pam: rename to libpam and add core config files

So far pam is not really functional as there no pam config files exists, here
we borrow from openembedded to setup core /etc/pam.d to make it functional:

  * change 'pam' to 'libpam' following Debian naming convention, and change
    (R)DEPENDS in other recipes

  * borrow openembedded libpam-base-files with changes:
    - rename to libpam-runtime to follow Debian naming
    - only keep common-* core files which can be traced back to Debian
      libpam-runtime-1.0.1 for license track. Other service specific files
      (such as atd, cron, ...) are removed because either they may contaminate
      the license or it's right thing to have their own packages providing them
    - use same libpam recipe instead of creating a new. This way other /etc/
      stuff are all contained by libpam-runtime

  * like openembedded, we package each pam plugin into seperate package now,
    with some differnce though:
    - Some ${sbindir} binaries are bound to specific PAM plugin. So better to
      package them together with corresponding plugin package
    - populate_sysroot_prepend is invoked before actual populate_sysroot, at
      that time ${D} binaries haven't been tripped. So it's difficult to specify
      -dev for those plugin pacakges from _prepend which are simply empty.
      actually one -dev/-doc per recipe is one good exercise here.

Signed-off-by: Kevin Tian <kevin.tian@intel.com>

1 files changed, 25 insertions, 0 deletions

diff --git a/meta/packages/pam/libpam-1.1.1/pam.d/common-account b/meta/packages/pam/libpam-1.1.1/pam.d/common-account
new file mode 100644
index 0000000000..316b17337b
--- /dev/null
+++ b/meta/packages/pam/libpam-1.1.1/pam.d/common-account
@@ -0,0 +1,25 @@
+#
+# /etc/pam.d/common-account - authorization settings common to all services
+#
+# This file is included from other service-specific PAM config files,
+# and should contain a list of the authorization modules that define
+# the central access policy for use on the system.  The default is to
+# only deny service to users whose accounts are expired in /etc/shadow.
+#
+# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
+# To take advantage of this, it is recommended that you configure any
+# local modules either before or after the default block, and use
+# pam-auth-update to manage selection of other modules.  See
+# pam-auth-update(8) for details.
+#
+
+# here are the per-package modules (the "Primary" block)
+account [success=1 new_authtok_reqd=done default=ignore]        pam_unix.so 
+# here's the fallback if no module succeeds
+account requisite                       pam_deny.so
+# prime the stack with a positive return value if there isn't one already;
+# this avoids us returning an error just because nothing sets a success code
+# since the modules above will each just jump around
+account required                        pam_permit.so
+# and here are more per-package modules (the "Additional" block)
+# end of pam-auth-update config