pam_rhosts.so

%{_pam_moduledir}/pam_rootok.so

%{_pam_moduledir}/pam_selinux.so

%{_pam_moduledir}/pam_selinux_permit.so

%{_pam_moduledir}/pam_sepermit.so

%{_pam_moduledir}/pam_securetty.so

%{_pam_moduledir}/pam_setquota.so

%{_pam_moduledir}/pam_shells.so

%{_pam_moduledir}/pam_stress.so

%{_pam_moduledir}/pam_succeed_if.so

%{_pam_moduledir}/pam_time.so

%{_pam_moduledir}/pam_timestamp.so

%{_pam_moduledir}/pam_tty_audit.so

%{_pam_moduledir}/pam_umask.so

%{_pam_moduledir}/pam_unix.so

%{_pam_moduledir}/pam_unix_acct.so

%{_pam_moduledir}/pam_unix_auth.so

%{_pam_moduledir}/pam_unix_passwd.so

%{_pam_moduledir}/pam_unix_session.so

%{_pam_moduledir}/pam_userdb.so

%{_pam_moduledir}/pam_usertype.so

%{_pam_moduledir}/pam_warn.so

%{_pam_moduledir}/pam_wheel.so

%{_pam_moduledir}/pam_xauth.so

%{_pam_moduledir}/pam_filter

%{_unitdir}/pam_namespace.service

%dir %{_pam_secconfdir}

%config(noreplace) %{_pam_secconfdir}/access.conf

%config(noreplace) %{_pam_secconfdir}/chroot.conf

%config(noreplace) %{_pam_secconfdir}/faillock.conf

%config(noreplace) %{_pam_secconfdir}/group.conf

%config(noreplace) %{_pam_secconfdir}/limits.conf

%dir %{_pam_secconfdir}/limits.d

%config(noreplace) %{_pam_secconfdir}/namespace.conf

%dir %{_pam_secconfdir}/namespace.d

%attr(755,root,root) %config(noreplace) %{_pam_secconfdir}/namespace.init

%config(noreplace) %{_pam_secconfdir}/pam_env.conf

%config(noreplace) %{_pam_secconfdir}/pwhistory.conf

%config(noreplace) %{_pam_secconfdir}/time.conf

%config(noreplace) %{_pam_secconfdir}/opasswd

%config(noreplace) %{_pam_secconfdir}/sepermit.conf

%dir /var/run/sepermit

%dir /var/run/faillock

%{_prefix}/lib/tmpfiles.d/pam.conf

%{_mandir}/man5/*

%{_mandir}/man8/*

%files devel

%dir %{_pkgdocdir}

%doc %{_pkgdocdir}/rfc86.0.txt

%{_includedir}/security

%{_mandir}/man3/*

%{_libdir}/libpam.so

%{_libdir}/libpamc.so

%{_libdir}/libpam_misc.so

%{_libdir}/pkgconfig/pam.pc

%{_libdir}/pkgconfig/pam_misc.pc

%{_libdir}/pkgconfig/pamc.pc

%files doc

%doc %{_pkgdocdir}

%files libs

%license Copyright

%license gpl-2.0.txt

%{_pam_libdir}/libpam.so.%{so_ver}*

%{_pam_libdir}/libpamc.so.%{so_ver}*

%{_pam_libdir}/libpam_misc.so.%{so_ver}*

%changelog

* Tue May 28 2024 Iker Pedrosa <ipedrosa@redhat.com> - 1.6.1-3

- pam_env: fixes for NULL environment variables (#2280896)

* Mon May 27 2024 Iker Pedrosa <ipedrosa@redhat.com> - 1.6.1-2

- Several fixes for issues detected by static analyzer tools

* Wed Apr 10 2024 Iker Pedrosa <ipedrosa@redhat.com> - 1.6.1-1

- Rebase to release 1.6.1

* Thu Feb 15 2024 Iker Pedrosa <ipedrosa@redhat.com> - 1.6.0-2

- pam_unix: do not warn if password aging is disabled (#2263689)

* Tue Jan 23 2024 Iker Pedrosa <ipedrosa@redhat.com> - 1.6.0-1

- Rebase to release 1.6.0

  Resolves: #2258964

* Sun Jan 21 2024 Fedora Release Engineering <releng@fedoraproject.org>

- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

* Mon Dec 18 2023 Ding-Yi Chen <dchen@redhat.com> - 1.5.3-9

- pam.conf: Remove tallylog (#2253817)

* Tue Nov 21 2023 Iker Pedrosa <ipedrosa@redhat.com> - 1.5.3-8

- Suggest libdb-convert-util (#2245149 and #1788543)

* Tue Nov  7 2023 Iker Pedrosa <ipedrosa@redhat.com> - 1.5.3-7

- Include openssl-devel build dependency

* Fri Nov  3 2023 Iker Pedrosa <ipedrosa@redhat.com> - 1.5.3-6

- Drop explicit dependencies (#2247250)

* Mon Oct 30 2023 Iker Pedrosa <ipedrosa@redhat.com> - 1.5.3-5

- Explicitly state package dependencies and reorganize them

* Mon Oct 23 2023 Iker Pedrosa <ipedrosa@redhat.com> - 1.5.2-4

- Switch pam_userdb from BerkeleyDB to GDBM (#2245149 and #1788543)

* Thu Oct 19 2023 Iker Pedrosa <ipedrosa@redhat.com> - 1.5.3-3

- pam_pwhistory: fix passing NULL filename argument to pwhistory helper

* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org>

- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild

* Fri May 19 2023 Björn Esser <besser82@fedoraproject.org> - 1.5.3-1

- Rebase to release 1.5.3

  Resolves: #2196709

- Drop pam-1.5.2-pwhistory-config.patch and pam-1.5.2-configure-c99.patch,

  as those patches are implemented upstream

- Realign left-over patches

- Update build requirements for documentation (docbook5)

- Remove --enable-vendordir from configuration

- Enable (deprecated) pam_lastlog module

* Tue Apr 25 2023 Björn Esser <besser82@fedoraproject.org> - 1.5.2-19

- Replace deprecated '%%patchN' with '%%patch -P N'

* Tue Apr 25 2023 Arjun Shankar <arjun@redhat.com> - 1.5.2-18

- Port configure script to C99

* Thu Feb  9 2023 Iker Pedrosa <ipedrosa@redhat.com> - 1.5.2-17

- Remove pam_console (#2166692)

- Rebase to pam-redhat-1.2.0

* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org>

- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild

* Mon Dec 19 2022 Iker Pedrosa <ipedrosa@redhat.com> - 1.5.2-15

- SPDX license migration

* Fri Jul 22 2022 Fedora Release Engineering <releng@fedoraproject.org>

- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild

* Mon Jul 18 2022 Iker Pedrosa <ipedrosa@redhat.com> - 1.5.2-13

- pam_pwhistory: load config from file

* Sun Feb 27 2022 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.5.2-12

- Add Conflicts for pam version before the split

* Thu Feb 17 2022 Björn Esser <besser82@fedoraproject.org> - 1.5.2-11

- Split shared libraries into pam-libs package (#2055572)

* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org>

- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild

* Mon Jan 10 2022 Ondrej Mosnacek <omosnace@redhat.com> - 1.5.2-9

- Remove conflicting ownership of motd.d directories

* Tue Nov 16 2021 Pavel Březina <pbrezina@redhat.com> - 1.5.2-8

- systemd-auth, smartcard-auth, fingerprint-auth, password-auth and postlogin are now owned by authselect (#2023738)

* Fri Nov 12 2021 Björn Esser <besser82@fedoraproject.org> - 1.5.2-7

- Rebuild(libnsl2)

* Wed Oct 06 2021 Björn Esser <besser82@fedoraproject.org> - 1.5.2-6

- Remove old cruft from spec file

- Rename docs sub-package to doc

- Replace $RPM_BUILD_ROOT with %%{buildroot}

- Move documentation to %%{_pkgdocdir}

- Constantly use spaces for indentation

* Thu Sep 23 2021 Björn Esser <besser82@fedoraproject.org> - 1.5.2-5

- Rebase to pam-redhat-1.1.5

- Drop explicit dependency on openssl, as auto-deps will pull it in

- Conditionalize BR: openssl >= 3.0.0 to supported distributions

* Thu Sep 23 2021 Iker Pedrosa <ipedrosa@redhat.com> - 1.5.2-4

- Remove the /etc/motd.d directory to exclude its ownership from pam (#1968131)

- pam_timestamp: enable openssl hmac authentication on supported

  distributions (Fedora >= 36 and RHEL >= 9) (#1947294)

- Clean spec file: organize dependencies and move URL location

* Thu Sep 23 2021 Björn Esser <besser82@fedoraproject.org> - 1.5.2-3

- Update patch for parallel build

* Wed Sep 22 2021 Björn Esser <besser82@fedoraproject.org> - 1.5.2-2

- Add a patch to fix parallel builds with autgenerated sources

* Sat Sep 04 2021 Björn Esser <besser82@fedoraproject.org> - 1.5.2-1

- Rebase to release 1.5.2

  Resolves: #2001208

- Add so_ver macro to avoid accidental soname bumps

- Add a patch to fix a missing header include in pam_console

* Thu Jul 22 2021 Iker Pedrosa <ipedrosa@redhat.com> - 1.5.1-9

- Add macros file to allow other packages to stop hardcoding directory names

* Fri Jul  9 2021 Iker Pedrosa <ipedrosa@redhat.com> - 1.5.1-8

- Fix issues detected by covscan tool

* Thu Jun 10 2021 Björn Esser <besser82@fedoraproject.org> - 1.5.1-7

- Change the default password hash method to yescrypt

* Thu Jun 10 2021 Björn Esser <besser82@fedoraproject.org> - 1.5.1-6

- Add a patch to not use crypt_checksalt for password expiration

  Resolves: #1965345, #1967150

* Fri Apr 16 2021 Benjamin Berg <bberg@redhat.com> - 1.5.1-5

- Add script to avoid fingerprint-auth issues for long term Fedora users

  Resolves: #1942443

* Mon Apr 12 2021 Iker Pedrosa <ipedrosa@redhat.com> - 1.5.1-4

- Change fingerprint-auth.pamd to return PAM_AUTHINFO_UNAVAIL from pam_fprintd.so

- Clean auto-generated message from pam stack files

* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.5.1-3

- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild

* Mon Nov 30 2020 Iker Pedrosa <ipedrosa@redhat.com> - 1.5.1-2

- Add BuildRequires: make (#1902520)

* Thu Nov 26 2020 Iker Pedrosa <ipedrosa@redhat.com> - 1.5.1-1

- Rebase to release 1.5.1

- fix CVE-2020-27780: authentication bypass when the user doesn't exist

  and root password is blank (#1901173)

* Wed Nov 11 2020 Iker Pedrosa <ipedrosa@redhat.com> - 1.5.0-1

- Rebase to release 1.5.0

- Rebase to pam-redhat-1.1.4

- Remove pam_cracklib, pam_tally and pam_tally2

- spec file cleanup

* Fri Nov  6 2020 Iker Pedrosa <ipedrosa@redhat.com> - 1.4.0-7

- libpam: fix memory leak in pam_start (#1894630)

* Mon Oct 19 2020 Iker Pedrosa <ipedrosa@redhat.com> - 1.4.0-6

- pam_unix: fix missing initialization of daysleft  (#1887077)

- pam_motd: change privilege message prompt to default (#1861640)

* Wed Oct 14 2020 Iker Pedrosa <ipedrosa@redhat.com> - 1.4.0-5

- pam_motd: read motd files with target user credentials skipping unreadable ones (#1861640)

- Clarify upstreamed patches

* Tue Aug 04 2020 Tom Stellard <tstellar@redhat.com> - 1.4.0-4

- Add BuildRequires: gcc

- https://docs.fedoraproject.org/en-US/packaging-guidelines/C_and_C++/#_packaging

* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.0-3

- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild

* Thu Jul  2 2020 Iker Pedrosa <ipedrosa@redhat.com> - 1.4.0-2

- Enable layered configuration with distribution configs in /usr/share/pam.d

- Added new pam-redhat tarball to lookaside cache

* Wed Jun 24 2020 Iker Pedrosa <ipedrosa@redhat.com> - 1.4.0-1

- Rebased to release 1.4.0

- Rebased to pam-redhat-1.1.3

- Removed pam_cracklib as it has been deprecated

* Mon Jun 22 2020 Iker Pedrosa <ipedrosa@redhat.com> - 1.3.1-28

- pam_faillock: change /run/faillock/$USER permissions to 0660 (#1661822)

* Wed Jun 17 2020 Iker Pedrosa <ipedrosa@redhat.com> - 1.3.1-27

- pam_unix and pam_usertype: avoid determining if user exists (#1629598)

* Thu May 14 2020 Iker Pedrosa <ipedrosa@redhat.com> 1.3.1-26

- pam_tty_audit: if kernel audit is disabled return PAM_IGNORE (#1775357)

- pam_modutil_sanitize_helper_fds: fix SIGPIPE effect of PAM_MODUTIL_PIPE_FD (#1791970)

* Thu Apr 23 2020 Iker Pedrosa <ipedrosa@redhat.com> - 1.3.1-25

- docs: splitted documentation in subpackage -docs

* Mon Mar 9 2020 Iker Pedrosa <ipedrosa@redhat.com> - 1.3.1-24

- pam_selinux: check unknown object classes or permissions in current policy

* Tue Feb 4 2020 Pavel Březina <pbrezina@redhat.com> - 1.3.1-23

- Add pam_usertype.so

* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.3.1-22

- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild

* Wed Dec 18 2019 Tomáš Mráz <tmraz@redhat.com> 1.3.1-21

- pam_faillock: Fix regression in admin_group support

* Wed Oct 16 2019 Tomáš Mráz <tmraz@redhat.com> 1.3.1-20

- pam_namespace: Support noexec, nosuid and nodev flags for tmpfs mounts

- Drop tallylog and pam_tally documentation

- pam_faillock: Support local_users_only option

- pam_lastlog: Do not display failed attempts with PAM_SILENT flag

- pam_lastlog: Support unlimited option to override fsize limit

- pam_unix: Log if user authenticated without password

- pam_tty_audit: Improve manual page

- Optimize closing fds when spawning helpers

- Fix duplicate password verification in pam_authtok_verify()

* Mon Sep  9 2019 Tomáš Mráz <tmraz@redhat.com> 1.3.1-19

- pam_faillock: Support configuration file /etc/security/faillock.conf

* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.3.1-18

- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild

* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.3.1-17

- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild

* Mon Jan 14 2019 Björn Esser <besser82@fedoraproject.org> - 1.3.1-16

- Rebuilt for libcrypt.so.2 (#1666033)

* Thu Dec 20 2018 Tomáš Mráz <tmraz@redhat.com> 1.3.1-15

- Add the motd.d directories (empty) to silence warnings and to

  provide proper ownership for them (#1660935)

* Tue Dec  4 2018 Tomáš Mráz <tmraz@redhat.com> 1.3.1-14

- Update Red Hat PAM modules to version 1.0.0 which includes pam_faillock

- Drop also pam_tally2 which was obsoleted and deprecated long time ago

* Sun Dec 02 2018 Björn Esser <besser82@fedoraproject.org> - 1.3.1-13

- Backport upstream commit reporting disabled or invalid hashes to syslog

- Backport upstream commit fixing syslog for disabled or invalid hashes

* Wed Nov 28 2018 Robert Fairley <rfairley@redhat.com> 1.3.1-12

- Backport upstream commit pam_motd: Support multiple motd paths specified, with filename overrides (#69)

- Backport upstream commit pam_motd: Fix segmentation fault when no motd_dir specified (#76)

* Mon Nov 26 2018 Tomáš Mráz <tmraz@redhat.com> 1.3.1-11

- Completely drop the check of invalid or disabled salt via crypt_checksalt

* Sun Nov 25 2018 Björn Esser <besser82@fedoraproject.org> - 1.3.1-10

- Fix passphraseless sudo with crypt_checksalt (#1653023)

* Fri Nov 23 2018 Björn Esser <besser82@fedoraproject.org> - 1.3.1-9

- Backport upstream commit removing an obsolete prototype

- Backport upstream commit preferring bcrypt_b ($2b$) for blowfish

- Backport upstream commit preferring gensalt with autoentropy

- Backport upstream commit using crypt_checksalt for password aging

- Backport upstream commit adding support for (gost-)yescrypt

- Update the no-MD5-fallback patch for alignment

* Fri Nov 16 2018 Björn Esser <besser82@fedoraproject.org> - 1.3.1-8

- Use %%ldconfig_scriptlets

- Drop Requires(post), not needed anymore

- Prefer %%global over %%define

* Tue Nov 13 2018 Björn Esser <besser82@fedoraproject.org> - 1.3.1-7

- when building against libxcrypt >= 4.3.3-2, we can avoid the explicit

  dependency on libxcrypt >= 4.3.3-1

* Mon Nov 12 2018 Björn Esser <besser82@fedoraproject.org> - 1.3.1-6

- add explicit (Build)Requires for libxcrypt >= 4.3.3-1

* Mon Nov 12 2018 Björn Esser <besser82@fedoraproject.org> - 1.3.1-5

- rebuilt against libxcrypt-4.3.3 to enable the use of crypt_gensalt_r

* Mon Sep 10 2018 Tomáš Mráz <tmraz@redhat.com> 1.3.1-4

- add pam_umask to postlogin PAM configuration file

- fix some issues found by Coverity scan

* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.3.1-3

- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild

* Fri Jun  8 2018 Tomáš Mráz <tmraz@redhat.com> 1.3.1-1

- use /run instead of /var/run in pamtmp.conf (#1588612)

* Fri May 18 2018 Tomáš Mráz <tmraz@redhat.com> 1.3.1-1

- new upstream release 1.3.1 with multiple improvements

* Thu Feb 08 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.3.0-10

- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

* Tue Jan 30 2018 Tomáš Mráz <tmraz@redhat.com> 1.3.0-9

- and the NIS support now also requires libnsl2

* Sat Jan 20 2018 Björn Esser <besser82@fedoraproject.org> - 1.3.0-8

- Rebuilt for switch to libxcrypt

* Thu Jan 11 2018 Tomáš Mráz <tmraz@redhat.com> 1.3.0-7

- the NIS support now requires libtirpc

* Mon Aug 21 2017 Tomáš Mráz <tmraz@redhat.com> 1.3.0-6

- add admin_group option to pam_faillock (#1285550)

* Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.3.0-5

- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild

* Thu Jul 27 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.3.0-4

- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild

* Thu Apr 20 2017 Tomáš Mráz <tmraz@redhat.com> 1.3.0-3

- drop superfluous 'Changing password' message from pam_unix (#658289)

* Sat Feb 11 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.3.0-2

- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild

* Fri May  6 2016 Tomáš Mráz <tmraz@redhat.com> 1.3.0-1

- new upstream release with multiple improvements

* Mon Apr 11 2016 Tomáš Mráz <tmraz@redhat.com> 1.2.1-8

- make cracklib-dicts dependency weak (#1323172)

* Wed Apr  6 2016 Tomáš Mráz <tmraz@redhat.com> 1.2.1-7

- do not drop PAM_OLDAUTHTOK if mismatched - can be used by further modules

* Mon Apr  4 2016 Tomáš Mráz <tmraz@redhat.com> 1.2.1-6

- pam_unix: use pam_get_authtok() and improve prompting

* Fri Feb  5 2016 Tomáš Mráz <tmraz@redhat.com> 1.2.1-5

- fix console device name in console.handlers (#1270224)

* Thu Feb 04 2016 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.1-4

- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild

* Fri Oct 16 2015 Tomáš Mráz <tmraz@redhat.com> 1.2.1-3

- pam_faillock: add possibility to set unlock_time to never

* Wed Aug 12 2015 Tomáš Mráz <tmraz@redhat.com> 1.2.1-2

- drop the nproc limit setting, it is causing more harm than it solves

* Fri Jun 26 2015 Tomáš Mráz <tmraz@redhat.com> 1.2.1-1

- new upstream release fixing security issue with unlimited password length

* Thu Jun 18 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.2.0-2

- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild

* Fri May 15 2015 Tomáš Mráz <tmraz@redhat.com> 1.2.0-1

- new upstream release with multiple minor improvements

* Fri Oct 17 2014 Tomáš Mráz <tmraz@redhat.com> 1.1.8-18

- use USER_MGMT type for auditing in the pam_tally2 and faillock

  apps (#1151576)

* Thu Sep 11 2014 Tomáš Mráz <tmraz@redhat.com> 1.1.8-17

- update the audit-grantor patch with the upstream changes

- pam_userdb: correct the example in man page (#1078784)

- pam_limits: check whether the utmp login entry is valid (#1080023)