8 files changed, 169 insertions, 0 deletions

diff --git a/meta/recipes-extended/pam/libpam-1.1.1/99_pam b/meta/recipes-extended/pam/libpam-1.1.1/99_pam
new file mode 100644
index 0000000000..97e990d10b
--- /dev/null
+++ b/meta/recipes-extended/pam/libpam-1.1.1/99_pam
@@ -0,0 +1 @@
+d root root 0755 /var/run/sepermit none
diff --git a/meta/recipes-extended/pam/libpam-1.1.1/disable_crossbinary.patch b/meta/recipes-extended/pam/libpam-1.1.1/disable_crossbinary.patch
new file mode 100644
index 0000000000..43359b08fe
--- /dev/null
+++ b/meta/recipes-extended/pam/libpam-1.1.1/disable_crossbinary.patch
@@ -0,0 +1,34 @@
+padout should be compiled using the native compiler but isn't. 
+Disable this piece of documentation for now.
+
+RP
+
+Index: Linux-PAM-1.0.2/doc/specs/Makefile.am
+===================================================================
+--- Linux-PAM-1.0.2.orig/doc/specs/Makefile.am  2008-11-04 21:06:23.000000000 +0000
++++ Linux-PAM-1.0.2/doc/specs/Makefile.am       2008-11-04 21:07:06.000000000 +0000
+@@ -2,21 +2,8 @@
+ # Copyright (c) 2005, 2006 Thorsten Kukuk <kukuk@suse.de>
+ #
+ 
+-CLEANFILES = draft-morgan-pam-current.txt *~
++CLEANFILES = *~
+ 
+-EXTRA_DIST = draft-morgan-pam.raw std-agent-id.raw rfc86.0.txt
++EXTRA_DIST = std-agent-id.raw rfc86.0.txt
+ 
+-draft-morgan-pam-current.txt: padout draft-morgan-pam.raw
+-       ./padout < $(srcdir)/draft-morgan-pam.raw > draft-morgan-pam-current.txt
+-
+-AM_YFLAGS = -d
+-
+-BUILT_SOURCES = parse_y.h
+-
+-noinst_PROGRAMS = padout
+-
+-padout_SOURCES = parse_l.l parse_y.y
+-
+-padout_LDADD = @LEXLIB@
+-
+-doc_DATA = draft-morgan-pam-current.txt rfc86.0.txt
++doc_DATA = rfc86.0.txt
diff --git a/meta/recipes-extended/pam/libpam-1.1.1/pam.d/common-account b/meta/recipes-extended/pam/libpam-1.1.1/pam.d/common-account
new file mode 100644
index 0000000000..316b17337b
--- /dev/null
+++ b/meta/recipes-extended/pam/libpam-1.1.1/pam.d/common-account
@@ -0,0 +1,25 @@
+#
+# /etc/pam.d/common-account - authorization settings common to all services
+#
+# This file is included from other service-specific PAM config files,
+# and should contain a list of the authorization modules that define
+# the central access policy for use on the system.  The default is to
+# only deny service to users whose accounts are expired in /etc/shadow.
+#
+# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
+# To take advantage of this, it is recommended that you configure any
+# local modules either before or after the default block, and use
+# pam-auth-update to manage selection of other modules.  See
+# pam-auth-update(8) for details.
+#
+
+# here are the per-package modules (the "Primary" block)
+account [success=1 new_authtok_reqd=done default=ignore]        pam_unix.so 
+# here's the fallback if no module succeeds
+account requisite                       pam_deny.so
+# prime the stack with a positive return value if there isn't one already;
+# this avoids us returning an error just because nothing sets a success code
+# since the modules above will each just jump around
+account required                        pam_permit.so
+# and here are more per-package modules (the "Additional" block)
+# end of pam-auth-update config
diff --git a/meta/recipes-extended/pam/libpam-1.1.1/pam.d/common-auth b/meta/recipes-extended/pam/libpam-1.1.1/pam.d/common-auth
new file mode 100644
index 0000000000..460b69f198
--- /dev/null
+++ b/meta/recipes-extended/pam/libpam-1.1.1/pam.d/common-auth
@@ -0,0 +1,18 @@
+#
+# /etc/pam.d/common-auth - authentication settings common to all services
+#
+# This file is included from other service-specific PAM config files,
+# and should contain a list of the authentication modules that define
+# the central authentication scheme for use on the system
+# (e.g., /etc/shadow, LDAP, Kerberos, etc.).  The default is to use the
+# traditional Unix authentication mechanisms.
+
+# here are the per-package modules (the "Primary" block)
+auth    [success=1 default=ignore]      pam_unix.so nullok_secure
+# here's the fallback if no module succeeds
+auth    requisite                       pam_deny.so
+# prime the stack with a positive return value if there isn't one already;
+# this avoids us returning an error just because nothing sets a success code
+# since the modules above will each just jump around
+auth    required                        pam_permit.so
+# and here are more per-package modules (the "Additional" block)
diff --git a/meta/recipes-extended/pam/libpam-1.1.1/pam.d/common-password b/meta/recipes-extended/pam/libpam-1.1.1/pam.d/common-password
new file mode 100644
index 0000000000..3896057328
--- /dev/null
+++ b/meta/recipes-extended/pam/libpam-1.1.1/pam.d/common-password
@@ -0,0 +1,26 @@
+#
+# /etc/pam.d/common-password - password-related modules common to all services
+#
+# This file is included from other service-specific PAM config files,
+# and should contain a list of modules that define the services to be
+# used to change user passwords.  The default is pam_unix.
+
+# Explanation of pam_unix options:
+#
+# The "sha512" option enables salted SHA512 passwords.  Without this option,
+# the default is Unix crypt.  Prior releases used the option "md5".
+#
+# The "obscure" option replaces the old `OBSCURE_CHECKS_ENAB' option in
+# login.defs.
+#
+# See the pam_unix manpage for other options.
+
+# here are the per-package modules (the "Primary" block)
+password        [success=1 default=ignore]      pam_unix.so obscure sha512
+# here's the fallback if no module succeeds
+password        requisite                       pam_deny.so
+# prime the stack with a positive return value if there isn't one already;
+# this avoids us returning an error just because nothing sets a success code
+# since the modules above will each just jump around
+password        required                        pam_permit.so
+# and here are more per-package modules (the "Additional" block)
diff --git a/meta/recipes-extended/pam/libpam-1.1.1/pam.d/common-session b/meta/recipes-extended/pam/libpam-1.1.1/pam.d/common-session
new file mode 100644
index 0000000000..a594dd9d90
--- /dev/null
+++ b/meta/recipes-extended/pam/libpam-1.1.1/pam.d/common-session
@@ -0,0 +1,19 @@
+#
+# /etc/pam.d/common-session - session-related modules common to all services
+#
+# This file is included from other service-specific PAM config files,
+# and should contain a list of modules that define tasks to be performed
+# at the start and end of sessions of *any* kind (both interactive and
+# non-interactive).
+#
+
+# here are the per-package modules (the "Primary" block)
+session [default=1]                     pam_permit.so
+# here's the fallback if no module succeeds
+session requisite                       pam_deny.so
+# prime the stack with a positive return value if there isn't one already;
+# this avoids us returning an error just because nothing sets a success code
+# since the modules above will each just jump around
+session required                        pam_permit.so
+# and here are more per-package modules (the "Additional" block)
+session required        pam_unix.so 
diff --git a/meta/recipes-extended/pam/libpam-1.1.1/pam.d/common-session-noninteractive b/meta/recipes-extended/pam/libpam-1.1.1/pam.d/common-session-noninteractive
new file mode 100644
index 0000000000..b110bb2b49
--- /dev/null
+++ b/meta/recipes-extended/pam/libpam-1.1.1/pam.d/common-session-noninteractive
@@ -0,0 +1,19 @@
+#
+# /etc/pam.d/common-session-noninteractive - session-related modules
+# common to all non-interactive services
+#
+# This file is included from other service-specific PAM config files,
+# and should contain a list of modules that define tasks to be performed
+# at the start and end of all non-interactive sessions.
+#
+
+# here are the per-package modules (the "Primary" block)
+session [default=1]                     pam_permit.so
+# here's the fallback if no module succeeds
+session requisite                       pam_deny.so
+# prime the stack with a positive return value if there isn't one already;
+# this avoids us returning an error just because nothing sets a success code
+# since the modules above will each just jump around
+session required                        pam_permit.so
+# and here are more per-package modules (the "Additional" block)
+session required        pam_unix.so 
diff --git a/meta/recipes-extended/pam/libpam-1.1.1/pam.d/other b/meta/recipes-extended/pam/libpam-1.1.1/pam.d/other
new file mode 100644
index 0000000000..6e40cd0c02
--- /dev/null
+++ b/meta/recipes-extended/pam/libpam-1.1.1/pam.d/other
@@ -0,0 +1,27 @@
+#
+# /etc/pam.d/other - specify the PAM fallback behaviour
+#
+# Note that this file is used for any unspecified service; for example
+#if /etc/pam.d/cron  specifies no session modules but cron calls
+#pam_open_session, the session module out of /etc/pam.d/other is
+#used.  
+
+#If you really want nothing to happen then use pam_permit.so or
+#pam_deny.so as appropriate.
+
+# We use pam_warn.so to generate syslog notes that the 'other'
+#fallback rules are being used (as a hint to suggest you should setup
+#specific PAM rules for the service and aid to debugging). We then 
+#fall back to the system default in /etc/pam.d/common-*
+
+auth       required     pam_warn.so
+auth       include      common-auth
+
+account    required     pam_warn.so
+account    include      common-account
+
+password   required     pam_warn.so
+password   include      common-password
+
+session    required     pam_warn.so
+session    include      common-session