From ef619b6115513dd36923c39190f907b55b0a4825 Mon Sep 17 00:00:00 2001
From: Pedro Alvarez <pedro.alvarez@codethink.co.uk>
Date: Tue, 5 May 2015 11:25:43 +0000
Subject: Configure shadow to work with PAM.

Also modify some /etc/pam.d files:

- Make the requirement on pam_selinux.so optional in shadow default
  pam.d configuration files.

- Modify 'system-auth' when installing systemd to add pam_deny.so,
  so that login attempts with wrong passwords fail now that
  shadow is configured to use PAM.

Change-Id: I7110d27b6b46ce33eeaeae904dea854deb46c759
---
 strata/core/shadow.morph        | 9 ++++++---
 strata/foundation/systemd.morph | 5 +++++
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/strata/core/shadow.morph b/strata/core/shadow.morph
index 34ec6197..c8715a7d 100644
--- a/strata/core/shadow.morph
+++ b/strata/core/shadow.morph
@@ -6,13 +6,11 @@ configure-commands:
 - |
   ./autogen.sh --with-selinux=no \
                --sysconfdir=/etc \
-               --with-pam=yes \
+               --with-libpam=yes \
                --prefix="$PREFIX" \
                --bindir=/bin
 post-install-commands:
 # Disable things handled by pam instead
-- rm "$DESTDIR/etc/limits"
-- rm "$DESTDIR/etc/login.access"
 - |
   for OPTION in FAIL_DELAY \
                 FAILLOG_ENAB \
@@ -48,3 +46,8 @@ post-install-commands:
   else
       echo 'ENCRYPT_METHOD SHA512' >>"$DESTDIR/etc/login.defs"
   fi
+
+# The default pam.d config files have pam_selinux.so as a requirement, even
+# when shadow is configured '--with-selinux=no'. We change this default config
+# to make this requirement optional.
+- sed -i -e 's/\(.*\)required\(.*pam_selinux.so.*\)/\1optional\2/' "$DESTDIR"/etc/pam.d/*
diff --git a/strata/foundation/systemd.morph b/strata/foundation/systemd.morph
index efca734f..5dc48e70 100644
--- a/strata/foundation/systemd.morph
+++ b/strata/foundation/systemd.morph
@@ -39,3 +39,8 @@ post-install-commands:
   EOF
 # Use the pam config systemd provides
 - cp -a "$DESTDIR/$PREFIX"/share/factory/etc/pam.d/* "$DESTDIR/etc/pam.d"
+
+# Add pam_deny.so to the default systemd-auth pam.d config file. Without
+# it, if shadow is configured to use PAM, it would be possible to login
+# to a system with the wrong password.
+- echo 'auth     requisite  pam_deny.so' >> "$DESTDIR"/etc/pam.d/system-auth
-- 
cgit v1.2.1