%define pam_redhat_version 0.99.9-1

Summary: A security tool which provides authentication for applications

Name: pam

Version: 1.0.2

Release: 2%{?dist}

# The library is BSD licensed with option to relicense as GPLv2+ - this option is redundant

# as the BSD license allows that anyway. pam_timestamp and pam_console modules are GPLv2+,

# pam_rhosts_auth module is BSD with advertising

License: BSD and GPLv2+ and BSD with advertising

Group: System Environment/Base

Source0: http://ftp.us.kernel.org/pub/linux/libs/pam/library/Linux-PAM-%{version}.tar.bz2

Source1: http://ftp.us.kernel.org/pub/linux/libs/pam/library/Linux-PAM-%{version}.tar.bz2.sign

Source2: https://fedorahosted.org/releases/p/a/pam-redhat/pam-redhat-%{pam_redhat_version}.tar.bz2

Source5: other.pamd

Source6: system-auth.pamd

Source7: config-util.pamd

Source8: dlopen.sh

Source9: system-auth.5

Source10: config-util.5

Source11: 90-nproc.conf

Patch1:  pam-0.99.7.0-redhat-modules.patch

Patch5:  pam-1.0.1-autoreconf.patch

Patch10: pam-1.0.0-sepermit-screensaver.patch

Patch12: pam-1.0.0-selinux-env-params.patch

Patch21: pam-0.99.10.0-unix-audit-failed.patch

Patch22: pam-1.0.1-unix-prompts.patch

Patch31: pam-1.0.1-cracklib-try-first-pass.patch

Patch32: pam-1.0.1-tally-fail-close.patch

Patch33: pam-1.0.2-tally-fdleak.patch

Patch41: pam-1.0.1-namespace-create.patch

Patch42: pam-1.0.2-cracklib-pwquality.patch

Patch43: pam-0.99.6.2-lastlog-failed.patch

Patch44: pam-1.0.2-many-groups.patch

%define _sbindir /sbin

%define _moduledir /%{_lib}/security

%define _secconfdir %{_sysconfdir}/security

%define _pamconfdir %{_sysconfdir}/pam.d

%if %{?WITH_SELINUX:0}%{!?WITH_SELINUX:1}

%define WITH_SELINUX 1

%endif

%if %{?WITH_AUDIT:0}%{!?WITH_AUDIT:1}

%define WITH_AUDIT 1

%endif

BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)

Requires: cracklib, cracklib-dicts >= 2.8

Requires(post): coreutils, /sbin/ldconfig

BuildRequires: autoconf >= 2.60

BuildRequires: automake, libtool

BuildRequires: bison, flex, sed

BuildRequires: cracklib-devel, cracklib-dicts >= 2.8

BuildRequires: perl, pkgconfig, gettext

%if %{WITH_AUDIT}

BuildRequires: audit-libs-devel >= 1.0.8

Requires: audit-libs >= 1.0.8

%endif

%if %{WITH_SELINUX}

BuildRequires: libselinux-devel >= 1.33.2

Requires: libselinux >= 1.33.2

%endif

BuildRequires: glibc >= 2.3.90-37

Requires: glibc >= 2.3.90-37

BuildRequires: db4-devel

# Following deps are necessary only to build the pam library documentation.

BuildRequires: linuxdoc-tools, w3m, libxslt

BuildRequires: docbook-style-xsl, docbook-dtds

URL: http://www.us.kernel.org/pub/linux/libs/pam/index.html

%description

PAM (Pluggable Authentication Modules) is a system security tool that

allows system administrators to set authentication policy without

having to recompile programs that handle authentication.

%package devel

Group: Development/Libraries

Summary: Files needed for developing PAM-aware applications and modules for PAM

Requires: pam = %{version}-%{release}

%description devel

PAM (Pluggable Authentication Modules) is a system security tool that

allows system administrators to set authentication policy without

having to recompile programs that handle authentication. This package

contains header files and static libraries used for building both

PAM-aware applications and modules for use with PAM.

%prep

%setup -q -n Linux-PAM-%{version} -a 2

# Add custom modules.

mv pam-redhat-%{pam_redhat_version}/* modules

%patch1 -p1 -b .redhat-modules

%patch5 -p1 -b .autoreconf

%patch10 -p1 -b .screensaver

%patch12 -p0 -b .env-params

%patch21 -p1 -b .audit-failed

%patch22 -p1 -b .prompts

%patch31 -p1 -b .try-first-pass

%patch32 -p1 -b .fail-close

%patch33 -p1 -b .fdleak

%patch41 -p1 -b .create

%patch42 -p1 -b .pwquality

%patch43 -p1 -b .failed

%patch44 -p1 -b .many-groups

autoreconf

%build

%configure \

	--libdir=/%{_lib} \

	--includedir=%{_includedir}/security \

%if ! %{WITH_SELINUX}

	--disable-selinux \

%endif

%if ! %{WITH_AUDIT}

	--disable-audit \

%endif

	--enable-isadir=../..%{_moduledir}

make

# we do not use _smp_mflags because the build of sources in yacc/flex fails

%install

rm -rf $RPM_BUILD_ROOT

mkdir -p doc/txts

for readme in modules/pam_*/README ; do

	cp -f ${readme} doc/txts/README.`dirname ${readme} | sed -e 's|^modules/||'`

done

# Install the binaries, libraries, and modules.

make install DESTDIR=$RPM_BUILD_ROOT LDCONFIG=:

%if %{WITH_SELINUX}

# Temporary compat link

ln -sf pam_sepermit.so $RPM_BUILD_ROOT%{_moduledir}/pam_selinux_permit.so

%endif

# RPM uses docs from source tree

rm -rf $RPM_BUILD_ROOT%{_datadir}/doc/Linux-PAM

# Included in setup package

rm -f $RPM_BUILD_ROOT%{_sysconfdir}/environment

# Install default configuration files.

install -d -m 755 $RPM_BUILD_ROOT%{_pamconfdir}

install -m 644 %{SOURCE5} $RPM_BUILD_ROOT%{_pamconfdir}/other

install -m 644 %{SOURCE6} $RPM_BUILD_ROOT%{_pamconfdir}/system-auth

install -m 644 %{SOURCE7} $RPM_BUILD_ROOT%{_pamconfdir}/config-util

install -m 644 %{SOURCE11} $RPM_BUILD_ROOT%{_secconfdir}/limits.d/90-nproc.conf

install -m 600 /dev/null $RPM_BUILD_ROOT%{_secconfdir}/opasswd

install -d -m 755 $RPM_BUILD_ROOT/var/log

install -m 600 /dev/null $RPM_BUILD_ROOT/var/log/faillog

install -m 600 /dev/null $RPM_BUILD_ROOT/var/log/tallylog

# Install man pages.

install -m 644 %{SOURCE9} %{SOURCE10} $RPM_BUILD_ROOT%{_mandir}/man5/

for phase in auth acct passwd session ; do

	ln -sf pam_unix.so $RPM_BUILD_ROOT%{_moduledir}/pam_unix_${phase}.so 

done

# Remove .la files and make new .so links -- this depends on the value

# of _libdir not changing, and *not* being /usr/lib.

install -d -m 755 $RPM_BUILD_ROOT%{_libdir}

for lib in libpam libpamc libpam_misc ; do

pushd $RPM_BUILD_ROOT%{_libdir}

ln -sf ../../%{_lib}/${lib}.so.*.* ${lib}.so

popd

rm -f $RPM_BUILD_ROOT/%{_lib}/${lib}.so

rm -f $RPM_BUILD_ROOT/%{_lib}/${lib}.la

done

rm -f $RPM_BUILD_ROOT%{_moduledir}/*.la

# Duplicate doc file sets.

rm -fr $RPM_BUILD_ROOT/usr/share/doc/pam

# Create /lib/security in case it isn't the same as %{_moduledir}.

install -m755 -d $RPM_BUILD_ROOT/lib/security

%find_lang Linux-PAM

%check

# Make sure every module subdirectory gave us a module.  Yes, this is hackish.

for dir in modules/pam_* ; do

if [ -d ${dir} ] ; then

%if ! %{WITH_SELINUX}

        [ ${dir} = "modules/pam_selinux" ] && continue

%endif	

	if ! ls -1 $RPM_BUILD_ROOT%{_moduledir}/`basename ${dir}`*.so ; then

		echo ERROR `basename ${dir}` did not build a module.

		exit 1

	fi

fi

done

# Check for module problems.  Specifically, check that every module we just

# installed can actually be loaded by a minimal PAM-aware application.

/sbin/ldconfig -n $RPM_BUILD_ROOT/%{_lib}

for module in $RPM_BUILD_ROOT%{_moduledir}/pam*.so ; do

	if ! env LD_LIBRARY_PATH=$RPM_BUILD_ROOT/%{_lib} \

		 %{SOURCE8} -ldl -lpam -L$RPM_BUILD_ROOT/%{_libdir} ${module} ; then

		echo ERROR module: ${module} cannot be loaded.

		exit 1

	fi

done

%clean

rm -rf $RPM_BUILD_ROOT

%post

/sbin/ldconfig

if [ ! -a /var/log/faillog ] ; then

	install -m 600 /dev/null /var/log/faillog

fi

if [ ! -a /var/log/tallylog ] ; then

	install -m 600 /dev/null /var/log/tallylog

fi

%postun -p /sbin/ldconfig

%files -f Linux-PAM.lang

%defattr(-,root,root)

%dir %{_pamconfdir}

%config(noreplace) %{_pamconfdir}/other

%config(noreplace) %{_pamconfdir}/system-auth

%config(noreplace) %{_pamconfdir}/config-util

%doc Copyright

%doc doc/txts

%doc doc/sag/*.txt doc/sag/html

%doc doc/specs/rfc86.0.txt

/%{_lib}/libpam.so.*

/%{_lib}/libpamc.so.*

/%{_lib}/libpam_misc.so.*

%{_sbindir}/pam_console_apply

%{_sbindir}/pam_tally

%{_sbindir}/pam_tally2

%attr(4755,root,root) %{_sbindir}/pam_timestamp_check

%attr(4755,root,root) %{_sbindir}/unix_chkpwd

%attr(0700,root,root) %{_sbindir}/unix_update

%if %{_lib} != lib

%dir /lib/security

%endif

%dir %{_moduledir}

%{_moduledir}/pam_access.so

%{_moduledir}/pam_chroot.so

%{_moduledir}/pam_console.so

%{_moduledir}/pam_cracklib.so

%{_moduledir}/pam_debug.so

%{_moduledir}/pam_deny.so

%{_moduledir}/pam_echo.so

%{_moduledir}/pam_env.so

%{_moduledir}/pam_exec.so

%{_moduledir}/pam_faildelay.so

%{_moduledir}/pam_filter.so

%{_moduledir}/pam_ftp.so

%{_moduledir}/pam_group.so

%{_moduledir}/pam_issue.so

%{_moduledir}/pam_keyinit.so

%{_moduledir}/pam_lastlog.so

%{_moduledir}/pam_limits.so

%{_moduledir}/pam_listfile.so

%{_moduledir}/pam_localuser.so

%{_moduledir}/pam_loginuid.so

%{_moduledir}/pam_mail.so

%{_moduledir}/pam_mkhomedir.so

%{_moduledir}/pam_motd.so

%{_moduledir}/pam_namespace.so

%{_moduledir}/pam_nologin.so

%{_moduledir}/pam_permit.so

%{_moduledir}/pam_postgresok.so

%{_moduledir}/pam_rhosts.so

%{_moduledir}/pam_rootok.so

%if %{WITH_SELINUX}

%{_moduledir}/pam_selinux.so

%{_moduledir}/pam_selinux_permit.so

%{_moduledir}/pam_sepermit.so

%endif

%{_moduledir}/pam_securetty.so

%{_moduledir}/pam_shells.so

%{_moduledir}/pam_stress.so

%{_moduledir}/pam_succeed_if.so

%{_moduledir}/pam_tally.so

%{_moduledir}/pam_tally2.so

%{_moduledir}/pam_time.so

%{_moduledir}/pam_timestamp.so

%{_moduledir}/pam_tty_audit.so

%{_moduledir}/pam_umask.so

%{_moduledir}/pam_unix.so

%{_moduledir}/pam_unix_acct.so

%{_moduledir}/pam_unix_auth.so

%{_moduledir}/pam_unix_passwd.so

%{_moduledir}/pam_unix_session.so

%{_moduledir}/pam_userdb.so

%{_moduledir}/pam_warn.so

%{_moduledir}/pam_wheel.so

%{_moduledir}/pam_xauth.so

%{_moduledir}/pam_filter

%dir %{_secconfdir}

%config(noreplace) %{_secconfdir}/access.conf

%config(noreplace) %{_secconfdir}/chroot.conf

%config %{_secconfdir}/console.perms

%config(noreplace) %{_secconfdir}/console.handlers

%config(noreplace) %{_secconfdir}/group.conf

%config(noreplace) %{_secconfdir}/limits.conf

%dir %{_secconfdir}/limits.d

%config(noreplace) %{_secconfdir}/limits.d/90-nproc.conf

%config(noreplace) %{_secconfdir}/namespace.conf

%dir %{_secconfdir}/namespace.d

%attr(755,root,root) %config(noreplace) %{_secconfdir}/namespace.init

%config(noreplace) %{_secconfdir}/pam_env.conf

%config(noreplace) %{_secconfdir}/sepermit.conf

%config(noreplace) %{_secconfdir}/time.conf

%config(noreplace) %{_secconfdir}/opasswd

%dir %{_secconfdir}/console.apps

%dir %{_secconfdir}/console.perms.d

%config %{_secconfdir}/console.perms.d/50-default.perms

%dir /var/run/console

%dir /var/run/sepermit

%ghost %verify(not md5 size mtime) /var/log/faillog

%ghost %verify(not md5 size mtime) /var/log/tallylog

%{_mandir}/man5/*

%{_mandir}/man8/*

%files devel

%defattr(-,root,root)

%{_includedir}/security/

%{_mandir}/man3/*

%{_libdir}/libpam.so

%{_libdir}/libpamc.so

%{_libdir}/libpam_misc.so

%doc doc/mwg/*.txt doc/mwg/html

%doc doc/adg/*.txt doc/adg/html

%changelog

* Tue Sep 23 2008 Tomas Mraz <tmraz@redhat.com> 1.0.2-2

- new password quality checks in pam_cracklib

- report failed logins from btmp in pam_lastlog

- allow larger groups in modutil functions

- fix leaked file descriptor in pam_tally

* Mon Sep  8 2008 Tomas Mraz <tmraz@redhat.com> 1.0.2-1

- pam_loginuid: uids are unsigned (#460241)

- new minor upstream release

- use external db4

- drop tests for not pulling in libpthread (as NPTL should

  be safe)

* Wed Jul  9 2008 Tomas Mraz <tmraz@redhat.com> 1.0.1-5

- update internal db4

* Wed May 21 2008 Tomas Mraz <tmraz@redhat.com> 1.0.1-4

- pam_namespace: allow safe creation of directories owned by user (#437116)

- pam_unix: fix multiple error prompts on password change (#443872)

* Tue May 20 2008 Tomas Mraz <tmraz@redhat.com> 1.0.1-3

- pam_selinux: add env_params option which will be used by OpenSSH

- fix build with new autoconf

* Tue Apr 22 2008 Tomas Mraz <tmraz@redhat.com> 1.0.1-2

- pam_selinux: restore execcon properly (#443667)

* Fri Apr 18 2008 Tomas Mraz <tmraz@redhat.com> 1.0.1-1

- upgrade to new upstream release (one bugfix only)

- fix pam_sepermit use in screensavers

* Mon Apr  7 2008 Tomas Mraz <tmraz@redhat.com> 1.0.0-2

- fix regression in pam_set_item

* Fri Apr  4 2008 Tomas Mraz <tmraz@redhat.com> 1.0.0-1

- upgrade to new upstream release (bugfix only)

* Thu Mar 20 2008 Tomas Mraz <tmraz@redhat.com> 0.99.10.0-4

- pam_namespace: fix problem with level polyinst (#438264)

- pam_namespace: improve override checking for umount

- pam_selinux: fix syslogging a context after free() (#438338)

* Thu Feb 28 2008 Tomas Mraz <tmraz@redhat.com> 0.99.10.0-3

- update pam-redhat module tarball

- update internal db4

* Fri Feb 22 2008 Tomas Mraz <tmraz@redhat.com> 0.99.10.0-2

- if shadow is readable for an user do not prevent him from

  authenticating any user with unix_chkpwd (#433459)

- call audit from unix_chkpwd when appropriate

* Fri Feb 15 2008 Tomas Mraz <tmraz@redhat.com> 0.99.10.0-1

- new upstream release

- add default soft limit for nproc of 1024 to prevent

  accidental fork bombs (#432903)

* Mon Feb  4 2008 Tomas Mraz <tmraz@redhat.com> 0.99.8.1-18

- allow the package to build without SELinux and audit support (#431415)

- macro usage cleanup

* Mon Jan 28 2008 Tomas Mraz <tmraz@redhat.com> 0.99.8.1-17

- test for setkeycreatecon correctly

- add exclusive login mode of operation to pam_selinux_permit (original

  patch by Dan Walsh)

* Tue Jan 22 2008 Tomas Mraz <tmraz@redhat.com> 0.99.8.1-16

- add auditing to pam_access, pam_limits, and pam_time

- moved sanity testing code to check script

* Mon Jan 14 2008 Tomas Mraz <tmraz@redhat.com> 0.99.8.1-15

- merge review fixes (#226228)

* Wed Jan  8 2008 Tomas Mraz <tmraz@redhat.com> 0.99.8.1-14

- support for sha256 and sha512 password hashes

- account expiry checks moved to unix_chkpwd helper

* Wed Jan  2 2008 Tomas Mraz <tmraz@redhat.com> 0.99.8.1-13

- wildcard match support in pam_tty_audit (by Miloslav Trmač)

* Thu Nov 29 2007 Tomas Mraz <tmraz@redhat.com> 0.99.8.1-12

- add pam_tty_audit module (#244352) - written by Miloslav Trmač

* Wed Nov  7 2007 Tomas Mraz <tmraz@redhat.com> 0.99.8.1-11

- add substack support

* Tue Sep 25 2007 Tomas Mraz <tmraz@redhat.com> 0.99.8.1-10

- update db4 to 4.6.19 (#274661)

* Fri Sep 21 2007 Tomas Mraz <tmraz@redhat.com> 0.99.8.1-9

- do not preserve contexts when copying skel and other namespace.init

  fixes (#298941)

- do not free memory sent to putenv (#231698)

* Wed Sep 19 2007 Tomas Mraz <tmraz@redhat.com> 0.99.8.1-8

- add pam_selinux_permit module

- pam_succeed_if: fix in operator (#295151)

* Tue Sep 18 2007 Tomas Mraz <tmraz@redhat.com> 0.99.8.1-7

- when SELinux enabled always run the helper binary instead of

  direct shadow access (#293181)

* Fri Aug 24 2007 Tomas Mraz <tmraz@redhat.com> 0.99.8.1-6

- do not ask for blank password when SELinux confined (#254044)

- initialize homedirs in namespace init script (original patch by dwalsh)

* Wed Aug 22 2007 Tomas Mraz <tmraz@redhat.com> 0.99.8.1-5

- most devices are now handled by HAL and not pam_console (patch by davidz)

- license tag fix

- multifunction scanner device support (#251468)

* Mon Aug 13 2007 Tomas Mraz <tmraz@redhat.com> 0.99.8.1-4

- fix auth regression when uid != 0 from previous build (#251804)

* Mon Aug  6 2007 Tomas Mraz <tmraz@redhat.com> 0.99.8.1-3

- updated db4 to 4.6.18 (#249740)

- added user and new instance parameters to namespace init

- document the new features of pam_namespace

- do not log an audit error when uid != 0 (#249870)

* Wed Jul 25 2007 Jeremy Katz <katzj@redhat.com> - 0.99.8.1-2

- rebuild for toolchain bug

* Mon Jul 23 2007 Tomas Mraz <tmraz@redhat.com> 0.99.8.1-1

- upgrade to latest upstream version

- add some firewire devices to default console perms (#240770)

* Thu Apr 26 2007 Tomas Mraz <tmraz@redhat.com> 0.99.7.1-6

- pam_namespace: better document behavior on failure (#237249)

- pam_unix: split out passwd change to a new helper binary (#236316)

- pam_namespace: add support for temporary logons (#241226)

* Fri Apr 13 2007 Tomas Mraz <tmraz@redhat.com> 0.99.7.1-5

- pam_selinux: improve context change auditing (#234781)

- pam_namespace: fix parsing config file with unknown users (#234513)

* Fri Mar 23 2007 Tomas Mraz <tmraz@redhat.com> 0.99.7.1-4

- pam_console: always decrement use count (#230823)

- pam_namespace: use raw context for poly dir name (#227345)

- pam_namespace: truncate long poly dir name (append hash) (#230120)

- we don't patch any po files anymore

* Wed Feb 21 2007 Tomas Mraz <tmraz@redhat.com> 0.99.7.1-3

- correctly relabel tty in the default case (#229542)

- pam_unix: cleanup of bigcrypt support

- pam_unix: allow modification of '*' passwords to root

* Tue Feb  6 2007 Tomas Mraz <tmraz@redhat.com> 0.99.7.1-2

- more X displays as consoles (#227462)

* Wed Jan 24 2007 Tomas Mraz <tmraz@redhat.com> 0.99.7.1-1

- upgrade to new upstream version resolving CVE-2007-0003

- pam_namespace: unmount poly dir for override users

* Mon Jan 22 2007 Tomas Mraz <tmraz@redhat.com> 0.99.7.0-2

- add back min salt length requirement which was erroneously removed

  upstream (CVE-2007-0003)

* Fri Jan 19 2007 Tomas Mraz <tmraz@redhat.com> 0.99.7.0-1

- upgrade to new upstream version

- drop pam_stack module as it is obsolete

- some changes to silence rpmlint

* Tue Jan 16 2007 Tomas Mraz <tmraz@redhat.com> 0.99.6.2-8

- properly include /var/log/faillog and tallylog as ghosts

  and create them in post script (#209646)

- update gmo files as we patch some po files (#218271)

- add use_current_range option to pam_selinux (#220487)

- improve the role selection in pam_selinux

- remove shortcut on Password: in ja locale (#218271)

- revert to old euid and not ruid when setting euid in pam_keyinit (#219486)

- rename selinux-namespace patch to namespace-level

* Thu Dec 1 2006 Dan Walsh <dwalsh@redhat.com> 0.99.6.2-7

- fix selection of role

* Thu Dec 1 2006 Dan Walsh <dwalsh@redhat.com> 0.99.6.2-6

- add possibility to pam_namespace to only change MLS component

- Resolves: Bug #216184

* Thu Nov 30 2006 Tomas Mraz <tmraz@redhat.com> 0.99.6.2-5

- add select-context option to pam_selinux (#213812)

- autoreconf won't work with autoconf-2.61 as configure.in is not yet adjusted

  for it

* Mon Nov 13 2006 Tomas Mraz <tmraz@redhat.com> 0.99.6.2-4

- update internal db4 to 4.5.20 version

- move setgid before setuid in pam_keyinit (#212329)

- make username check in pam_unix consistent with useradd (#212153)

* Tue Oct 24 2006 Tomas Mraz <tmraz@redhat.com> 0.99.6.2-3.3

- don't overflow a buffer in pam_namespace (#211989)

* Mon Oct 16 2006 Tomas Mraz <tmraz@redhat.com> 0.99.6.2-3.2

- /var/log/faillog and tallylog must be config(noreplace)

* Fri Oct 13 2006 Tomas Mraz <tmraz@redhat.com> 0.99.6.2-3.1

- preserve effective uid in namespace.init script (LSPP for newrole)

- include /var/log/faillog and tallylog to filelist (#209646)

- add ids to .xml docs so the generated html is always the same (#210569)

* Thu Sep 28 2006 Tomas Mraz <tmraz@redhat.com> 0.99.6.2-3

- add pam_namespace option no_unmount_on_close, required for newrole

* Mon Sep  4 2006 Tomas Mraz <tmraz@redhat.com> 0.99.6.2-2

- silence pam_succeed_if in default system-auth (#205067)

- round the pam_timestamp_check sleep up to wake up at the start of the

  wallclock second (#205068)

* Thu Aug 31 2006 Tomas Mraz <tmraz@redhat.com> 0.99.6.2-1

- upgrade to new upstream version, as there are mostly bugfixes except

  improved documentation

- add support for session and password service for pam_access and

  pam_succeed_if

- system-auth: skip session pam_unix for crond service

* Thu Aug 10 2006 Dan Walsh <dwalsh@redhat.com> 0.99.5.0-8

- Add new setkeycreatecon call to pam_selinux to make sure keyring has correct context

* Thu Aug 10 2006 Tomas Mraz <tmraz@redhat.com> 0.99.5.0-7

- revoke keyrings properly when pam_keyinit called as root (#201048)

- pam_succeed_if should return PAM_USER_UNKNOWN when getpwnam fails (#197748)

* Wed Aug  2 2006 Tomas Mraz <tmraz@redhat.com> 0.99.5.0-6

- revoke keyrings properly when pam_keyinit called more than once (#201048)

  patch by David Howells

* Fri Jul 21 2006 Tomas Mraz <tmraz@redhat.com> 0.99.5.0-5

- don't log pam_keyinit debug messages by default (#199783)

* Fri Jul 21 2006 Tomas Mraz <tmraz@redhat.com> 0.99.5.0-4

- drop ainit from console.handlers (#199561)

* Mon Jul 17 2006 Tomas Mraz <tmraz@redhat.com> 0.99.5.0-3

- don't report error in pam_selinux for nonexistent tty (#188722)

- add pam_keyinit to the default system-auth file (#198623)

* Wed Jul 12 2006 Jesse Keating <jkeating@redhat.com> - 0.99.5.0-2.1

- rebuild

* Mon Jul  3 2006 Tomas Mraz <tmraz@redhat.com> 0.99.5.0-2

- fixed network match in pam_access (patch by Dan Yefimov)

* Fri Jun 30 2006 Tomas Mraz <tmraz@redhat.com> 0.99.5.0-1

- updated to a new upstream release

- added service as value to be matched and list matching to

  pam_succeed_if

- namespace.init was missing from EXTRA_DIST

* Thu Jun  8 2006 Tomas Mraz <tmraz@redhat.com> 0.99.4.0-5

- updated pam_namespace with latest patch by Janak Desai

- merged pam_namespace patches

- added buildrequires libtool

- fixed a few rpmlint warnings

* Wed May 24 2006 Tomas Mraz <tmraz@redhat.com> 0.99.4.0-4

- actually don't link to libssl as it is not used (#191915)

* Wed May 17 2006 Tomas Mraz <tmraz@redhat.com> 0.99.4.0-3

- use md5 implementation from pam_unix in pam_namespace

- pam_namespace should call setexeccon only when selinux is enabled

* Tue May 16 2006 Tomas Mraz <tmraz@redhat.com> 0.99.4.0-2

- pam_console_apply shouldn't access /var when called with -r (#191401)

- actually apply the large-uid patch

- don't build hmactest in pam_timestamp so openssl-devel is not required

- add missing buildrequires (#191915)

* Wed May 10 2006 Tomas Mraz <tmraz@redhat.com> 0.99.4.0-1

- upgrade to new upstream version

- make pam_console_apply not dependent on glib

- support large uids in pam_tally, pam_tally2

* Thu May  4 2006 Tomas Mraz <tmraz@redhat.com> 0.99.3.0-5

- the namespace instance init script is now in /etc/security (#190148)

- pam_namespace: added missing braces (#190026)

- pam_tally(2): never call fclose twice on the same FILE (from upstream)

* Wed Apr 26 2006 Tomas Mraz <tmraz@redhat.com> 0.99.3.0-4

- fixed console device class for irda (#189966)

- make pam_console_apply fail gracefully when a class is missing

* Tue Apr 25 2006 Tomas Mraz <tmraz@redhat.com> 0.99.3.0-3

- added pam_namespace module written by Janak Desai (per-user /tmp

support)

- new pam-redhat modules version

* Fri Feb 24 2006 Tomas Mraz <tmraz@redhat.com> 0.99.3.0-2

- added try_first_pass option to pam_cracklib

- use try_first_pass for pam_unix and pam_cracklib in

  system-auth (#182350)

* Fri Feb 10 2006 Jesse Keating <jkeating@redhat.com> - 0.99.3.0-1.2

- bump again for double-long bug on ppc(64)

* Tue Feb 07 2006 Jesse Keating <jkeating@redhat.com> - 0.99.3.0-1.1

- rebuilt for new gcc4.1 snapshot and glibc changes

* Fri Feb  3 2006 Tomas Mraz <tmraz@redhat.com> 0.99.3.0-1

- new upstream version

- updated db4 to 4.3.29

- added module pam_tally2 with auditing support

- added manual pages for system-auth and config-util (#179584)

* Tue Jan  3 2006 Tomas Mraz <tmraz@redhat.com> 0.99.2.1-3

- remove 'initscripts' dependency (#176508)

- update pam-redhat modules, merged patches

* Fri Dec 16 2005 Tomas Mraz <tmraz@redhat.com> 0.99.2.1-2

- fix dangling symlinks in -devel (#175929)

- link libaudit only where necessary

- actually compile in audit support

* Thu Dec 15 2005 Tomas Mraz <tmraz@redhat.com> 0.99.2.1-1

- support netgroup matching in pam_succeed_if

- upgrade to new release

- drop pam_pwdb as it was obsolete long ago

- we don't build static libraries anymore

* Fri Dec 09 2005 Jesse Keating <jkeating@redhat.com>

- rebuilt

* Tue Nov 15 2005 Tomas Mraz <tmraz@redhat.com> 0.80-14

- pam_stack is deprecated - log its usage

* Wed Oct 26 2005 Tomas Mraz <tmraz@redhat.com> 0.80-13

- fixed CAN-2005-2977 unix_chkpwd should skip user verification only if

  run as root (#168181)

- link pam_loginuid to libaudit

- support no tty in pam_access (#170467)

- updated audit patch (by Steve Grubb)

- the previous pam_selinux change was not applied properly

- pam_xauth: look for the xauth binary in multiple directories (#171164)

* Wed Oct 26 2005 Dan Walsh <dwalsh@redhat.com> 0.80-12

- Eliminate multiple in pam_selinux

* Fri Oct 14 2005 Dan Walsh <dwalsh@redhat.com> 0.80-11

- Eliminate fail over for getseuserbyname call

* Thu Oct 13 2005 Dan Walsh <dwalsh@redhat.com> 0.80-10

- Add getseuserbyname call for SELinux MCS/MLS policy

* Tue Oct  4 2005 Tomas Mraz <tmraz@redhat.com>

- pam_console manpage fixes (#169373)

* Fri Sep 30 2005 Tomas Mraz <tmraz@redhat.com> 0.80-9

- don't include ps and pdf docs (#168823)

- new common config file for configuration utilities

- remove glib2 dependency (#166979)

* Tue Sep 20 2005 Tomas Mraz <tmraz@redhat.com> 0.80-8

- process limit values other than RLIMIT_NICE correctly (#168790)

- pam_unix: always honor nis flag on password change (by Aaron Hope)

* Wed Aug 24 2005 Tomas Mraz <tmraz@redhat.com> 0.80-7

- don't fail in audit code when audit is not compiled in 

  on the newest kernels (#166422)

* Mon Aug 01 2005 Tomas Mraz <tmraz@redhat.com> 0.80-6

- add option to pam_loginuid to require auditd

* Fri Jul 29 2005 Tomas Mraz <tmraz@redhat.com> 0.80-5

- fix NULL dereference in pam_userdb (#164418)

* Tue Jul 26 2005 Tomas Mraz <tmraz@redhat.com> 0.80-4

- fix 64bit bug in pam_pwdb

- don't crash in pam_unix if pam_get_data fail

* Fri Jul 22 2005 Tomas Mraz <tmraz@redhat.com> 0.80-3

- more pam_selinux permissive fixes (Dan Walsh)

- make binaries PIE (#158938)

* Mon Jul 18 2005 Tomas Mraz <tmraz@redhat.com> 0.80-2

- fixed module tests so the pam doesn't require itself to build (#163502)

- added buildprereq for building the documentation (#163503)

- relaxed permissions of binaries (u+w)

* Thu Jul 14 2005 Tomas Mraz <tmraz@redhat.com> 0.80-1

- upgrade to new upstream sources

- removed obsolete patches

- pam_selinux module shouldn't fail on broken configs unless

  policy is set to enforcing (Dan Walsh)

* Tue Jun 21 2005 Tomas Mraz <tmraz@redhat.com> 0.79-11

- update pam audit patch

- add support for new limits in kernel-2.6.12 (#157050)

* Thu Jun  9 2005 Tomas Mraz <tmraz@redhat.com> 0.79-10

- add the Requires dependency on audit-libs (#159885)

- pam_loginuid shouldn't report error when /proc/self/loginuid

  is missing (#159974)

* Fri May 20 2005 Tomas Mraz <tmraz@redhat.com> 0.79-9

- update the pam audit patch to support newest audit library,

  audit also pam_setcred calls (Steve Grubb)

- don't use the audit_fd as global static variable

- don't unset the XAUTHORITY when target user is root