From ef619b6115513dd36923c39190f907b55b0a4825 Mon Sep 17 00:00:00 2001
From: Pedro Alvarez <pedro.alvarez@codethink.co.uk>
Date: Tue, 5 May 2015 11:25:43 +0000
Subject: Configure shadow to work with PAM.

Also modify some /etc/pam.d files:

- Make the requirement on pam_selinux.so optional in shadow default
  pam.d configuration files.

- Modify 'system-auth' when installing systemd to add pam_deny.so,
  so that login attempts with wrong passwords fail now that
  shadow is configured to use PAM.

Change-Id: I7110d27b6b46ce33eeaeae904dea854deb46c759
---
 strata/core/shadow.morph | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

(limited to 'strata/core')

diff --git a/strata/core/shadow.morph b/strata/core/shadow.morph
index 34ec6197..c8715a7d 100644
--- a/strata/core/shadow.morph
+++ b/strata/core/shadow.morph
@@ -6,13 +6,11 @@ configure-commands:
 - |
   ./autogen.sh --with-selinux=no \
                --sysconfdir=/etc \
-               --with-pam=yes \
+               --with-libpam=yes \
                --prefix="$PREFIX" \
                --bindir=/bin
 post-install-commands:
 # Disable things handled by pam instead
-- rm "$DESTDIR/etc/limits"
-- rm "$DESTDIR/etc/login.access"
 - |
   for OPTION in FAIL_DELAY \
                 FAILLOG_ENAB \
@@ -48,3 +46,8 @@ post-install-commands:
   else
       echo 'ENCRYPT_METHOD SHA512' >>"$DESTDIR/etc/login.defs"
   fi
+
+# The default pam.d config files have pam_selinux.so as a requirement, even
+# when shadow is configured '--with-selinux=no'. We change this default config
+# to make this requirement optional.
+- sed -i -e 's/\(.*\)required\(.*pam_selinux.so.*\)/\1optional\2/' "$DESTDIR"/etc/pam.d/*
-- 
cgit v1.2.1