Fix matching of usernames in the pam_unix remember feature.

* modules/pam_unix/pam_unix_passwd.c (check_old_password): Make
sure we match only the whole username in opasswd entry.
* modules/pam_unix/passverify.c (save_old_password): Likewise make
sure we match only the whole username in opasswd entry.

pam_selinux.8.xml: update

* modules/pam_selinux/pam_selinux.8.xml (pam_selinux-cmdsynopsis):
Reorder options, add new "restore" option.
pam_selinux-description): Rewrite.
(pam_selinux-options): Reorder options, describe new "restore" option.
(pam_selinux-return_values): Remove PAM_AUTH_ERR, PAM_SESSION_ERR
and PAM_BUF_ERR.
(pam_selinux-see_also): Remove pam.conf(5).  Add execve(2), tty(4)
and selinux(8).

pam_selinux.c: add "restore" option

* modules/pam_selinux/pam_selinux.c (pam_sm_open_session): Add new
"restore" option.

pam_selinux.c: rewrite using pam_get_data/pam_set_data

* modules/pam_selinux/pam_selinux.c (security_restorelabel_tty,
security_label_tty): Remove old functions.
(module_data_t): New structure.
(free_module_data, cleanup, get_module_data, get_item,
set_exec_context, set_file_context, compute_exec_context,
compute_tty_context, restore_context, set_context,
create_context): New functions.
(pam_sm_authenticate, pam_sm_setcred, pam_sm_open_session,
pam_sm_close_session): Use them.

Use libpam.la/libpam_misc.la to link with -lpam/-lpam_misc

GNU automake documentation recommends to avoid using -l options in
LDADD or LIBADD when referring to libraries built by the package.
Instead, it recommends to write the file name of the library explicitly,
and use -l option only to list third-party libraries.  As result, the
default value of *_DEPENDENCIES will list all local libraries and omit
the other ones.
* modules/pam_access/Makefile.am (pam_access_la_LIBADD): Replace
"-L$(top_builddir)/libpam -lpam" with
"$(top_builddir)/libpam/libpam.la", to follow GNU automake
recommendations.
* modules/pam_cracklib/Makefile.am (pam_cracklib_la_LIBADD): Likewise.
* modules/pam_debug/Makefile.am (pam_debug_la_LIBADD): Likewise.
* modules/pam_deny/Makefile.am (pam_deny_la_LIBADD): Likewise.
* modules/pam_echo/Makefile.am (pam_echo_la_LIBADD): Likewise.
* modules/pam_env/Makefile.am (pam_env_la_LIBADD): Likewise.
* modules/pam_exec/Makefile.am (pam_exec_la_LIBADD): Likewise.
* modules/pam_faildelay/Makefile.am (pam_faildelay_la_LIBADD): Likewise.
* modules/pam_filter/Makefile.am (pam_filter_la_LIBADD): Likewise.
* modules/pam_filter/upperLOWER/Makefile.am (LDADD): Likewise.
* modules/pam_ftp/Makefile.am (pam_ftp_la_LIBADD): Likewise.
* modules/pam_group/Makefile.am (pam_group_la_LIBADD): Likewise.
* modules/pam_issue/Makefile.am (pam_issue_la_LIBADD): Likewise.
* modules/pam_keyinit/Makefile.am (pam_keyinit_la_LIBADD): Likewise.
* modules/pam_lastlog/Makefile.am (pam_lastlog_la_LIBADD): Likewise.
* modules/pam_limits/Makefile.am (pam_limits_la_LIBADD): Likewise.
* modules/pam_listfile/Makefile.am (pam_listfile_la_LIBADD): Likewise.
* modules/pam_localuser/Makefile.am (pam_localuser_la_LIBADD): Likewise.
* modules/pam_loginuid/Makefile.am (pam_loginuid_la_LIBADD): Likewise.
* modules/pam_mail/Makefile.am (pam_mail_la_LIBADD): Likewise.
* modules/pam_mkhomedir/Makefile.am (pam_mkhomedir_la_LIBADD,
mkhomedir_helper_LDADD): Likewise.
* modules/pam_motd/Makefile.am (pam_motd_la_LIBADD): Likewise.
* modules/pam_namespace/Makefile.am (pam_namespace_la_LIBADD): Likewise.
* modules/pam_nologin/Makefile.am (pam_nologin_la_LIBADD): Likewise.
* modules/pam_permit/Makefile.am (pam_permit_la_LIBADD): Likewise.
* modules/pam_pwhistory/Makefile.am (pam_pwhistory_la_LIBADD): Likewise.
* modules/pam_rhosts/Makefile.am (pam_rhosts_la_LIBADD): Likewise.
* modules/pam_rootok/Makefile.am (pam_rootok_la_LIBADD): Likewise.
* modules/pam_securetty/Makefile.am (pam_securetty_la_LIBADD): Likewise.
* modules/pam_sepermit/Makefile.am (pam_sepermit_la_LIBADD): Likewise.
* modules/pam_shells/Makefile.am (pam_shells_la_LIBADD): Likewise.
* modules/pam_stress/Makefile.am (pam_stress_la_LIBADD): Likewise.
* modules/pam_succeed_if/Makefile.am (pam_succeed_if_la_LIBADD):
Likewise.
* modules/pam_tally/Makefile.am (pam_tally_la_LIBADD): Likewise.
* modules/pam_tally2/Makefile.am (pam_tally2_la_LIBADD,
pam_tally2_LDADD): Likewise.
* modules/pam_time/Makefile.am (pam_time_la_LIBADD): Likewise.
* modules/pam_timestamp/Makefile.am (pam_timestamp_la_LIBADD,
pam_timestamp_check_LDADD, hmacfile_LDADD): Likewise.
* modules/pam_tty_audit/Makefile.am (pam_tty_audit_la_LIBADD): Likewise.
* modules/pam_umask/Makefile.am (pam_umask_la_LIBADD): Likewise.
* modules/pam_unix/Makefile.am (pam_unix_la_LIBADD): Likewise.
* modules/pam_userdb/Makefile.am (pam_userdb_la_LIBADD): Likewise.
* modules/pam_warn/Makefile.am (pam_warn_la_LIBADD): Likewise.
* modules/pam_wheel/Makefile.am (pam_wheel_la_LIBADD): Likewise.
* modules/pam_xauth/Makefile.am (pam_xauth_la_LIBADD): Likewise.
* tests/Makefile.am (LDADD): Likewise.
* examples/Makefile.am (LDADD): Replace "-L$(top_builddir)/libpam -lpam"
with "$(top_builddir)/libpam/libpam.la", and
"-L$(top_builddir)/libpam_misc -lpam_misc" with
"$(top_builddir)/libpam_misc/libpam_misc.la", to follow GNU automake
recommendations.
* xtests/Makefile.am (LDADD): Likewise.
* modules/pam_selinux/Makefile.am (pam_selinux_la_LIBADD): Likewise.

Fix usage of LIBADD, LDADD and LDFLAGS

* modules/pam_selinux/Makefile.am: Rename pam_selinux_check_LDFLAGS to
pam_selinux_check_LDADD.
* modules/pam_userdb/Makefile.am: Split out pam_userdb_la_LIBADD from
AM_LDFLAGS.
* modules/pam_warn/Makefile.am: Split out pam_warn_la_LIBADD from
AM_LDFLAGS.
* modules/pam_wheel/Makefile.am: Split out pam_wheel_la_LIBADD from
AM_LDFLAGS.
* modules/pam_xauth/Makefile.am: split out pam_xauth_la_LIBADD from
AM_LDFLAGS.
* xtests/Makefile.am: Rename AM_LDFLAGS to LDADD.

Update .gitignore files

* .gitignore: Add common ignore patterns.
* m4/.gitignore: Unignore local m4 files.
* dynamic/.gitignore: Unignore Makefile.
* libpamc/test/modules/.gitignore: Likewise.
* libpamc/test/regress/.gitignore: Likewise.
* po/.gitignore: Add Makevars.template.
* conf/.gitignore: Remove common ignore patterns.
* conf/pam_conv1/.gitignore: Likewise.
* doc/.gitignore: Likewise.
* doc/specs/.gitignore: Likewise.
* doc/specs/formatter/.gitignore: Likewise.
* examples/.gitignore: Likewise.
* modules/pam_filter/upperLOWER/.gitignore: Likewise.
* modules/pam_mkhomedir/.gitignore: Likewise.
* modules/pam_selinux/.gitignore: Likewise.
* modules/pam_stress/.gitignore: Likewise.
* modules/pam_tally/.gitignore: Likewise.
* modules/pam_tally2/.gitignore: Likewise.
* modules/pam_timestamp/.gitignore: Likewise.
* modules/pam_unix/.gitignore: Likewise.
* tests/.gitignore: Likewise.
* xtests/.gitignore: Likewise.
* doc/adg/.gitignore: Remove.
* doc/man/.gitignore: Remove.
* doc/mwg/.gitignore: Remove.
* doc/sag/.gitignore: Remove.
* libpamc/.gitignore: Remove.
* libpamc/test/.gitignore: Remove.
* libpam/.gitignore: Remove.
* libpam_misc/.gitignore: Remove.
* modules/.gitignore: Remove.
* modules/pam_access/.gitignore: Remove.
* modules/pam_cracklib/.gitignore: Remove.
* modules/pam_debug/.gitignore: Remove.
* modules/pam_deny/.gitignore: Remove.
* modules/pam_echo/.gitignore: Remove.
* modules/pam_env/.gitignore: Remove.
* modules/pam_exec/.gitignore: Remove.
* modules/pam_faildelay/.gitignore: Remove.
* modules/pam_filter/.gitignore: Remove.
* modules/pam_ftp/.gitignore: Remove.
* modules/pam_group/.gitignore: Remove.
* modules/pam_issue/.gitignore: Remove.
* modules/pam_keyinit/.gitignore: Remove.
* modules/pam_lastlog/.gitignore: Remove.
* modules/pam_limits/.gitignore: Remove.
* modules/pam_listfile/.gitignore: Remove.
* modules/pam_localuser/.gitignore: Remove.
* modules/pam_loginuid/.gitignore: Remove.
* modules/pam_mail/.gitignore: Remove.
* modules/pam_motd/.gitignore: Remove.
* modules/pam_namespace/.gitignore: Remove.
* modules/pam_nologin/.gitignore: Remove.
* modules/pam_permit/.gitignore: Remove.
* modules/pam_pwhistory/.gitignore: Remove.
* modules/pam_rhosts/.gitignore: Remove.
* modules/pam_rootok/.gitignore: Remove.
* modules/pam_securetty/.gitignore: Remove.
* modules/pam_sepermit/.gitignore: Remove.
* modules/pam_shells/.gitignore: Remove.
* modules/pam_succeed_if/.gitignore: Remove.
* modules/pam_time/.gitignore: Remove.
* modules/pam_tty_audit/.gitignore: Remove.
* modules/pam_umask/.gitignore: Remove.
* modules/pam_userdb/.gitignore: Remove.
* modules/pam_warn/.gitignore: Remove.
* modules/pam_wheel/.gitignore: Remove.
* modules/pam_xauth/.gitignore: Remove.

Move generated auxiliary files to build-aux directory

* configure.in: Add AC_CONFIG_AUX_DIR([build-aux]).

Remove generated files

* ABOUT-NLS: Remove.
* INSTALL: Remove.
* config.rpath: Remove.
* install-sh: Remove.
* mkinstalldirs: Remove.
* Makefile.am (EXTRA_DIST): Remove config.rpath and mkinstalldirs.
* .gitignore: Add ABOUT-NLS and INSTALL.

Create release tarballs using safe ownership and permissions

* Makefile.am: Define and export TAR_OPTIONS.

Generate ChangeLog from git log

* .gitignore: Add ChangeLog
* ChangeLog: Rename to ChangeLog-CVS.
* Makefile.am (gen-changelog): New rule.
(dist-hook, .PHONY): Depend on it.
(EXTRA_DIST): Add ChangeLog-CVS.
* README-hacking: New file.
* gitlog-to-changelog: Import from gnulib.
* autogen.sh: Create empty ChangeLog file to make automake strictness
check happy.  Use automated "autoreconf -fiv" instead of manual
invocations of various autotools.

Fix "make distcheck"

There is no use to distribute m4 files manually, because automake does
the right thing, while manual distribution is not only redundant but
also very fragile.
* Makefile.am (M4_FILES): Remove.
(EXTRA_DIST): Remove M4_FILES.

Remove modules/pam_timestamp/hmacfile from distribution

* modules/pam_timestamp/Makefile.am (dist_TESTS): Add tst-pam_timestamp.
(nodist_TESTS): Add hmacfile.
(EXTRA_DIST): Replace TESTS with dist_TESTS.

Rename all .cvsignore files to .gitignore

Fix whitespace issues

Cleanup trailing whitespaces, indentation that uses spaces before tabs,
and blank lines at EOF.  Make the project free of warnings reported by
git diff --check 4b825dc642cb6eb9a060e54bf8d69288fbee4904 HEAD

2011-10-25  Thorsten Kukuk  <kukuk@thkukuk.de>

        * release version 1.1.5

        * configure.in: Bump version number.

        * modules/pam_tally2/pam_tally2.8.xml: Remove never used option
        "no_lock_time".

pam_env: abort when encountering an overflowed environment variable expansion

* modules/pam_env/pam_env.c (_expand_arg): Abort when encountering an
overflowed environment variable expansion.
Fixes CVE-2011-3149.
Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/pam/+bug/874565

pam_env: correctly count leading whitespace when parsing environment file

* modules/pam_env/pam_env.c (_assemble_line): Correctly count leading
whitespace.
Fixes CVE-2011-3148.
Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/pam/+bug/874469

If getdomainname() fails or domainname not set use NULL as domain in innetgr().

Add hostname resolution cache.

Improve documentation of the sufficient and requisite control values. (Red Hat Bug #742413)

Correct the FSF address.

Fix the split on @ in the user field. (Red Hat Bug #732081)

Fix missing dereference.

Fix order of libraries

Add release to ChangeLog

2011-06-22  Thorsten Kukuk  <kukuk@thkukuk.de>

* release version 1.1.4

        * configure.in: Bump version number.
        * NEWS: Document changes since 1.1.3
        * libpam/Makefile.am: Bump release number of shared library
        * po/de.po: Translate new string.

Merge branch 'master' of ssh://git.fedorahosted.org/git/linux-pam into new_version

Bump version to 1.1.4

2011-06-21  Thorsten Kukuk  <kukuk@thkukuk.de>

       * modules/pam_limits/pam_limits.c: Add set_all option,
       read limits from PID one if no limit is specified and set_all
       is set.
       * modules/pam_limits/pam_limits.8.xml: Document set_all option.
       Based on Patch by Kees Cook.

Initialize the fake_item from item.

Avoid memleaks and fd leak in error paths.

Do not crash when remember, minlen, or rounds options are used with wrong module type.

Cleanups of pam_pwhistory code. Make opasswd entry parsing more robust.

        * modules/pam_pwhistory/opasswd.c (check_old_password): Do not
        needlessly call strdupa().
        (save_old_password): Avoid memleaks in error paths. Avoid memleak of
        buf. Make the opasswd entry parsing more robust.
        * modules/pam_pwhistory/pam_pwhistory.8.xml: Document the
        special meaning of remember=0.

Avoid leaking memory and dir handle on realloc failure.

Fix typo

2011-06-14  Thorsten Kukuk  <kukuk@thkukuk.de>

* configure.in: Check for libtirpc bye default.
* libpam/Makefile.am: Add support for libtirpc.
* modules/pam_access/Makefile.am: Likewise.
* modules/pam_unix/Makefile.am: Likewise.
* modules/pam_unix/pam_unix_passwd.c: Change ifdefs for
new libtirpc support.
* modules/pam_unix/yppasswd_xdr.c: Only compile if we have rpc/rpc.h.

Test also whether the tty is in the /sys/class/tty/console/active file.

Detect the shared / mount and enable private mounts based on that.

Define the MS_PRIVATE and MS_REC flags if they are not in sys/mount.h.

Rewrite of the field parsing in pam_group and pam_time.

Vietnamese translation added.

po: add Vietnamese translation

Signed-off-by: Nguyễn Thái Ngọc Duy <pclouds@gmail.com>

Check for return value of pam_get_item() in pam_echo module.

Guard for pam_get_user() error in pam_filter module.

Guards for memory allocation errors in pam_cracklib module.

Add support for the mount_private option to pam_namespace.

2011-05-30  Thorsten Kukuk  <kukuk@thkukuk.de>

        * modules/pam_timestamp/pam_timestamp.c (main): Remove unsused
        variable pretval.

        * modules/pam_stress/pam_stress.c (converse): **message is const.
        (stress_get_password): pmsg is const.
        (pam_sm_chauthtok): Likewise.
        * libpam/pam_item.c (pam_get_user): Make pmsg const and remove
        casts.

2011-05-30  Thorsten Kukuk  <kukuk@thkukuk.de>

* modules/pam_env/pam_env.c (_pam_parse): Implement debug option.
Based on patch by Tomas Mraz.

2011-05-24  Thorsten Kukuk  <kukuk@thkukuk.de>

        * modules/pam_listfile/pam_listfile.c (pam_sm_authenticate): quiet
        option has no argument, print no missing file if quiet is set
        [sf#3194930].

2011-05-04  Thorsten Kukuk  <kukuk@thkukuk.de>

        * modules/pam_lastlog/pam_lastlog.c (last_login_failed): Don't
        abort with error if btmp file does not exist.

Clear the whole MD5 context.

Relevant BUGIDs:

Purpose of commit: bugfix

Commit summary:
---------------
2011-03-18  Tomas Mraz  <tm@t8m.info>

        * modules/pam_namespace/md5.c (MD5Final): Clear the whole ctx.
        * modules/pam_namespace/pam_namespace.c (del_polydir): Guard for NULL poly.
        (protect_dir): Guard for -1 passing to close().
        (ns_setup): Likewise.
        (pam_sm_open_session): Correctly test for SELinux enabled flag.

Relevant BUGIDs:

Purpose of commit: bugfix

Commit summary:
---------------
2011-03-17  Tomas Mraz  <tm@t8m.info>

        * modules/pam_selinux/pam_selinux.c (config_context): Fix leak of type.
        (manual_context): Likewise.
        (context_from_env): Remove extraneous auditing in success case.

        * modules/pam_unix/support.c (_unix_run_helper_binary): Remove extra
        close() call.

Relevant BUGIDs:

Purpose of commit: docfix

Commit summary:
---------------
2011-02-22  Tomas Mraz  <tm@t8m.info>

        * modules/pam_nologin/pam_nologin.8.xml: Add missing space.
        * modules/pam_limits/limits.conf.5.xml: Fix typo.

Relevant BUGIDs:

Purpose of commit: bugfix

Commit summary:
---------------
2010-12-21  Tomas Mraz  <tm@t8m.info>

        * modules/pam_selinux/pam_selinux.c (mls_range_allowed): Unhardcode
        values for security class and av permission bit.

Relevant BUGIDs:

Purpose of commit: new feature

Commit summary:
---------------
2010-12-14  Tomas Mraz  <tm@t8m.info>

        * modules/pam_limits/pam_limits.c (parse_uid_range): New function
        to parse the range of uids or gids.
        (parse_config_file): Call parse_uid_range() and if uid/gid range
        is identified, setup the limits if the range matches. New parameters
        containing user's uid and primary gid.
        (pam_sm_open_session): Pass the user's uid and primary gid to
        parse_config_file().
        * modules/pam_limits/limits.conf.5.xml: Document the uid/gid ranges.

Relevant BUGIDs:

Purpose of commit: translations

Commit summary:
---------------
2010-12-14  Bahadır Kandemir <bahadir@pardus.org.tr>

        * po/tr.po: Updated translations.

Relevant BUGIDs:

Purpose of commit: docfix

Commit summary:
---------------
2010-11-25  Tomas Mraz  <tm@t8m.info>

        * modules/pam_securetty/pam_securetty.8.xml: Improve documentation
        of the kernel console feature and the noconsole option.

Relevant BUGIDs:

Purpose of commit: new feature

Commit summary:
---------------

2010-11-24  Thorsten Kukuk  <kukuk@thkukuk.de>

        * modules/pam_securetty/pam_securetty.c: Parse console= kernel
        option, add noconsole option.
        * modules/pam_securetty/pam_securetty.8.xml: Document new behavior
        for serial console.
        Patch from Lennart Poettering.

Relevant BUGIDs:

Purpose of commit: docfix

Commit summary:
---------------
2010-11-24  Tomas Mraz  <tm@t8m.info>

        * modules/pam_limits/limits.conf.5.xml: Document the %group syntax.

Relevant BUGIDs:

Purpose of commit: cleanup

Commit summary:
---------------
2010-11-18  Tomas Mraz  <tm@t8m.info>

        * modules/pam_limits/pam_limits.c (pam_parse,pam_sm_open_session):
        Drop obsolete and broken option change_uid.
        * modules/pam_limits/pam_limits.8.xml: Likewise.

Relevant BUGIDs:

Purpose of commit: bugfix

Commit summary:
---------------
2010-11-16  Tomas Mraz  <tm@t8m.info>

        * modules/pam_pwhistory/pam_pwhistory.c (pam_sm_chauthtok): Remove
        dead and duplicate code. Return PAM_INCOMPLETE instead of
        PAM_CONV_AGAIN.

Relevant BUGIDs:

Purpose of commit: bugfix

Commit summary:
---------------
2010-11-11  Tomas Mraz  <tm@t8m.info>

        * modules/pam_selinux/pam_selinux.c (pam_sm_open_session): Fix
        potential use after free in case SELinux is misconfigured.

        * modules/pam_namespace/pam_namespace.c (process_line): Fix memory
        leak when parsing empty config file lines.

Relevant BUGIDs:

Purpose of commit: release

Commit summary:
---------------

2010-10-28  Thorsten Kukuk  <kukuk@thkukuk.de>

        * release version 1.1.3

        * configure.in: Increase version to 1.1.3

        * NEWS: document visible changes

        * libpam/Makefile.am (libpam_la_LDFLAGS): Bump version number.

Relevant BUGIDs:

Purpose of commit: bugfix

Commit summary:
---------------

2010-10-27  Thorsten Kukuk <kukuk@thkukuk.de>

        * doc/adg/Makefile.am: Use UTF-8 for html docu.
        * doc/mwg/Makefile.am: Likewise.
        * doc/sag/Makefile.am: Likewise.

kernel.org webserver is using UTF-8

Relevant BUGIDs:

Purpose of commit: bugfix

Commit summary:
---------------
2010-10-22  Tomas Mraz  <tm@t8m.info>

        * modules/pam_namespace/pam_namespace.c (inst_init): Use execle()
        to execute the init script with clean environment. (CVE-2010-3853)
        (cleanup_tmpdirs): Likewise for executing rm.

Relevant BUGIDs:

Purpose of commit: cleanup

Commit summary:
---------------
2010-10-21  Dmitry V. Levin  <ldv@altlinux.org>

* modules/pam_mkhomedir/mkhomedir_helper.c (rec_mkdir): Remove.
(create_homedir): Use mkdir() instead of rec_mkdir().
(make_parent_dirs): New function.
(main): Use make_parent_dirs() to create parent directories only
for the home directory itself.

Relevant BUGIDs:

Purpose of commit: bugfix

Commit summary:
---------------

2010-10-21  Thorsten Kukuk  <kukuk@thkukuk.de>

        * modules/pam_unix/support.c (_unix_getpwnam): Don't allocate
        unneeded buffer for uid/gid [sf#3059572].

Relevant BUGIDs:

Purpose of commit: bugfix

Commit summary:
---------------

2010-10-20  Thorsten Kukuk  <kukuk@thkukuk.de>

        * doc/man/pam_get_authtok.3.xml: Fix xml code.

Relevant BUGIDs:

Purpose of commit: bugfix

Commit summary:
---------------

2010-10-20  Thorsten Kukuk  <kukuk@thkukuk.de>

        * doc/man/Makefile.am: Fix build dependencys of pam_get_authtok.3.

        * xtests/Makefile.am: Only build xtests if we run xtests.

Relevant BUGIDs:

Purpose of commit: bugfix

Commit summary:
---------------

2010-10-20  Thorsten Kukuk  <kukuk@thkukuk.de>

        * configure.in: Check for libdb with symbol versions, too.
        Patch from Diego Elio Pettenò.

Relevant BUGIDs:

Purpose of commit: bugfix

Commit summary:
---------------

2010-10-20  Thorsten Kukuk  <kukuk@thkukuk.de>

        * modules/pam_mkhomedir/mkhomedir_helper.c (rec_mkdir): Create
        parent directories always with mode 0755.
        (create_homedir): Create main directory with mode 0700 at first.

Relevant BUGIDs:

Purpose of commit: cleanup

Commit summary:
---------------
2010-10-19  Dmitry V. Levin  <ldv@altlinux.org>

* modules/pam_selinux/pam_selinux.c (verbose_message): Remove.
(pam_sm_open_session): Call send_text() instead of verbose_message().

Relevant BUGIDs:

Purpose of commit: new feature

Commit summary:
---------------
2010-10-19  Dmitry V. Levin  <ldv@altlinux.org>

* m4/ld-no-undefined.m4: New file.
* configure.in: Use PAM_LD_NO_UNDEFINED.
* Makefile.am (M4_FILES): Add m4/ld-no-undefined.m4.

Relevant BUGIDs:

Purpose of commit: bugfix

Commit summary:
---------------
2010-10-19  Dmitry V. Levin  <ldv@altlinux.org>

* m4/ld-O1.m4 (PAM_LD_O1): Fix typo.

Relevant BUGIDs:

Purpose of commit: bugfix

Commit summary:
---------------
2010-10-19  Dmitry V. Levin  <ldv@altlinux.org>

* modules/pam_selinux/Makefile.am (pam_selinux_la_LIBADD): Add
@LIBAUDIT@.

Relevant BUGIDs:

Purpose of commit: documentation

Commit summary:
---------------

2010-10-19  Thorsten Kukuk  <kukuk@thkukuk.de>

        * modules/pam_env/pam_env.8.xml: Document side effects of
        environment variables in the stack.
        * modules/pam_exec/pam_exec.8.xml: Document that user can
        have controll over the environment.

revert preceding patch; under discussion, no consensus

Relevant BUGIDs:

Purpose of commit: bugfix

Commit summary:
---------------
2010-10-11  Tomas Mraz  <t8m@centrum.cz>

        * modules/pam_env/pam_env.c: Change default for user_readenv to 0.
        * modules/pam_env/pam_env.8.xml: Document the new default for user_readenv.

Relevant BUGIDs:

Purpose of commit: bugfix

Commit summary:
---------------
2010-10-07  Dmitry V. Levin  <ldv@altlinux.org>

* modules/pam_selinux/pam_selinux.c (verbose_message): Fix format
string.

Relevant BUGIDs:

Purpose of commit: bugfix

Commit summary:
---------------
2010-10-04  Dmitry V. Levin  <ldv@altlinux.org>

* libpam/pam_modutil_priv.c: New file.
* libpam/Makefile.am (libpam_la_SOURCES): Add it.
* libpam/include/security/pam_modutil.h (struct pam_modutil_privs,
PAM_MODUTIL_DEF_PRIVS, pam_modutil_drop_priv,
pam_modutil_regain_priv): New declarations.
* libpam/libpam.map (LIBPAM_MODUTIL_1.1.3): New interface.
* modules/pam_env/pam_env.c (handle_env): Use new pam_modutil interface.
* modules/pam_mail/pam_mail.c (_do_mail): Likewise.
* modules/pam_xauth/pam_xauth.c (check_acl, pam_sm_open_session,
pam_sm_close_session): Likewise.
(pam_sm_open_session): Remove redundant fchown call.
Fixes CVE-2010-3430, CVE-2010-3431.

Relevant BUGIDs: #3078936

Purpose of commit: bugfix

Commit summary:
---------------

2010-10-01  Thorsten Kukuk  <kukuk@thkukuk.de>

        * configure.in: Extend cross compiling check.
        * doc/specs/Makefile.am: Set CFLAGS and LDFLAGS to BUILD_CFLAGS
        and BUILD_LDFLAGS.
        Bug #3078936 / gentoo #339174

Relevant BUGIDs:

Purpose of commit: cleanup

Commit summary:
---------------

2010-09-30  Thorsten Kukuk  <kukuk@thkukuk.de>

        * modules/pam_xauth/pam_xauth.c (pam_sm_close_session): Warn if
        unlink() fails.

Relevant BUGIDs:

Purpose of commit: bugfix

Commit summary:
---------------
2010-09-27  Dmitry V. Levin  <ldv@altlinux.org>

* modules/pam_xauth/pam_xauth.c (pam_sm_close_session): Return
PAM_SUCCESS immediately if no cookie file is defined.  Return
PAM_SESSION_ERR if cookie file is defined but target uid cannot be
determined.  Do not modify cookiefile string returned by pam_get_data.

Relevant BUGIDs:

Purpose of commit: bugfix

Commit summary:
---------------
2010-09-27  Dmitry V. Levin  <ldv@altlinux.org>

* modules/pam_xauth/pam_xauth.c (check_acl): Check that the given
access control file is a regular file.

Relevant BUGIDs:

Purpose of commit: cleanup

Commit summary:
---------------

2010-09-16  Dmitry V. Levin  <ldv@altlinux.org>

* modules/pam_env/pam_env.c (handle_env): Use setfsuid() return code.
* modules/pam_mail/pam_mail.c (_do_mail): Likewise.
* modules/pam_xauth/pam_xauth.c (check_acl, pam_sm_open_session,
pam_sm_close_session): Likewise.

Relevant BUGIDs:

Purpose of commit: new release

Commit summary:
---------------

2010-08-31  Thorsten Kukuk  <kukuk@thkukuk.de>

        * release version 1.1.2

        * configure.in: Bump version number.
        * NEWS: Document changes since 1.1.1.
        * doc/adg/Linux-PAM_ADG.xml: Bump version number.
        * doc/mwg/Linux-PAM_MWG.xml: Likewise.
        * doc/sag/Linux-PAM_SAG.xml: Likewise.
        * libpam/Makefile.am: Bump revision of shared library.
        * po/*.po: Regenerate.

Relevant BUGIDs:

Purpose of commit: new feature

Commit summary:
---------------
2010-08-26  Tomas Mraz  <t8m@centrum.cz>

        * modules/pam_nologin/pam_nologin.c (perform_check): Try first
         /var/run/nologin if the nologin file is not explicitly specified.
        * modules/pam_nologin/pam_nologin.8.xml: Document that /var/run/nologin
        is tried first.

Relevant BUGIDs:

Purpose of commit: translation

Commit summary:
---------------
2010-08-26  Sweta Kothari  <swkothar@redhat.com>

        * po/gu.po: Updated translations.

2010-08-26  Geert Warrink  <geert.warrink@onsnet.nu>

        * po/nl.po: Updated translations.

Relevant BUGIDs: #2315432, debian#284854#42.

Purpose of commit: bugfix

Commit summary:
---------------

2010-08-26  Thorsten Kukuk  <kukuk@thkukuk.de>

* doc/specs/Makefile.am: Use CC_FOR_BUILD as compiler (cross
compile support).
* configure.in: Check for host compiler if cross compiling.
Bug #2315432, debian#284854#42.

Relevant BUGIDs:

Purpose of commit: new feature

Commit summary:
---------------

2010-08-17  Thorsten Kukuk  <kukuk@thkukuk.de>

        * modules/pam_unix/pam_unix_passwd.c: Implement minlen option.
        * modules/pam_unix/support.c: Likewise.
        * modules/pam_unix/support.h: Likewise.

        * modules/pam_unix/pam_unix_acct.c (pam_sm_acct_mgmt): Adjust
        arguments for _set_ctrl call.
        * modules/pam_unix/pam_unix_auth.c (pam_sm_authenticate): Likewise.
        * modules/pam_unix/pam_unix_session.c: Likewise.

        * modules/pam_unix/pam_unix.8.xml: Document minlen option.
        Based on patch by Steve Langasek.

Relevant BUGIDs:

Purpose of commit: bugfix

Commit summary:
---------------

2010-08-12  Thorsten Kukuk  <kukuk@thkukuk.de>

        * modules/pam_mail/pam_mail.c: Check for mail only with user
        privilegs.

        * modules/pam_xauth/pam_xauth.c (run_coprocess): Check return
        value of setgid, setgroups and setuid.

        * modules/pam_xauth/pam_xauth.c (check_acl): Save errno for
        later usage.

        * modules/pam_env/pam_env.c (handle_env): Check if user exists,
        read local user config only with user privilegs.`

Relevant BUGIDs:

Purpose of commit: bugfix/cleanup

Commit summary:
---------------

2010-08-09  Thorsten Kukuk  <kukuk@thkukuk.de>

        * modules/pam_tally/pam_tally.8.xml: Document that pam_tally is
        deprecated.

        * modules/pam_tty_audit/Makefile.am (EXTRA_DIST): Fix make dist.

Relevant BUGIDs: 2923437

Purpose of commit: bugfix

Commit summary:
---------------

2010-08-09  Thorsten Kukuk  <kukuk@thkukuk.de>

        * modules/pam_unix/passverify.c (check_shadow_expiry): Correct
        check for expired date.

        * modules/pam_unix/pam_unix_passwd.c (_pam_unix_approve_pass): Remove
        check for password length. Bug #2923437.

Relevant BUGIDs:

Purpose of commit: bugfix

Commit summary:
---------------

2010-08-04  Thorsten Kukuk  <kukuk@thkukuk.de>

        * modules/pam_tally2/pam_tally2.c (get_tally): Create file
        with correct permissions. Patch by Diego Elio "Flameeyes" Pettenò.

Relevant BUGIDs: 2730965

Purpose of commit: workaround

Commit summary:
---------------

2010-08-04  Thorsten Kukuk  <kukuk@thkukuk.de>

        * modules/pam_unix/passverify.c (PAMH_ARG_DECL): Don't request
        password change if time is not yet set (1.1.1970). Bug #2730965.

Relevant BUGIDs: #3035919, #3002340, #3037155

Purpose of commit: bugfix

Commit summary:
---------------

2010-08-04  Thorsten Kukuk  <kukuk@thkukuk.de>

        * modules/pam_access/pam_access.c (user_match): Make sure
        that user@host will not match @@netgroup. Bug #3035919.

        * modules/pam_group/pam_group.c (check_account): Add '%' for
        UNIX groups.
        * modules/pam_group/group.conf: Add example for '%'.
        * modules/pam_group/group.conf.5.xml: Document '%' syntax.
        Bug #3002340, #3037155.

Relevant BUGIDs: Debian bug #582362

Purpose of commit: bugfix

Commit summary:
---------------
Don't pass --version-script options when linking executables, only when
linking libraries
Patch from Julien Cristau <jcristau@debian.org>

Relevant BUGIDs: 2917257

Purpose of commit: enhancement

Commit summary:
---------------

2010-07-12  Thorsten Kukuk  <kukuk@thkukuk.de>

        * modules/pam_succeed_if/pam_succeed_if.c (pam_sm_authenticate): Add
        audit flag to enable logging about unknown user (#2917257).
        * modules/pam_succeed_if/pam_succeed_if.8.xml: Document audit.
        * modules/pam_succeed_if/pam_succeed_if.8: Regenerated from xml.
        * modules/pam_succeed_if/README: Regenerated from xml.